Wanguard 6.2 User Guide
Choosing a Method of DDoS Mitigation
Choosing a Method of DDoS Mitigation
Wanguard provides a network-level protection against volumetric Denial of Service attacks by using several
complementary methods:
➢
Wanguard Sensor
can be configured to announce via BGP the upstream provider(s) to stop routing
traffic towards the attacked destinations. This is a simple, widely-used DDoS protection technique as it
requires only a preexistent agreement with your BGP peer(s). The attacked targets are effectively
blocked from accessing the Internet, leaving upstream links and all other destinations not congested
during attacks.
➢
Wanguard Sensor
can trigger an Internet Service Provider (ISP) or Managed Security Service Provider
(MMSP) that offers anti-DDoS services to start scrubbing the malicious packets in cloud.
➢
Wanguard Filter
can clean malicious packets on-premise by applying dynamic filtering rules on stateless
software firewalls and hardware packet filters. Dedicated filtering servers can be clustered in packet
scrubbing farms. This method protects critical services against attacks that do not congest the upstream
links.
➢
Wanguard Filter
can apply filtering rules on third-party DDoS mitigation appliances, firewalls, load-
balancers or routers via helper scripts or by using BGP FlowSpec.
➢
Wanguard Filter
can be configured to send notification emails to the ISP's originating non-spoofed
attacks.
DDoS Mitigation with Wanguard Filter
When a Sensor detects that a destination is under attack, it executes a Response that can activate a Filter
instance. Filter instances cannot run stand-alone and can only be started through Responses.
Wanguard Filter includes a sophisticated traffic analysis engine that detects
attack patterns
by inspecting
packets or flows sent to the attacked destinations.
Each attack pattern is formed by malicious packets that share some common OSI Layer 3-7 data:
When an attack is launched from a non-spoofed IP address, the attack pattern is always the IP of the
attacker.
When the attack is spoofed and comes from random IP addresses, the attack pattern can be a common
source or destination TCP or UDP port, source or destination IP address, IP protocol number, packet
length, packet content, TTL, ICMP type, DNS Transaction ID, originating country, and so on.
When Wanguard Filter detects multiple attack patterns, it generates only the filtering rule(s) that have
the least negative impact on regular customer traffic.
Each attack pattern detected by Wanguard Filter is translated into a
filtering rule
that can be applied on the
server's NetFilter stateless firewall, on the network adapter's hardware packet filter, or on third-party appliances.
Wanguard Filter is designed to generate filtering rules that block malicious traffic in a granular manner, without
impacting the user experience or resulting in downtime.
- 10 -
Summary of Contents for wanguard 6.2
Page 1: ......
