Configuring a Zone Defense Policy (AntiDDoS1820-N/Netflow Detection)

The AntiDDoS1820-N outbound defense policy is used to detect the following types of attack traffic. When the rate or bandwidth of the attack traffic exceeds the preset threshold, the AntiDDoS1820-N reports an anomaly event to the ATIC.

• TCP SYN Flood attack

  Attackers send SYN packets with forged source addresses to hosts. The hosts reply with SYN-ACK packets to the source addresses, but will not receive any ACK packets. As a result, the hosts keep many half-open connections until the connections time out. These half-open connections can exhaust host resources so that the hosts cannot establish normal TCP connections.

• TCP Fragment Flood attack

  TCP fragments seldom occur in normal network traffic. If the number of TCP fragments increases on the network, DDoS attacks may occur. Attackers send large numbers of TCP fragments to the targets, which brings the following adverse impacts:

  • The large numbers of TCP fragments consume bandwidth resources. As a result, the targets respond slowly or even fail to respond.
  • After receiving large numbers of TCP fragments, network devices or servers reassemble the fragments. As a result, the performance of network devices or servers deteriorates, and even they fail to work properly.

• UDP Flood attack

  Attackers use botnets to send a large number of oversized UDP packets at a high rate to target servers, which brings the following adverse impacts:

  • The UDP fragment flood attacks exhaust network bandwidth resources or even congest links.
  • The large numbers of UDP attack packets with changing source IP addresses or ports compromise the performance of session-based forwarding devices or even crash the network to cause denial of service.
  • If the UDP service port of the target server receives attack packets, the server consumes computing resources to verify the attack packets, affecting the processing of legitimate services.

• UDP Fragment Flood attack

  Attackers send large numbers of UDP fragments to the targets, which brings the following adverse impacts:

  • The UDP fragment flood attacks exhaust network bandwidth resources or even congest links.
  • The performance of network devices capable of packet reassembly severely deteriorates.
  • The large numbers of UDP fragments with changing source IP addresses or ports compromise the performance of session-based forwarding devices or even crash the network to cause denial of service.
  • If the UDP service port of the target server receives attack packets, the server consumes computing resources to verify the attack packets, causing the server to respond slowly or fail to respond to legitimate services.

• ICMP Flood attack

  Attackers send mass ICMP packets to the target in a short period of time, exhausting session resources on network devices. If the attackers send oversized packets over a network link, the network link may be congested.