Session 3 Response Measure

1
Session 3Response Measure

• Traceback
• React

2
Traceback Attacks to the Source
3
Traceback Essentials
4
Traceback Valid IPv4 Source Addresses
5
Traceback Valid IPv4 Source Addresses
6
Traceback Spoofed IPv4 Addresses
7
Traceback via Hop by Hop Technique
8
Traceback via Hop by Hop Technique
9
Traceback via the Jump to Ingress Technique
10
Traceback via the Jump to Ingress Technique
11
Traceback Spoofed IPv4 Addresses
12
Traceback with ACLs
13
Traceback with ACLs
14
Traceback with Netflow
15
Traceback with Netflow
16
show ip cache flow
17
Traceback with Netflow
18
Traceback with Netflow
19
Traceback with Netflow
20
Backscatter Traceback Technique
21
Backscatter Traceback Technique
22
Backscatter Traceback Technique
23
Backscatter Traceback Preparation
24
Backscatter Traceback Preparation
25
Backscatter Traceback Preparation
26
Backscatter Traceback Preparation
27
Backscatter Traceback Preparation
28
Backscatter Traceback Preparation
29
Backscatter Traceback Preparation
30
Backscatter Traceback Activation
31
Backscatter Traceback Activation
32
Backscatter Traceback Activation
33
Backscatter Traceback Activation
34
Backscatter Traceback Activation
35
Backscatter Traceback Activation
36
Traceback with Edge Probes
37
Traceback Summary
38
React to the Attack
39
Reaction Tools
40
Reacting to an Attack with CAR
41
Reacting to an Attack with CAR
42
Reacting to an Attack with CAR
43
Reacting to an Attack with CAR
44
Reacting to an Attack with CAR with Remote Trigger
45
Reacting to an Attack with CAR with Remote Trigger
46
Reacting to an Attack with CAR with Remote Trigger
47
Reacting to an Attack with CAR with Remote Trigger
48
Detect Affirm
49
Sink Hole Router
50
Sink Hole Architecture
51
Example slapper worm 2002.9
52
Sink Hole Detect worm
53
Track DoS Attack
54
IRR Network Information
55
IRR AS
56
IP Source Tracker
57
IP Source Tracker
58
IP Source Tracker configure
59
Use Netflow
60
Show Ip Cache Flow
61
Show IP cache verbose flow
62
Use ACL to Track
63
Use IXP to track
64
ICMP Unreachable
65
How to find router drop packet
66
ICMP back scatter
67
ICMP back scatter
68
ICMP back scatter
69
Track DoS summary
70
Anti Dos DDos measure
71
Remote Triggered Black Hole
72
Remote Triggered Black Hole
73
Remote Triggered Black Hole
74
Remote Triggered Black Hole
75
Remote Triggered Black Hole
76
Triggered source address drop packet
77
Loose uRPF
78
Source based remote triggered black hole
79
Source based remote triggered black hole
80
Date Cleanout
81
Departure from the victim
82
Remote triggered rate limit
83
Summary
84
What can we do?
85
Suggestion
86
Other notion