Blackhole BGP – Huawei (Huawei NE20, Huawei NE40, Huawei NE8000/NE8k)
How to Setup a BGP Blackhole on Huawei (Huawei NE20, Huawei NE40, Huawei NE8000/NE8k)
I am suffering from DDoS Attacks, now what?!
Calm down, very calm! You are neither the first nor the last to suffer from DDoS attacks. At first it is hopeless, but there are techniques that can help you tackle this major problem in your network. Let’s go, I have separated in a few parts what to do Identify if it is really an attack and who is attacking False positives are common—situations where you think it’s an attack, but it’s actually abnormal traffic. For example, consider a Windows update, an Apple iOS update, or updates on Android devices, where multiple devices update at the same time, making it appear to be an attack, but it is real traffic, albeit abnormal. If your case is not a false-positive and you really confirm that it is a DDoS Attack the next step is to identify which interfaces and where the attack is directed, to which client or which equipment. But how do you do that? There are several ways to track this traffic, including If it is a Mikrotik Router you can use the Torch Tool (Tools -> Torch) and analyze which IP has an abnormal consumption If you’re using a server or router running Linux or FreeBSD, you can use tcpdump to analyze which IP addresses are exhibiting abnormal traffic. On Cisco, Juniper, Huawei, or Nokia routers, you’ll need a NetFlow analyzer such as Made4Flow to identify which IP addresses are exhibiting abnormal traffic. If you are unable to use NetFlow (Netstream, jFlow, NetFlow v5/v9/IPFIX, or RouterOS Traffic Flow), you can set up port mirroring to mirror traffic from your router’s port to a server or host that can analyze the traffic But with so much traffic, how can you tell if something is abnormal? DDoS attacks generally occur on ports that use amplification; as mentioned in our article on what a DDoS is, examples include NTP and SSDP. If you observe higher-than-normal traffic (usually involving a large number of packets and high bandwidth from various sources) directed at a specific IP address, you can move on to the next step. Use the Blackhole – RTBH Blackhole, or RTBH (Remote Triggered Blackhole), is a technique in which we literally send an IP address to the “black hole,” causing that IP address to stop functioning both on your network and on the Internet, thereby stopping the attack. Through a BGP announcement, it is possible to make the IP address stop functioning and notify your ISPs that it should not receive any traffic. Blackhole solves the problem for attacks targeting one or a few IP addresses, but if the attack targets many IP addresses, Blackhole is not effective due to the maximum number of prefixes advertised in the BGP session. If you want to know more about Blackhole check out our article! Pros: Easily configured Broad support (all routers support it) Attack is stopped quickly Cons: – The IP will stop working completely – If the attack is directed at multiple IP’s it can be a bigger problem Blackhole works, but only to a certain extent; in larger attacks, or if the attacks are persistent and the techniques change—targeting multiple systems—it won’t meet your needs. Use a Mitigation Link or Scrubbing Center When attacks change and begin targeting multiple IP addresses, the blackhole technique will not be sufficient to meet the demand, and in order to continue operating, someone must filter out the attack traffic from the legitimate traffic; To this end, there are companies that sell mitigation services known as Scrubbing Centers or Anti-DDoS services. With this type of link, you route your download traffic to them via BGP, and they will use their servers, routers, appliances, and techniques to filter out attack traffic from legitimate traffic. If you’d like to learn more about Mitigation Link, check out our article—we explain how it works in more detail there. Pros: The attacked IP(s) are still working The whole problem of receiving the attack is transferred to these companies Cons: Cost of this link Increased latency A more complex configuration, as it requires BGP traffic engineering while the attack is in progress Automate everything DDoS attacks will occur when you least expect them, so creating the protection framework with automation is extremely necessary. To this end, Made4Flow features an Anti-DDoS module that can either send an IP address to a blackhole or route it to the mitigation system when it detects a DDoS attack. With it you can receive alerts via e-mail and have the peace of mind that the tool is working for you and taking automated actions to protect your network. If you like this post, please share it! In the next articles we will tell you how to prevent attacks, how to set up a blackhole on Mikrotik, Cisco, Juniper or Huawei routers and many more information about DDoS. Until next time
RTBH Blackhole, what is it?
Blackhole—or, literally, “black hole”—is a technique that discards packets destined for a specific IP address or range of IP addresses at an Internet Service Provider’s edge routers (BGP). Once a DDoS attack is detected, Blackhole can be used to drop all traffic destined for the attacked IP address or range of IP addresses, thereby protecting the network from overload or shutdown due to the volume of DDoS traffic. RTBH, or Remote Triggered Blackhole, is a technique that uses BGP to easily drop traffic destined for the targeted IP address at the backbone or at the BGP layer, thereby preventing the entire network from going down or experiencing performance degradation due to a DDoS attack. To make the explanation easier let’s give an example: The provider XPTO has the prefix 200.200.200.0/24 associated with its ASN123456, and within this provider there is a company Bubble that suffered a DDoS attack, so that the provider’s network XPTO not stop completely, they add the configuration of blackhole for this company Bubble, thus protecting your infrastructure and leaving only the company Bubble without services What are the pros and cons? Pros: Efficient against DDoS attacks Its deployment is very simple and fast Support for all vendors (equipment brands) Widely deployed in Operators of all sizes Cons: The blackhole IP stops working completely In attacks directed to several IP’s it can generate more problems than solutions How does Blackhole work in practice? As soon as the attack is detected—either through NetFlow analysis (Made4Flow is an example of NetFlow analysis software) or via a port mirror—and the destination IP address of the DDoS attack is determined, you can configure the router to send the route to a blackhole or, more specifically, to Null0 (on Cisco/Huawei routers) or Discard (Juniper) or Blackhole (Mikrotik), literally sending that route to the “black hole” and thereby discarding the traffic destined for that IP address. In the world of BGP it is possible to send this Blackhole route to your carrier so that it can discard the packets within its network and also send it to all the carriers so that the whole world knows that this IP no longer works. We will show later how Blackhole works in the BGP world. How to configure the Blackhole?After determining the attacked IP the Router operator accesses the equipment, configures a static route with the Attack destination IP being its next-hop (or gateway) as Null0 or Blackhole An example of a configuration on Huawei routers uses the following syntax: [~rt-huawei-ne40]ip route-static 200.200.200.200 32 NULL 0 Explanation of the command: All packets destined for IP address 200.200.200.200 will be sent to Null0 (Blackhole), and thus all traffic to that address will be discarded. You still need to advertise this blackhole route via BGP so that your ISPs receive it and also discard traffic destined for that compromised IP address. To make this clearer, the image below illustrates the entire blackhole advertising process. In the following articles we will show you how to configure Blackhole on Huawei, Cisco, Juniper, and Mikrotik routers. If you have any questions, please contact us on social media or via WhatsApp!Until the next articles!
Agile Methodologies – What they are and how they can help your team
Why should you monitor your Infrastructure? (Lucas Kazama)
Since it is such a present and important resource in our daily lives, it is necessary for providers to be certain that the equipment and services in their networks are working with 100% of the efficiency and security for which they were developed.
What is NOC?
First of all, it is necessary to understand what a NOC is. NOC (Network Operation Center) is the Network Operations Center, which can be one or more locations where network monitoring or management takes place. Using tools to collect data about equipment and services, the NOC is able to identify failures and quickly find ways to repair these failures. Infrastructure monitoring is essential because it makes the maintenance and management process more dynamic, since its priority is to ensure that the network is running as efficiently as possible. Avoiding problems such as unnecessary expenses, service interruption, and slow service delivery. To better understand how the NOC facilitates network management, let’s imagine a scenario in which an ISP is facing problems with increased demand for bandwidth, even though it has links capable of handling that demand. In this case, let’s assume that the problem stems from the fact that the network is unbalanced—that is, all traffic is trying to pass through the same link, causing that link to become a bottleneck. With effective monitoring, this type of problem would be easily detected and corrected, preventing issues with angry customers calling to complain about service quality and even preventing the loss of some of those customers. In addition to helping identify the problem, the NOC also makes it easier to understand the issue, allowing the support team to take action more quickly. Usually support teams know there is a problem, but most of the time they do not know where the problem is, which results in a longer time to solve the problem. If a NOC is analyzing the network, the failure can be identified even before it affects service delivery. For example, a link that is coming close to its maximum capacity, equipment that is experiencing cooling system failures, servers that are coming close to their maximum memory capacity. All of this is identified by monitoring, making the need for preventive maintenance more visible and avoiding future problems. NOC is not simple monitoring, an efficient NOC team means care for the network and consideration for the customers that hire their services. Having a monitoring goes far beyond knowing what is happening on the net, as it enables you to expand your horizons and focus on new areas.
Cyber attacks, what are they?
How to manage a 24×7 team?
To keep a 24/7 team running well some procedures and dynamics are necessary. It is extremely important that all team members understand how essential it is to pass information from one shift to another; for each incident that occurs, a summary must be ready so that the next attendant is not “lost” and does not know the context of the dialogs with the customer. Due to the fact that without information we would not be able to be an effective 24/7 team, we always carry out dynamics to improve our internal communication. We have a group where any member of the team can send messages at any time of the day and someone will always be willing to help. Another concern is dealing with the early morning. Because this is a sensitive time, the team members covering the early morning shifthave slightly different training focused on analysis so that they can understand the incidents and make decisions whether or not to contact the customer. Periodically, the supervisor spends an early morning with them to analyze the team’s performance at all times, to detect difficulties or possible points of improvement, thus making it easier and more dynamic for the employees and consequently making the service more efficient for the customer. Hold monthly meetings to listen to the team as they discuss their challenges and share their suggestions, but also to address the mistakes they’ve made—always making sure to highlight the team’s successes. This way, we can maintain a good relationship among everyone on the team, and eventually the team becomes self-managing. The attendants themselves detect and correct the errors, only reporting to the supervisor. This is of course all on a small scale, but this method proves to be very efficient and can scale as the team grows.
What are DDoS attacks?
DDoS or Distributed Denial of Services, also known as denial of service attack, is a type of cyber attack (if you want to know more check out our article on Cyber Attacks) where the hacker (or attacker/attacker) tries to overload a server, a piece of network equipment such as router, switch, BRAS/BNG, firewall, a computer or a network so that services or their use become unavailable. Distributed denial-of-service (DDoS) attacks are not intended to steal information from victims, but rather to take down or render a network or service inoperable (think of a service as a web server, a database, or a banking application). A DDoS attack can also serve as a “smokescreen” to hide other attacks that may occur at the same time—attacks that are actually intended to steal information. Unlike DoS attacks, where only one computer or host is used in the attack, DDoS attacks use thousands or even millions of computers and devices to attack their victims Plus why would anyone do that?! Among the various reasons for a DDoS attack, the most common ones over time are: But now in 2021 do I need to worry about DDoS? The answer is: YOU REALLY NEED to be concerned about this. Below are some news stories from around the world: And it is not only big people that take DDoS attacks, like a carrier or a big service company, over the years we have seen many small companies taking DDoS attacks with high volume and many different forms of attack. A second factor to be concerned about is the cost of launching a DDoS attack; some websites offer “DDoS starting at 5 euros,” so if someone has a little money, they don’t need to be a hacker to launch a DDoS attack against someone. So if you have a network, it’s important to be concerned about DDoS attacks. But how does a DDoS attack work? Here in this article I will explain how it works in a very basic way, if you want to know a little more in depth check out our more detailed article How a DDoS Attack Works. DDoS attacks usually occur through botnets or zombie networks controlled by hackers. These networks can consist of millions of devices controlled by hackers, who can simply send a command for all these devices to start sending packets to the victim, thereby launching a DDoS attack. Various devices are susceptible to becoming zombies in a botnet, such as: computers infected with viruses, security cameras with vulnerabilities, residential routers (or CPEs) with vulnerabilities, IoT devices, and even your smart refrigerator can be a zombie in a botnet. The image below demonstrates a little better how a DDoS works:
Most commonly used programming languages and tools – Rhuan Yago
Many people who want to learn programming have common questions, and one of the main ones is exactly which tools companies typically use in their day-to-day work. In this post, we’ll tell you about the main tools used by our development team
