Intelligent manipulation of denial-of-service attack traffic
Systems and methods for improved intelligent manipulation of distributed-denial-of-service (DDoS) attack traffic are provided. In implementations, a method may include receiving, at a traffic management system, a mirrored first stream of packets from a router on a first link and a mirrored second stream of packets from the router on a second link. The method may further include determining flow information about the first stream. In examples, the flow information may indicate that a challenge to a particular source IP address has been issued to test the legitimacy of the source IP address. The method may further include sending, by the traffic management system, a routing policy update based on the flow information.
1. A method, comprising:
receiving, at a traffic management system, a first stream of packets from a router on a first link and a second stream of packets from the router on a second link, wherein the first stream of packets comprises traffic from a first network element operatively connected to the router and the second stream of packets comprises traffic from a second network element operatively connected to the router;
determining flow information about the first stream, wherein the flow information indicates that the first network element has received at least one packet from the router that comprises a first source Internet protocol (IP) address and a first destination IP address, and wherein at least a first parameter of the first stream indicates that the first network element has sent a return packet to the source IP address;
sending, by the traffic management system, a routing policy update, wherein the routing policy update causes at least a routing table at the router to be updated to require that all traffic received by the router having the first source IP address and the first destination IP address be routed to the first network element.
2. The method of claim 1 , wherein the routing policy update is applied for a determined period of time.
3. The method of claim 2 , wherein the determined period of time is based upon the flow information.
4. The method of claim 1 , further comprising:
determining flow information about the second stream, wherein the flow information indicates that the second network element has received at least one packet from the router that comprises a second source Internet protocol (IP) address and a second destination IP address, and wherein at least a second parameter of the second stream indicates that the second network element has sent a return packet to the second source IP address;
sending, by the traffic management system, a second routing policy update, wherein the second routing policy update causes at least a second routing table at the router to be updated to require that all traffic received by the router having the second source IP address and second destination IP address be routed to the second network element.
5. The method of claim 1 , wherein the first network element is a scrubber.
6. The method of claim 5 , wherein the first parameter of the first stream indicates that a challenge has been issued by the scrubber to the source IP address.
7. The method of claim 1 , further comprising:
determining flow information about the second stream, wherein the flow information indicates that the second network element has received at least one packet from the router that comprises a second source Internet protocol (IP) address and a second destination IP address, and wherein at least a second parameter of the second stream indicates that the second network element has sent a return packet to the second source IP address;
determining that a current routing policy exists for the second source IP address and the second destination IP address; and
based on determining that the current routing policy exists, determining, by the traffic management system, not to send a second routing policy update.
8. A system comprising:
at least one processor; and
memory, operatively coupled to the at least one processor, the memory storing computer executable instructions that, when executed by the at least one processor, cause the system to perform a method comprising:
receiving, at a traffic management system, a first stream of packets from a router on a first link and a second stream of packets from the router on a second link, wherein the first stream of packets comprises traffic from a first network element operatively connected to the router and the second stream of packets comprises traffic from a second network element operatively connected to the router;
determining flow information about the first stream, wherein the flow information indicates that the first network element has received at least one packet from the router that comprises a first source Internet protocol (IP) address and a first destination IP address, and wherein at least a first parameter of the first stream indicates that the first network element has sent a return packet to the source IP address;
sending, by the traffic management system, a routing policy update, wherein the routing policy update causes at least a routing table at the router to be updated to require that all traffic received by the router having the first source IP address and the first destination IP address be routed to the first network element.
9. The system of claim 8 , wherein the routing policy update is applied for a determined period of time.
10. The system of claim 9 , wherein the determined period of time is based upon the flow information.
11. The system of claim 8 , wherein the method further comprises:
determining flow information about the second stream, wherein the flow information indicates that the second network element has received at least one packet from the router that comprises a second source Internet protocol (IP) address and a second destination IP address, and wherein at least a second parameter of the second stream indicates that the second network element has sent a return packet to the second source IP address;
sending, by the traffic management system, a second routing policy update, wherein the second routing policy update causes at least a second routing table at the router to be updated to require that all traffic received by the router having the second source IP address and second destination IP address be routed to the second network element.
12. The system of claim 8 , wherein the first network element is a scrubber.
13. The system of claim 12 , wherein the first parameter of the first stream indicates that a challenge has been issued by the scrubber to the source IP address.
14. The system of claim 8 , wherein the method further comprises:
determining flow information about the second stream, wherein the flow information indicates that the second network element has received at least one packet from the router that comprises a second source Internet protocol (IP) address and a second destination IP address, and wherein at least a second parameter of the second stream indicates that the second network element has sent a return packet to the second source IP address;
determining that a current routing policy exists for the second source IP address and the second destination IP address; and
based on determining that the current routing policy exists, determining, by the traffic management system, not to send a second routing policy update.
15. A system comprising:
a router;
a first network element, operatively connected to the router;
a second network element, operatively connected to the router; and
a traffic management system, operatively connected to the router and configured to:
receive a first stream of packets from the router on a first link and a second stream of packets from the router on a second link, wherein the first stream of packets comprises traffic from the first network element and the second stream of packets comprises traffic from the second network element;
determine flow information about the first stream, wherein the flow information indicates that the first network element has received at least one packet from the router that comprises a first source Internet protocol (IP) address and a first destination IP address, and wherein at least a first parameter of the first stream indicates that the first network element has sent a return packet to the source IP address;
send a routing policy update, wherein the routing policy update causes at least a routing table at the router to be updated to require that all traffic received by the router having the first source IP address and the first destination IP address be routed to the first network element.
16. The system of claim 15 , wherein the routing policy update is applied for a determined period of time.
17. The system of claim 16 , wherein the determined period of time is based upon the flow information.
18. The system of claim 15 , wherein the first network element is a scrubber.
19. The system of claim 18 , wherein the first parameter of the first stream indicates that a challenge has been issued by the scrubber to the source IP address.
20. The system of claim 15 , wherein the traffic management system is further configured to:
determine flow information about the second stream, wherein the flow information indicates that the second network element has received at least one packet from the router that comprises a second source Internet protocol (IP) address and a second destination IP address, and wherein at least a second parameter of the second stream indicates that the second network element has sent a return packet to the second source IP address;
determine that a current routing policy exists for the second source IP address and the second destination IP address; and
based on determining that the current routing policy exists, determine not to send a second routing policy update.