FastNetMon - ENOG9 speech about DDoS mitigation
•
5 likes•8,451 views
Speech at NANOG9 about FastNetMon - open source DDoS detection solution: https://github.com/FastVPSEestiOu/fastnetmon
Report
Share
Report
Share
Download to read offline
Recommended
FastNetMon Advanced DDoS detection tool
Slides about DDoS detection tool. IPFIX, sFlow, Netflow support. Instant detection. Complete API and command line tools.
Free trial: https://fastnetmon.com/trial/
DDoS Mitigation Tools and Techniques
This document discusses techniques for mitigating distributed denial of service (DDoS) attacks, including remotely triggered black hole filtering (RTBH) and BGP FlowSpec. It provides an overview of DDoS attack trends, types, and impacts. It also introduces the open-source FastNetMon tool for DDoS detection using network telemetry and introducing mitigation actions like flow blocking through integration with tools like ExaBGP.
Ripe71 FastNetMon open source DoS / DDoS mitigation
This document describes FastNetMon, an open source DDoS mitigation toolkit. It provides concise summaries of network traffic and detects DDoS attacks in real-time. It can block malicious traffic through methods like BGP announcements. FastNetMon supports many Linux distributions and can integrate with hardware/cloud solutions. It detects attacks faster than traditional hardware/service approaches through optimized packet capture using tools like Netmap and PF_RING.
9534715
This document discusses using fastnetmon and ExaBGP to monitor and mitigate DDoS attacks at the University of Wisconsin-Platteville. Fastnetmon monitors network traffic in real-time and detects DDoS attacks based on packet, bandwidth, and flow thresholds. It then triggers ExaBGP to inject blackhole routes to drop attack traffic while allowing legitimate traffic to pass. This integrated solution allows the university to automatically detect and mitigate DDoS attacks in near real-time.
Ultra fast DDoS Detection with FastNetMon at Coloclue (AS 8283)
This document discusses how Coloclue, a non-profit volunteer-driven ISP, automated the detection and mitigation of DDoS attacks through the use of FastNetMon and BIRD. FastNetMon allows for detection of attacks within 3 seconds by monitoring traffic levels. BIRD then injects selective blackhole routes within 1 second to mitigate attacks by dropping traffic for 1 IP or subnet for 60 seconds. This approach solves the DDoS problem within 4 seconds through 100% automated detection and mitigation.
GoBGP : yet another OSS BGPd
GoBGP is an open source BGP implementation written in Go that aims for high performance. It uses gRPC for its API-first architecture and OpenConfig for its vendor-neutral configuration model. Some key uses of GoBGP include as a high performance route server, for integration with data analysis systems via its APIs, and as a BGP implementation for whitebox switches.
DDoS Mitigation using BGP Flowspec
This document discusses using BGP Flowspec for DDoS mitigation. It provides an overview of legacy DDoS mitigation methods, describes how BGP Flowspec works by distributing flow specifications using BGP, and gives examples of how it can be used for inter-domain and intra-domain DDoS mitigation as well as with a scrubbing center. It also discusses vendor support, advantages over previous methods, potential issues, real world deployments, and the current state and future of BGP Flowspec.
BGP FlowSpec experience and future developments
This document discusses BGP FlowSpec, which is a technique for mitigating DDoS attacks. It provides an overview of FlowSpec implementations by various vendors and open source tools. It also discusses operational experience with FlowSpec deployments. While FlowSpec works well against many amplification attacks, the document notes some limitations and areas for improvement. This includes improving router scale, adding flexibility to payload matching, and developing standards for traffic reporting across administrative domains. Overall, FlowSpec is presented as a mature mitigation technique, but one that requires continued development and vendor/operator collaboration to address evolving attacks.
Recommended
FastNetMon Advanced DDoS detection tool
Slides about DDoS detection tool. IPFIX, sFlow, Netflow support. Instant detection. Complete API and command line tools.
Free trial: https://fastnetmon.com/trial/
DDoS Mitigation Tools and Techniques
This document discusses techniques for mitigating distributed denial of service (DDoS) attacks, including remotely triggered black hole filtering (RTBH) and BGP FlowSpec. It provides an overview of DDoS attack trends, types, and impacts. It also introduces the open-source FastNetMon tool for DDoS detection using network telemetry and introducing mitigation actions like flow blocking through integration with tools like ExaBGP.
Ripe71 FastNetMon open source DoS / DDoS mitigation
This document describes FastNetMon, an open source DDoS mitigation toolkit. It provides concise summaries of network traffic and detects DDoS attacks in real-time. It can block malicious traffic through methods like BGP announcements. FastNetMon supports many Linux distributions and can integrate with hardware/cloud solutions. It detects attacks faster than traditional hardware/service approaches through optimized packet capture using tools like Netmap and PF_RING.
9534715
This document discusses using fastnetmon and ExaBGP to monitor and mitigate DDoS attacks at the University of Wisconsin-Platteville. Fastnetmon monitors network traffic in real-time and detects DDoS attacks based on packet, bandwidth, and flow thresholds. It then triggers ExaBGP to inject blackhole routes to drop attack traffic while allowing legitimate traffic to pass. This integrated solution allows the university to automatically detect and mitigate DDoS attacks in near real-time.
Ultra fast DDoS Detection with FastNetMon at Coloclue (AS 8283)
This document discusses how Coloclue, a non-profit volunteer-driven ISP, automated the detection and mitigation of DDoS attacks through the use of FastNetMon and BIRD. FastNetMon allows for detection of attacks within 3 seconds by monitoring traffic levels. BIRD then injects selective blackhole routes within 1 second to mitigate attacks by dropping traffic for 1 IP or subnet for 60 seconds. This approach solves the DDoS problem within 4 seconds through 100% automated detection and mitigation.
GoBGP : yet another OSS BGPd
GoBGP is an open source BGP implementation written in Go that aims for high performance. It uses gRPC for its API-first architecture and OpenConfig for its vendor-neutral configuration model. Some key uses of GoBGP include as a high performance route server, for integration with data analysis systems via its APIs, and as a BGP implementation for whitebox switches.
DDoS Mitigation using BGP Flowspec
This document discusses using BGP Flowspec for DDoS mitigation. It provides an overview of legacy DDoS mitigation methods, describes how BGP Flowspec works by distributing flow specifications using BGP, and gives examples of how it can be used for inter-domain and intra-domain DDoS mitigation as well as with a scrubbing center. It also discusses vendor support, advantages over previous methods, potential issues, real world deployments, and the current state and future of BGP Flowspec.
BGP FlowSpec experience and future developments
This document discusses BGP FlowSpec, which is a technique for mitigating DDoS attacks. It provides an overview of FlowSpec implementations by various vendors and open source tools. It also discusses operational experience with FlowSpec deployments. While FlowSpec works well against many amplification attacks, the document notes some limitations and areas for improvement. This includes improving router scale, adding flexibility to payload matching, and developing standards for traffic reporting across administrative domains. Overall, FlowSpec is presented as a mature mitigation technique, but one that requires continued development and vendor/operator collaboration to address evolving attacks.
Implementing BGP Flowspec at IP transit network
This document discusses implementing BGP Flowspec at an IP transit network to help mitigate distributed denial of service (DDoS) attacks. BGP Flowspec allows network operators to announce flow specifications via BGP to define distributed access lists across their network. The document outlines BGP Flowspec options, typical attack scenarios with and without its use, implementation considerations, validation of rules, statistics collection, and plans for a web portal and integration with attack detection systems. Over 85% of detected DDoS traffic was found to originate from foreign interfaces, showing BGP Flowspec's effectiveness against such attacks.
BGP Flowspec (RFC5575) Case study and Discussion
BGP Flowspec is a technique for distributing flow specification rules via BGP. It allows an ISP to dynamically distribute filtering and redirection rules to mitigate DDoS attacks. The document discusses several real-world use cases where BGP Flowspec was deployed to successfully block large DDoS attacks in a targeted manner without affecting legitimate traffic. However, interoperability between vendors and scalability challenges remain open issues requiring further work and testing.
macvlan and ipvlan
macvlan and ipvlan allow VMs and containers to have direct exposure to the host network by assigning them their own MAC/IP addresses without requiring a bridge. macvlan uses MAC addresses to separate traffic while ipvlan uses layer 3. Both are lighter weight than bridges. macvlan is commonly used in bridge mode to allow communication between VMs/containers on the same host, while ipvlan may be preferred when MAC limits are in place or for untrusted networks.
BGP Update Source
This document discusses using a loopback interface as the update source for BGP sessions. It explains that when there are multiple paths between BGP neighbors, using a loopback interface ensures the BGP session will not go down if the physical interface fails. It provides the configuration to enable this by specifying the loopback interface in the neighbor update-source command. An example topology is shown connecting routers with EIGRP and configuring BGP between the routers using a loopback interface as the update source.
Обеспечение безопасности сети оператора связи с помощью BGP FlowSpec
The document discusses using BGP FlowSpec to provide network security for an internet service provider. It begins with an introduction to BGP FlowSpec, describing its components and how rules are distributed using BGP. It then covers using BGP FlowSpec for different DDoS mitigation scenarios, including stateless amplification attacks, stateless L3/L4 attacks, and stateful attacks targeting application resources. Configuration and other use cases are also briefly mentioned.
ISP load balancing with mikrotik nth
In this webinar, we discussed an advanced topic of mikrotik firewall features: nth packet matcher. we assumed the readers already have a solid understanding of prerequisite knowledge.
we started the discussion with the basic concepts of traffic load balancing, and then move to the nth discussion.
The recording is available on youtube (GLC Networks Channel): https://youtu.be/s0JxxdKuh58
netfilter and iptables
netfilter is a framework provided by the Linux kernel that allows various networking-related operations to be implemented in the form of customized handlers.
iptables is a user-space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall (implemented as different netfilter modules) and the chains and rules it stores.
Many systems use iptables/netfilter, Linux's native packet filtering/mangling framework since Linux 2.4, be it home routers or sophisticated cloud network stacks.
In this session, we will talk about the netfilter framework and its facilities, explain how basic filtering and mangling use-cases are implemented using iptables, and introduce some less common but powerful extensions of iptables.
Shmulik Ladkani, Chief Architect at Nsof Networks.
Long time network veteran and kernel geek.
Shmulik started his career at Jungo (acquired by NDS/Cisco) implementing residential gateway software, focusing on embedded Linux, Linux kernel, networking and hardware/software integration.
Some billions of forwarded packets later, Shmulik left his position as Jungo's lead architect and joined Ravello Systems (acquired by Oracle) as tech lead, developing a virtual data center as a cloud-based service, focusing around virtualization systems, network virtualization and SDN.
Recently he co-founded Nsof Networks, where he's been busy architecting network infrastructure as a cloud-based service, gazing at internet routes in astonishment, and playing the chkuku.
From NAT to NAT Traversal
This document discusses network address translation (NAT) and NAT traversal techniques. It begins with an overview of NAT and why NAT traversal is needed to access network resources behind NAT. It then covers various NAT traversal solutions including port forwarding, NAT traversal protocols like STUN and TURN, and implementations like ICE and WebRTC that use these protocols. The document provides examples and diagrams to illustrate key NAT concepts and how different traversal techniques work.
Entropy and denial of service attacks
Denial of Service attacks – Definitions, related surveys
Traceback of DDoS Attacks – Proposed method, advantages, future work
Detection methods with Shannon and Renyi cross entropy – Previous works, proposed method, dataset and results
The added value of entropy detection methods
References
BGP filter with mikrotik
In this webinar, we start the discussion with an introduction to BGP like AS to AS connection, comparison BGP routing and traditional routing, also BGP peering. we then talk about problem that might occur during BGP peering, its effects, and the solution. finally we cover an example of how to configure BGP filter on mikrotik.
The recording is available on youtube (GLC Networks Channel): https://www.youtube.com/channel/UCI611_IIkQC0rsLWIFIx_yg
Network LACP/Bonding/Teaming with Mikrotik
Webinar topic: Network LACP/Bonding/Teaming with Mikrotik
Presenter: Achmad Mardiansyah
In this webinar series, How Network LACP/Bonding/Teaming with Mikrotik
Please share your feedback or webinar ideas here: http://bit.ly/glcfeedback
Check our schedule for future events: https://www.glcnetworks.com/en/schedule/
Follow our social media for updates: Facebook, Instagram, YouTube Channel, and telegram also discord
Recording available on Youtube
https://youtu.be/smRcyLE42hU
OSPF On Router OS7
Webinar topic: OSPF On Router OS7
Presenter: Achmad Mardiansyah & M. Taufik Nurhuda
In this webinar series, How OSPF On Router OS7
Please share your feedback or webinar ideas here: http://bit.ly/glcfeedback
Check our schedule for future events: https://www.glcnetworks.com/en/schedule/
Follow our social media for updates: Facebook, Instagram, YouTube Channel, and telegram also discord
Recording available on Youtube
https://youtu.be/nuByFdZHvAg
Linux Network Stack
- The document discusses Linux network stack monitoring and configuration. It begins with definitions of key concepts like RSS, RPS, RFS, LRO, GRO, DCA, XDP and BPF.
- It then provides an overview of how the network stack works from the hardware interrupts and driver level up through routing, TCP/IP and to the socket level.
- Monitoring tools like ethtool, ftrace and /proc/interrupts are described for viewing hardware statistics, software stack traces and interrupt information.
Cisco IPv6 Tutorial
This document outlines an IPv6 lab and techtorial that covers IPv6 addressing, neighbor discovery, static routing, OSPFv3, BGP, and tunneling. The agenda includes lectures on these topics as well as corresponding labs to provide hands-on experience. Prerequisites for the session are basic network engineering knowledge and interest in Cisco technologies. The document then goes on to describe IPv6 addressing formats, types of addresses, and how addresses are allocated to interfaces.
Introduction to eBPF and XDP
This document provides an introduction to eBPF and XDP. It discusses the history of BPF and how it evolved into eBPF. Key aspects of eBPF covered include the instruction set, JIT compilation, verifier, helper functions, and maps. XDP is introduced as a way to program the data plane using eBPF programs attached early in the receive path. Example use cases and performance benchmarks for XDP are also mentioned.
BGP Monitoring Protocol
BMP (BGP Monitoring Protocol) allows routers to send BGP peer route updates and statistics to external monitoring stations. It provides access to the pre-policy routing table (Adj-RIB-In) of peers on an ongoing basis. Cisco supports BMP in IOS-XE and IOS-XR routers. OpenBMP is an open-source BMP collector that stores updates in a MySQL database for analysis.
BGP on mikrotik
In this webinar, we are talking about BGP implementation on mikrotik router. the presentation starts with the fundamental of BGP and then discuss about Basic BGP setting on RouterOS
ICE: The ultimate way of beating NAT in SIP
Talk given at Amoocon about NAT traversal using Interactive Connectivity Establishment (ICE, RFC5245)
TC Flower Offload
The TC Flower Classifier allows control of packets based on flows determined by matching of well-known packet fields and metadata. This is inspired by similar flow classification described by OpenFlow and implemented by Open vSwitch. Offload of the TC Flower classifier and related modules provides a powerful mechanism to both increase throughput and reduce CPU utilisation for users of such flow-based systems. This presentation will give an overview of the evolution of offload of the TC Flower classifier: where it came from, the current status and possible future directions.
Detecting and mitigating DDoS ZenDesk by Vicente De Luca
This document discusses how to improve detection of DDoS attacks using an open-source solution involving FastNetMon, InfluxDB, Grafana, Redis, Morgoth, BIRD, and an experimental code called Net Healer. FastNetMon detects attacks and reports them to Redis. Net Healer watches Redis for attack reports and can trigger actions like alerting on-call teams or injecting routes based on policy thresholds over a 5 minute period to mitigate attacks faster without relying solely on humans. The solution integrates various open source tools for scalable metrics storage, routing, anomaly detection, and triggering automated responses to detected attacks.
DDoS detection at small ISP by Wardner Maia
Este documento trata sobre la detección y mitigación de ataques distribuidos de denegación de servicio (DDoS) en un pequeño proveedor de servicios de Internet (ISP). Explica conceptos básicos sobre DDoS, incluidos tipos de ataques y arquitectura. Luego, discute buenas prácticas de red para minimizar ataques, como la implementación de BCP-38 y la eliminación de amplificadores y bucles estáticos. Finalmente, cubre técnicas de mitigación como blackholing remoto y sol
More Related Content
What's hot
Implementing BGP Flowspec at IP transit network
This document discusses implementing BGP Flowspec at an IP transit network to help mitigate distributed denial of service (DDoS) attacks. BGP Flowspec allows network operators to announce flow specifications via BGP to define distributed access lists across their network. The document outlines BGP Flowspec options, typical attack scenarios with and without its use, implementation considerations, validation of rules, statistics collection, and plans for a web portal and integration with attack detection systems. Over 85% of detected DDoS traffic was found to originate from foreign interfaces, showing BGP Flowspec's effectiveness against such attacks.
BGP Flowspec (RFC5575) Case study and Discussion
BGP Flowspec is a technique for distributing flow specification rules via BGP. It allows an ISP to dynamically distribute filtering and redirection rules to mitigate DDoS attacks. The document discusses several real-world use cases where BGP Flowspec was deployed to successfully block large DDoS attacks in a targeted manner without affecting legitimate traffic. However, interoperability between vendors and scalability challenges remain open issues requiring further work and testing.
macvlan and ipvlan
macvlan and ipvlan allow VMs and containers to have direct exposure to the host network by assigning them their own MAC/IP addresses without requiring a bridge. macvlan uses MAC addresses to separate traffic while ipvlan uses layer 3. Both are lighter weight than bridges. macvlan is commonly used in bridge mode to allow communication between VMs/containers on the same host, while ipvlan may be preferred when MAC limits are in place or for untrusted networks.
BGP Update Source
This document discusses using a loopback interface as the update source for BGP sessions. It explains that when there are multiple paths between BGP neighbors, using a loopback interface ensures the BGP session will not go down if the physical interface fails. It provides the configuration to enable this by specifying the loopback interface in the neighbor update-source command. An example topology is shown connecting routers with EIGRP and configuring BGP between the routers using a loopback interface as the update source.
Обеспечение безопасности сети оператора связи с помощью BGP FlowSpec
The document discusses using BGP FlowSpec to provide network security for an internet service provider. It begins with an introduction to BGP FlowSpec, describing its components and how rules are distributed using BGP. It then covers using BGP FlowSpec for different DDoS mitigation scenarios, including stateless amplification attacks, stateless L3/L4 attacks, and stateful attacks targeting application resources. Configuration and other use cases are also briefly mentioned.
ISP load balancing with mikrotik nth
In this webinar, we discussed an advanced topic of mikrotik firewall features: nth packet matcher. we assumed the readers already have a solid understanding of prerequisite knowledge.
we started the discussion with the basic concepts of traffic load balancing, and then move to the nth discussion.
The recording is available on youtube (GLC Networks Channel): https://youtu.be/s0JxxdKuh58
netfilter and iptables
netfilter is a framework provided by the Linux kernel that allows various networking-related operations to be implemented in the form of customized handlers.
iptables is a user-space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall (implemented as different netfilter modules) and the chains and rules it stores.
Many systems use iptables/netfilter, Linux's native packet filtering/mangling framework since Linux 2.4, be it home routers or sophisticated cloud network stacks.
In this session, we will talk about the netfilter framework and its facilities, explain how basic filtering and mangling use-cases are implemented using iptables, and introduce some less common but powerful extensions of iptables.
Shmulik Ladkani, Chief Architect at Nsof Networks.
Long time network veteran and kernel geek.
Shmulik started his career at Jungo (acquired by NDS/Cisco) implementing residential gateway software, focusing on embedded Linux, Linux kernel, networking and hardware/software integration.
Some billions of forwarded packets later, Shmulik left his position as Jungo's lead architect and joined Ravello Systems (acquired by Oracle) as tech lead, developing a virtual data center as a cloud-based service, focusing around virtualization systems, network virtualization and SDN.
Recently he co-founded Nsof Networks, where he's been busy architecting network infrastructure as a cloud-based service, gazing at internet routes in astonishment, and playing the chkuku.
From NAT to NAT Traversal
This document discusses network address translation (NAT) and NAT traversal techniques. It begins with an overview of NAT and why NAT traversal is needed to access network resources behind NAT. It then covers various NAT traversal solutions including port forwarding, NAT traversal protocols like STUN and TURN, and implementations like ICE and WebRTC that use these protocols. The document provides examples and diagrams to illustrate key NAT concepts and how different traversal techniques work.
Entropy and denial of service attacks
Denial of Service attacks – Definitions, related surveys
Traceback of DDoS Attacks – Proposed method, advantages, future work
Detection methods with Shannon and Renyi cross entropy – Previous works, proposed method, dataset and results
The added value of entropy detection methods
References
BGP filter with mikrotik
In this webinar, we start the discussion with an introduction to BGP like AS to AS connection, comparison BGP routing and traditional routing, also BGP peering. we then talk about problem that might occur during BGP peering, its effects, and the solution. finally we cover an example of how to configure BGP filter on mikrotik.
The recording is available on youtube (GLC Networks Channel): https://www.youtube.com/channel/UCI611_IIkQC0rsLWIFIx_yg
Network LACP/Bonding/Teaming with Mikrotik
Webinar topic: Network LACP/Bonding/Teaming with Mikrotik
Presenter: Achmad Mardiansyah
In this webinar series, How Network LACP/Bonding/Teaming with Mikrotik
Please share your feedback or webinar ideas here: http://bit.ly/glcfeedback
Check our schedule for future events: https://www.glcnetworks.com/en/schedule/
Follow our social media for updates: Facebook, Instagram, YouTube Channel, and telegram also discord
Recording available on Youtube
https://youtu.be/smRcyLE42hU
OSPF On Router OS7
Webinar topic: OSPF On Router OS7
Presenter: Achmad Mardiansyah & M. Taufik Nurhuda
In this webinar series, How OSPF On Router OS7
Please share your feedback or webinar ideas here: http://bit.ly/glcfeedback
Check our schedule for future events: https://www.glcnetworks.com/en/schedule/
Follow our social media for updates: Facebook, Instagram, YouTube Channel, and telegram also discord
Recording available on Youtube
https://youtu.be/nuByFdZHvAg
Linux Network Stack
- The document discusses Linux network stack monitoring and configuration. It begins with definitions of key concepts like RSS, RPS, RFS, LRO, GRO, DCA, XDP and BPF.
- It then provides an overview of how the network stack works from the hardware interrupts and driver level up through routing, TCP/IP and to the socket level.
- Monitoring tools like ethtool, ftrace and /proc/interrupts are described for viewing hardware statistics, software stack traces and interrupt information.
Cisco IPv6 Tutorial
This document outlines an IPv6 lab and techtorial that covers IPv6 addressing, neighbor discovery, static routing, OSPFv3, BGP, and tunneling. The agenda includes lectures on these topics as well as corresponding labs to provide hands-on experience. Prerequisites for the session are basic network engineering knowledge and interest in Cisco technologies. The document then goes on to describe IPv6 addressing formats, types of addresses, and how addresses are allocated to interfaces.
Introduction to eBPF and XDP
This document provides an introduction to eBPF and XDP. It discusses the history of BPF and how it evolved into eBPF. Key aspects of eBPF covered include the instruction set, JIT compilation, verifier, helper functions, and maps. XDP is introduced as a way to program the data plane using eBPF programs attached early in the receive path. Example use cases and performance benchmarks for XDP are also mentioned.
BGP Monitoring Protocol
BMP (BGP Monitoring Protocol) allows routers to send BGP peer route updates and statistics to external monitoring stations. It provides access to the pre-policy routing table (Adj-RIB-In) of peers on an ongoing basis. Cisco supports BMP in IOS-XE and IOS-XR routers. OpenBMP is an open-source BMP collector that stores updates in a MySQL database for analysis.
BGP on mikrotik
In this webinar, we are talking about BGP implementation on mikrotik router. the presentation starts with the fundamental of BGP and then discuss about Basic BGP setting on RouterOS
ICE: The ultimate way of beating NAT in SIP
Talk given at Amoocon about NAT traversal using Interactive Connectivity Establishment (ICE, RFC5245)
TC Flower Offload
The TC Flower Classifier allows control of packets based on flows determined by matching of well-known packet fields and metadata. This is inspired by similar flow classification described by OpenFlow and implemented by Open vSwitch. Offload of the TC Flower classifier and related modules provides a powerful mechanism to both increase throughput and reduce CPU utilisation for users of such flow-based systems. This presentation will give an overview of the evolution of offload of the TC Flower classifier: where it came from, the current status and possible future directions.
What's hot (20)
Обеспечение безопасности сети оператора связи с помощью BGP FlowSpec
Обеспечение безопасности сети оператора связи с помощью BGP FlowSpec
Viewers also liked
Detecting and mitigating DDoS ZenDesk by Vicente De Luca
This document discusses how to improve detection of DDoS attacks using an open-source solution involving FastNetMon, InfluxDB, Grafana, Redis, Morgoth, BIRD, and an experimental code called Net Healer. FastNetMon detects attacks and reports them to Redis. Net Healer watches Redis for attack reports and can trigger actions like alerting on-call teams or injecting routes based on policy thresholds over a 5 minute period to mitigate attacks faster without relying solely on humans. The solution integrates various open source tools for scalable metrics storage, routing, anomaly detection, and triggering automated responses to detected attacks.
DDoS detection at small ISP by Wardner Maia
Este documento trata sobre la detección y mitigación de ataques distribuidos de denegación de servicio (DDoS) en un pequeño proveedor de servicios de Internet (ISP). Explica conceptos básicos sobre DDoS, incluidos tipos de ataques y arquitectura. Luego, discute buenas prácticas de red para minimizar ataques, como la implementación de BCP-38 y la eliminación de amplificadores y bucles estáticos. Finalmente, cubre técnicas de mitigación como blackholing remoto y sol
03 estrategia-ddos
O documento discute estratégias de defesa contra ataques de negação de serviço (DoS e DDoS), incluindo tipos de ataques, planejamento de rede, detecção e contramedidas. É destacada a importância da visibilidade da rede, do conhecimento dos serviços e da capacidade dos equipamentos para mitigar ataques. Quando o ataque excede a banda disponível, opções como bloqueio remoto, "clean pipes" e distribuição de carga podem ajudar a reduzir o impacto.
Blackholing from a_providers_perspektive_theo_voss
This document discusses blackholing from a provider's perspective. It describes how blackholing can be implemented at the provider's upstreams and internet exchange points (IXPs). The document also discusses using FastNetMon for DDoS attack detection and implementing blackholing policies on routers to discard attack traffic in the case of a detected DDoS attack.
Jon Nield FastNetMon
FastNetMon is an open source, cross-platform, and lightweight real-time black hole monitoring system that can detect network anomalies from sFlow, Netflow, or mirrored port data. It has flexible response methods and works with routing protocols like ExaBGP and GoBGP, though its limited documentation and some quirks like inaccurate flow averages require modifications for optimal use.
Nanog66 vicente de luca fast netmon
This document describes an open-source solution for improving fast detection of and automating mitigation of DDoS attacks. The solution uses FastNetMon for fast detection of attacks from sFlow, NetFlow, or port mirroring. Metrics and events are stored in InfluxDB for analysis by Morgoth and visualization in Grafana. Net Healer uses policies to trigger actions like blackholing routes in BIRD based on data from Redis and anomalies detected by Morgoth in InfluxDB. This provides faster detection and reaction than traditional hardware appliances alone.
Distributed Denial of Service Attack - Detection And Mitigation
This document discusses distributed denial of service (DDoS) attacks, detection, and mitigation. It provides background on DDoS including components and architecture. It explains why small and medium internet service providers should care about DDoS attacks. The presentation aims to show how an ISP can implement an automated solution for DDoS mitigation using Mikrotik Traffic Flow, Fastnetmon for detection, and ExaBGP for route announcements. Detection and mitigation techniques are discussed such as remote triggered blackholing, mitigation at a cloud scrubbing center, and using the Cymru Unwanted Traffic Removal Service.
Protect your edge BGP security made simple
SysEleven filters routes to protect its edge by rejecting bogon prefixes and invalid routes. It generates prefix filters automatically based on peer AS sets to apply strict inbound filtering. It also uses RPKI to validate routes and reject invalid announcements. For DDoS mitigation, it uses FastNetMon for detection and FlowSpec to propagate rate limiting filters via BGP to upstream providers for quick attack mitigation in under 2 minutes. Open source tools like bgpq3, aggregate, and GoBGP help implement these solutions in a cost effective manner.
Janog 39: speech about FastNetMon by Yutaka Ishizaki
FastNetMon is an open-source software that can quickly detect DDoS attacks by analyzing packet capture and NetFlow data. It stores metrics in InfluxDB and Redis for visualization and attack details. When an attack is detected, FastNetMon can trigger scripts and announce blocked IPs using protocols like BGP. While it detects attacks well based on thresholds, it may be more effective when combined with other components for full DDoS mitigation functionality.
Keeping your rack cool
Marek discusses how his company Faelix uses MikroTik hardware and RouterOS at their network edges to route over 600k IPv4 and 30k IPv6 routes. While there were some initial issues, MikroTik has proven reliable and cost-effective. Marek then explains how Faelix implements firewalling with zero filter rules through a multi-step process. They use fail2ban to block brute force attacks, AMQP to share block lists across routers, and destination NAT misbehaving traffic. Most importantly, they leverage the "/ip route rule" feature to route blocked traffic to a separate routing table for easy isolation without complex firewall rules.
Борьба с DDoS в хостинге - по обе стороны баррикад / Константин Новаковский (...
Доклад будет полезен тем, кто планирует организовывать защиту от DDoS-атак собственными силами. Отдельный акцент будет сделан на использовании open-source продуктов для обнаружения и блокирования внешних сетевых атак. Кроме этого, я поделюсь опытом организации автоматического обнаружения и предотвращения атак изнутри инфраструктуры (взломанные клиентские серверы, недобросовестные клиенты).
FastNetMonを試してみた
JANOG39 トラフィック可視化 BoF 発表資料
Japanese - https://www.janog.gr.jp/meeting/janog39/program/traffic
English - https://www.janog.gr.jp/meeting/janog39/en/programs/y-bof-traffic
An Introduction to BGP Flow Spec
BGP Flow Specification allows network operators to define and distribute traffic filtering rules via BGP. This helps operators quickly mitigate DDoS attacks by filtering traffic at an upstream level rather than just blackholing entire prefixes. It separates filtering information from routing data using new BGP address families. Validating flow specifications against the best unicast route helps prevent spoofing. Common filtering actions include traffic policing, sampling, and redirection. While some ISPs have begun implementations, widespread adoption is still needed to realize the benefits of centralized DDoS defense using BGP Flow Specification.
IPTV Set-top box monitoring
Dávid Károly, Tivadar Szemethy, Árpád Bakay: "Signal and System Monitoring for IPTV Set-top Box Systems", in Proc. RCEAS'07, 2008.
DDoS Protection System DPS
Terabit Security offers a DDoS protection solution (DPS) that uses BGP Flowspec to quickly distribute ACL rules across routers to mitigate DDoS attacks. The DPS software can be installed on customer servers or virtual machines, and provides detection of DDoS attacks in 1-2 seconds and protection of up to 6.4Tbps of traffic. Professional support plans include basic 8x5 and advanced 24x7 support with unlimited cases. Over 1000 customers in 20+ countries use Terabit Security's solutions to protect terabits of internet traffic from DDoS attacks.
Webinar: “Cómo proteger–de verdad–tus aplicaciones web”
Presentación del webinar “Cómo proteger–de verdad–tus aplicaciones web”, en la que se ha desarrollado la presentación del producto Incapsula de Imperva
BGP route leak
This document discusses route filtering recommendations to protect networks from routing leaks. It recommends:
1. Identifying transit routes using AS path filtering, communities, or prefix lists to refuse advertising these routes.
2. Applying maximum prefix limits and filters to inbound routes from peers to limit route exposure.
3. Creating inbound route filters to protect networks from leaked routes that should not be received from peers.
Set top box
Set top boxes allow users to access multimedia services and cable television through a user-friendly interface. They integrate video and audio decoding with an application execution environment. While multimedia computers are more versatile and expensive, set top boxes have limited functionality and lower cost, targeting entertainment applications. Digital video networks use set top boxes to deliver high-bandwidth video and low-bandwidth interactivity between the user and service provider over various connection types like cable, satellite, and internet. Set top box hardware and software architectures integrate components like an MPEG decoder and microprocessor to control devices and enable downloading and running of applications.
GoSF Jan 2016 - Go Write a Plugin for Snap!
We have an open source telemetry framework called snap. Here's the how, the why and the what of using it. TL;DR: Go learn it and contribute back!
SDN-IP Peering using BGP
This document discusses enabling seamless interworking between SDN and IP networks. It proposes using SDN controllers to emulate IP routing in the SDN domain so that SDN appears as a single router to external IP peers. The SDN controller would install flow entries proactively based on BGP routes and update them reactively upon BGP changes. This would allow SDN and IP networks to peer without requiring any changes to the IP networks. The document outlines the current implementation using ONOS and future work, such as improving performance and scaling the solution across multiple ONOS instances and BGP processes.
Viewers also liked (20)
Detecting and mitigating DDoS ZenDesk by Vicente De Luca
Detecting and mitigating DDoS ZenDesk by Vicente De Luca
Blackholing from a_providers_perspektive_theo_voss
Blackholing from a_providers_perspektive_theo_voss
Distributed Denial of Service Attack - Detection And Mitigation
Distributed Denial of Service Attack - Detection And Mitigation
Janog 39: speech about FastNetMon by Yutaka Ishizaki
Janog 39: speech about FastNetMon by Yutaka Ishizaki
Борьба с DDoS в хостинге - по обе стороны баррикад / Константин Новаковский (...
Борьба с DDoS в хостинге - по обе стороны баррикад / Константин Новаковский (...
Webinar: “Cómo proteger–de verdad–tus aplicaciones web”
Webinar: “Cómo proteger–de verdad–tus aplicaciones web”
Similar to FastNetMon - ENOG9 speech about DDoS mitigation
DDOS Mitigation Experience from IP ServerOne by CL Lee
IP ServerOne is a Malaysian data center provider that manages over 4500 physical servers across 5 data centers. They experience 2-5 DDoS attacks per day, mostly ranging from 4.5-8.9 Gbps. To detect attacks, they use netflow to monitor traffic patterns and flag abnormal packet rates to single IPs. When an attack is detected, traffic is rerouted to on-premise filtering devices in less than 90 seconds to scrub attacks while allowing legitimate traffic. IP ServerOne advocates a hybrid mitigation approach using their own infrastructure alongside cloud-based protection.
DDoS Attack Preparation and Mitigation
Layered controls to help you prepare for and defend yourself from a distributed denial of service (DDoS) attack.
DDoS Attack Detection & Mitigation in SDN
This document summarizes a presentation on detecting and mitigating distributed denial of service (DDoS) attacks in software-defined networks. It discusses using sFlow and the Floodlight controller to detect common DDoS attack types like ICMP floods, SYN floods, and DNS amplification. An application was developed in Python to classify attacks and push static flow entries to direct attack traffic to the sFlow collector for analysis. The scheme was tested in a Mininet virtual network and shown to successfully mitigate ICMP and SYN flood attacks. Future work includes testing DNS amplification and UDP floods, implementing adaptive sampling rates and thresholds, and designing an unblocking mechanism.
DDoS - unstoppable menace
DDoS attacks are a growing menace due to readily available attack tools, botnets for hire, and lack of adequate protections by many organizations. The motives for attacks include hacktivism, extortion, competitive attacks in online games, and revenge. Common targets are websites and online services. The impacts of DDoS attacks include lost revenue, reputation damage, lost productivity, and recovery costs. Common attack types are volumetric (flooding bandwidth), protocol attacks, and application layer attacks targeting services like HTTP and DNS. Myths around protection include overreliance on firewalls, belief that attacks only happen to others, and that ISPs or software fixes can fully mitigate risks. Effective mitigation techniques involve monitoring, over
DDoS - unstoppable menace
DDoS attacks are a growing menace due to readily available attack tools, botnets for hire, and lack of adequate protections by many organizations. The motives for attacks include hacktivism, extortion, competitive attacks in online games, and revenge. Common targets are websites and online services. The impacts of DDoS attacks include lost revenue, reputation damage, lost productivity, and recovery costs. Common attack types are volumetric (flooding bandwidth), protocol attacks, and application layer attacks targeting services like HTTP and DNS. Many organizations have myths about protection and rely solely on firewalls, IDS, or their ISPs. Effective mitigation requires monitoring, overprovisioning resources, IP reputation databases, ACLs, load
Layer one 2011-gh0stwood-d-dos-attacks
This document provides an overview and discussion of distributed denial of service (DDoS) attacks. It begins with an agenda outlining topics to be covered, including the business side of DDoS, attack types, recognition and mitigation. It then covers various DDoS attack types classified by network layer, including examples like SYN floods. Detection and mitigation techniques are discussed for different layers. The document emphasizes preparation, monitoring, response plans and partnerships as important strategies for dealing with DDoS attacks.
IX 2020 - Internet Security & Mitigation of Risk Webinar: Linux Malware and D...
APNIC's Senior Security Specialist Adli Wahid gave a presentation on Linux malware, DDoS agents and bots, based on observations from the Honeynet project at the IX 2020 – Internet Security and Mitigation of Risk Webinar, held online on 15 June 2020.
I2O Solutions - HDN Network Security Solution
The document discusses security issues with internal networks and proposes a security switch solution from HanDreamnet. It notes that 80% of breaches come from internal traffic but most perimeter security like firewalls only protect from external threats. The security switch aims to detect and block harmful internal traffic in real-time without impacting regular traffic. It uses proprietary technology to analyze network traffic on multiple dimensions and identify attacks like denial of service, spoofing, and advanced persistent threats. The document compares the security switch's features to regular switches and other vendor solutions.
UDP Flood Attack.pptx
A UDP flood attack is a denial of service attack where an attacker overwhelms a targeted host with UDP packets. UDP is a connectionless protocol that does not require handshaking, allowing it to be used to launch attacks. While firewalls can filter unwanted traffic, they too can be overwhelmed. There are several ways to mitigate UDP flood attacks, such as rate limiting ICMP responses, firewall filtering, and filtering UDP packets except for DNS at the network level. Advanced mitigation techniques involve load balancing attacks across scrubbing servers using anycast technology and deep packet inspection to filter out malicious packets.
Hacking Cisco
The document discusses various reconnaissance and access attacks against Cisco networks, as well as countermeasures. It covers passive sniffing, port scans, ping sweeps, password attacks, trust exploitation, IP spoofing, DHCP/ARP attacks, and DoS/DDoS attacks. Defenses include switched networks, encryption, firewall rules, DHCP snooping, dynamic ARP inspection, rate limiting, and storm control.
DDoS-bdNOG
The document provides information about different types of DDoS attacks including DoS, DDoS, DNS reflection, SYN reflection, SMURF, UDP flood, SNMP, NTP, HTTP GET, and HTTP POST attacks. It describes how each attack works and overloads the target system with traffic. Mitigation techniques are also outlined, such as firewalls, rate limiting, authentication, and modifying server configurations.
DDoS Threat Landscape - Ron Winward CHINOG16
- DDoS attacks continue to grow in complexity and now utilize multi-vector attacks across all layers of the infrastructure. The top failure points for networks are internet pipe saturation and stateful firewalls.
- Common attack types include UDP, ICMP, reflection attacks, TCP weaknesses like SYN floods, low and slow attacks like Slowloris, and encrypted attacks such as HTTPS floods. Anonymous hacking tools enable these attacks.
- Successful mitigation of DDoS attacks requires proactive preparation across the network, including a hybrid solution of on-premise and cloud-based detection and mitigation, emergency response planning, and a single point of contact during attacks.
Ddos and mitigation methods.pptx
This document discusses DDoS attacks and mitigation methods. It begins by defining DDoS attacks as using multiple sources to overwhelm a target's availability, unlike a DOS attack which uses a single source. Common DDoS attack types are then outlined, along with the costs and impacts of attacks for victims. The document also provides details on specific attack methods like SYN floods, reflection attacks using DNS and NTP, and recommended mitigation techniques including whitelisting, rate limiting, and fingerprinting. It concludes by emphasizing that DDoS attacks are easy to carry out and difficult to detect, while having significant negative effects on victims.
DDoS Challenges in IPv6 environment
This document discusses challenges and solutions related to detecting and mitigating DDoS attacks in IPv6 environments. It provides an overview of common attack vectors in IPv6, such as protocol floods, fragmentation attacks, and spoofing. It also addresses issues with using existing monitoring tools in IPv6 networks and proposes protocols like Netflow v9, IPFIX, and sFlow v5 for exporting IPv6 traffic metadata. Specific challenges involving BGP, blackholing, traffic engineering and fastnetmon tool support for IPv6 are examined along with potential solutions.
Secure 2013 Poland
This document discusses how to launch and defend against DDoS attacks. It explains that DDoS attacks are easy to conduct using tools that allow for spoofing of IP addresses. It also describes how protocols like UDP and DNS amplification attacks can be used to launch large attacks. The document then provides recommendations for how to defend against DDoS attacks, including using a global network with anycast, hiding your origin IP, separating protocols by IP, and working closely with your upstream provider.
How to launch and defend against a DDoS
This document discusses how to launch and defend against DDoS attacks. It explains that DDoS attacks are easy to conduct using tools that allow for spoofing of IP addresses. It also describes how protocols like UDP and DNS amplification attacks can be used to launch large attacks. The document then provides recommendations for how to defend against DDoS attacks, including using a global network with anycast, hiding your origin IP, separating protocols by IP, and working closely with your upstream provider.
KHNOG 3: DDoS Attack Prevention
APNIC Security Specialist Jamie Gillespie presents on DDoS Attack Prevention at KHNOG 3, held online on 4 December 2021.
Net mcr 2021 05 handout
How we stopped a DDos ransom attack - some redaction in deck - why give opportunists to up their game?
DDosMon A Global DDoS Monitoring Project
DDosMon A Global DDoS Monitoring Project by Yiming Gong.
A presentation given at APNIC 42's FIRST TC Security Session (2) session on Wednesday, 5 October 2016.
Tcpdump hunter
This document discusses how to use tcpdump and Linux utilities like grep, awk and sed to analyze network traffic for incident response. It provides examples of basic tcpdump syntax and using BPF filters to profile traffic. Specific techniques covered include hunting for suspicious DNS queries, mapping related infrastructure, finding unusual outbound connections, and automating tasks with scripting. The overall message is that security analysts should go beyond automated tools and learn to manually analyze network data to identify compromised systems that tools may miss.
Similar to FastNetMon - ENOG9 speech about DDoS mitigation (20)
DDOS Mitigation Experience from IP ServerOne by CL Lee
DDOS Mitigation Experience from IP ServerOne by CL Lee
IX 2020 - Internet Security & Mitigation of Risk Webinar: Linux Malware and D...
IX 2020 - Internet Security & Mitigation of Risk Webinar: Linux Malware and D...
More from Pavel Odintsov
Network telemetry for DDoS detection presentation
This presentation covers issues and benefits for Netflow, sFlow, IPFIX, SPAN and othre protocols in context of DDoS detection purposes
Using MikroTik routers for BGP transit and IX points
This document discusses using MikroTik routers for BGP transit and internet exchange (IX) points. It covers how to configure BGP to import routes from transit carriers and IXes, export routes to customers, and control outgoing traffic preferences. Communities are used to mark routes from different providers and for blackholing DDoS attacks. Recommended BGP attribute values are provided to control traffic flow. Acknowledgments are given to DE-CIX for information used in the presentation.
DDoS Defense Mechanisms for IXP Infrastructures
DDoS Defense Mechanisms for IXP Infrastructures by Tim Dijkhuizen Lennart van Gijtenbeek
Supervisor: Stavros Konstantaras (AMS-IX)
Flowspec contre les attaques DDoS : l'expérience danoise
RÉSUMÉ
Au sein de DeiC, le réseau de recherche au Danemark, nous avons développé un service de protection contre les attaques DDoS qui est basé sur la distribution des règles firewall vers les routeurs de bordure par le biais de BGP FlowSpec.
Par rapport aux solutions alternatives, cette méthode a un coût très réduit puisqu'elle est basée sur des composants open source uniquement.
Dans cette phase du projet la détection des attaques est faite au moyen de FastNetMon, mais grâce aux interfaces ouvertes, d'autres outils IDS peuvent être utilisés.
Nous présenterons un retour d'expérience pour ce service qui est actuellement en cours de déploiement au sein de DeIC.
Detectando DDoS e intrusiones con RouterOS
Maximiliano Dobladez presentó sobre cómo detectar ataques DDoS e intrusiones con RouterOS. Explicó las herramientas Suricata e IDS/IPS para analizar tráfico en busca de eventos maliciosos conocidos y FastNetMon para detectar DDoS en 2 segundos. Detalló cómo instalar y configurar estas herramientas, integrarlas con RouterOS y tomar acciones como enviar tráfico a un blackhole cuando se detecta un ataque.
DeiC DDoS Prevention System - DDPS
DeiC DDoS Prevention System - DDPS by Niels Thomas Haugård, DeiC. See https://www.linkedin.com/in/uninth and https://www.deic.dk
Lekker weer nlnog_nlnog_ddos_fl
Cheap and Efficient DDoS Traffic Analysis
Fabian Labohm
f.labohm@duocast.nl
Duocast
Lekker weer nlnog_how_to_avoid_buying_expensive_routers
How to avoid buying expensive routers
Mark Schouten
Tuxis Internet Engineering
SIG-NOC Tools Survey
The survey found that the most commonly used NOC tools are for monitoring (e.g. CACTI, Nagios), problem management (e.g. Nagios, Request Tracker), and ticketing (e.g. Request Tracker, OTRS). Performance management tools like Iperf, Wireshark and MRTG were also widely used. Configuration management was commonly done using tools like Git, RANCID, Subversion and CVS. The survey provided insights into the software tools used by NOCs and helped identify trends in tools that have increased in importance since a previous survey in 2011.
Containers in real world презентация
Report about practical experience using openvz and Linux upstream containers in real hosting.
Containers are the future of the Cloud
Containers are becoming increasingly popular as the future of cloud computing. The document discusses and compares several open source container virtualization platforms - KVM, Xen, OpenVZ, and LXC. It provides details on each platform such as the main developer, status, hardware support, virtualization type, and supported operating systems. OpenVZ is highlighted as being production ready since 2006, having extremely low overhead compared to Xen and KVM, and being widely used in projects like Docker.
More from Pavel Odintsov (11)
Using MikroTik routers for BGP transit and IX points
Using MikroTik routers for BGP transit and IX points
Flowspec contre les attaques DDoS : l'expérience danoise
Flowspec contre les attaques DDoS : l'expérience danoise
Lekker weer nlnog_how_to_avoid_buying_expensive_routers
Lekker weer nlnog_how_to_avoid_buying_expensive_routers
Recently uploaded
怎么办理(umiami毕业证书)美国迈阿密大学毕业证文凭证书实拍图原版一模一样
原版定制【微信:bwp0011】《(umiami毕业证书)美国迈阿密大学毕业证文凭证书》【微信:bwp0011】成绩单 、雅思、外壳、留信学历认证永久存档查询，采用学校原版纸张、特殊工艺完全按照原版一比一制作（包括：隐形水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠，文字图案浮雕，激光镭射，紫外荧光，温感，复印防伪）行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备，十五年致力于帮助留学生解决难题，业务范围有加拿大、英国、澳洲、韩国、美国、新加坡，新西兰等学历材料，包您满意。
【业务选择办理准则】
一、工作未确定，回国需先给父母、亲戚朋友看下文凭的情况，办理一份就读学校的毕业证【微信bwp0011】文凭即可
二、回国进私企、外企、自己做生意的情况，这些单位是不查询毕业证真伪的，而且国内没有渠道去查询国外文凭的真假，也不需要提供真实教育部认证。鉴于此，办理一份毕业证【微信bwp0011】即可
三、进国企，银行，事业单位，考公务员等等，这些单位是必需要提供真实教育部认证的，办理教育部认证所需资料众多且烦琐，所有材料您都必须提供原件，我们凭借丰富的经验，快捷的绿色通道帮您快速整合材料，让您少走弯路。
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
【关于价格问题（保证一手价格）】
我们所定的价格是非常合理的，而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格，因为我想坦诚对待大家 不想跟大家在价格方面浪费时间
对于老客户或者被老客户介绍过来的朋友，我们都会适当给一些优惠。
一比一原版新西兰林肯大学毕业证(Lincoln毕业证书)学历如何办理
原版办【微信号:95270640】【新西兰林肯大学毕业证(Lincoln毕业证书)】【微信号:95270640】《成绩单、外壳、雅思、offer、真实留信官方学历认证（永久存档/真实可查）》采用学校原版纸张、特殊工艺完全按照原版一比一制作（包括：隐形水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠，文字图案浮雕，激光镭射，紫外荧光，温感，复印防伪）行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备，十五年致力于帮助留学生解决难题，业务范围有加拿大、英国、澳洲、韩国、美国、新加坡，新西兰等学历材料，包您满意。
【我们承诺采用的是学校原版纸张（纸质、底色、纹路）我们拥有全套进口原装设备，特殊工艺都是采用不同机器制作，仿真度基本可以达到100%，所有工艺效果都可提前给客户展示，不满意可以根据客户要求进行调整，直到满意为止！】
【业务选择办理准则】
一、工作未确定，回国需先给父母、亲戚朋友看下文凭的情况，办理一份就读学校的毕业证【微信号95270640】文凭即可
二、回国进私企、外企、自己做生意的情况，这些单位是不查询毕业证真伪的，而且国内没有渠道去查询国外文凭的真假，也不需要提供真实教育部认证。鉴于此，办理一份毕业证【微信号95270640】即可
三、进国企，银行，事业单位，考公务员等等，这些单位是必需要提供真实教育部认证的，办理教育部认证所需资料众多且烦琐，所有材料您都必须提供原件，我们凭借丰富的经验，快捷的绿色通道帮您快速整合材料，让您少走弯路。
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
留信网服务项目：
1、留学生专业人才库服务（留信分析）
2、国（境）学习人员提供就业推荐信服务
3、留学人员区块链存储服务
【关于价格问题（保证一手价格）】
我们所定的价格是非常合理的，而且我们现在做得单子大多数都是代理和回头客户介绍的所以一般现在有新的单子 我给客户的都是第一手的代理价格，因为我想坦诚对待大家 不想跟大家在价格方面浪费时间
对于老客户或者被老客户介绍过来的朋友，我们都会适当给一些优惠。
选择实体注册公司办理，更放心，更安全！我们的承诺：客户在留信官方认证查询网站查询到认证通过结果后付款，不成功不收费！
HijackLoader Evolution: Interactive Process Hollowing
CrowdStrike researchers have identified a HijackLoader (aka IDAT Loader) sample that employs sophisticated evasion techniques to enhance the complexity of the threat. HijackLoader, an increasingly popular tool among adversaries for deploying additional payloads and tooling, continues to evolve as its developers experiment and enhance its capabilities.
In their analysis of a recent HijackLoader sample, CrowdStrike researchers discovered new techniques designed to increase the defense evasion capabilities of the loader. The malware developer used a standard process hollowing technique coupled with an additional trigger that was activated by the parent process writing to a pipe. This new approach, called "Interactive Process Hollowing", has the potential to make defense evasion stealthier.
Honeypots Unveiled: Proactive Defense Tactics for Cyber Security, Phoenix Sum...
Adli Wahid, Senior Internet Security Specialist at APNIC, delivered a presentation titled 'Honeypots Unveiled: Proactive Defense Tactics for Cyber Security' at the Phoenix Summit held in Dhaka, Bangladesh from 23 to 24 May 2024.
Securing BGP: Operational Strategies and Best Practices for Network Defenders...
Md. Zobair Khan,
Network Analyst and Technical Trainer at APNIC, presented 'Securing BGP: Operational Strategies and Best Practices for Network Defenders' at the Phoenix Summit held in Dhaka, Bangladesh from 23 to 24 May 2024.
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
原版一模一样【微信：741003700 】【新西兰奥克兰大学毕业证学位证书】【微信：741003700 】学位证，留信认证（真实可查，永久存档）offer、雅思、外壳等材料/诚信可靠,可直接看成品样本，帮您解决无法毕业带来的各种难题！外壳，原版制作，诚信可靠，可直接看成品样本。行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备。十五年致力于帮助留学生解决难题，包您满意。
本公司拥有海外各大学样板无数，能完美还原海外各大学 Bachelor Diploma degree, Master Degree Diploma
1:1完美还原海外各大学毕业材料上的工艺：水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠。文字图案浮雕、激光镭射、紫外荧光、温感、复印防伪等防伪工艺。材料咨询办理、认证咨询办理请加学历顾问Q/微741003700
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
Discover the benefits of outsourcing SEO to India
"Discover the benefits of outsourcing SEO to India! From cost-effective services and expert professionals to round-the-clock work advantages, learn how your business can achieve digital success with Indian SEO solutions.
快速办理(Vic毕业证书)惠灵顿维多利亚大学毕业证完成信一模一样
学校原件一模一样【微信：741003700 】《(Vic毕业证书)惠灵顿维多利亚大学毕业证》【微信：741003700 】学位证，留信认证（真实可查，永久存档）原件一模一样纸张工艺/offer、雅思、外壳等材料/诚信可靠,可直接看成品样本，帮您解决无法毕业带来的各种难题！外壳，原版制作，诚信可靠，可直接看成品样本。行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备。十五年致力于帮助留学生解决难题，包您满意。
本公司拥有海外各大学样板无数，能完美还原。
1:1完美还原海外各大学毕业材料上的工艺：水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠。文字图案浮雕、激光镭射、紫外荧光、温感、复印防伪等防伪工艺。材料咨询办理、认证咨询办理请加学历顾问Q/微741003700
【主营项目】
一.毕业证【q微741003700】成绩单、使馆认证、教育部认证、雅思托福成绩单、学生卡等！
二.真实使馆公证(即留学回国人员证明,不成功不收费)
三.真实教育部学历学位认证（教育部存档！教育部留服网站永久可查）
四.办理各国各大学文凭(一对一专业服务,可全程监控跟踪进度)
如果您处于以下几种情况：
◇在校期间，因各种原因未能顺利毕业……拿不到官方毕业证【q/微741003700】
◇面对父母的压力，希望尽快拿到；
◇不清楚认证流程以及材料该如何准备；
◇回国时间很长，忘记办理；
◇回国马上就要找工作，办给用人单位看；
◇企事业单位必须要求办理的
◇需要报考公务员、购买免税车、落转户口
◇申请留学生创业基金
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
Bengaluru Dreamin' 24 - Personal Branding
Session on Personal Branding presented at Bengaluru Dreamin
Should Repositories Participate in the Fediverse?
Presentation for OR2024 making the case that repositories could play a part in the "fediverse" of distributed social applications
一比一原版(USYD毕业证)悉尼大学毕业证如何办理
USYD硕士毕业证成绩单【微信95270640】《如何办理悉尼大学毕业证认证》【办证Q微信95270640】《悉尼大学文凭毕业证制作》《USYD学历学位证书哪里买》办理悉尼大学学位证书扫描件、办理悉尼大学雅思证书！
国际留学归国服务中心《如何办悉尼大学毕业证认证》《USYD学位证书扫描件哪里买》实体公司，注册经营，行业标杆，精益求精！
如果您是以下情况，我们都能竭诚为您解决实际问题：【公司采用定金+余款的付款流程，以最大化保障您的利益，让您放心无忧】
1、在校期间，因各种原因未能顺利毕业，拿不到官方毕业证+微信95270640
2、面对父母的压力，希望尽快拿到悉尼大学悉尼大学毕业证offer；
3、不清楚流程以及材料该如何准备悉尼大学悉尼大学毕业证offer；
4、回国时间很长，忘记办理；
5、回国马上就要找工作，办给用人单位看；
6、企事业单位必须要求办理的；
面向美国乔治城大学毕业留学生提供以下服务:
【★悉尼大学悉尼大学毕业证offer毕业证、成绩单等全套材料，从防伪到印刷，从水印到钢印烫金，与学校100%相同】
【★真实使馆认证（留学人员回国证明），使馆存档可通过大使馆查询确认】
【★真实教育部认证，教育部存档，教育部留服网站可查】
【★真实留信认证，留信网入库存档，可查悉尼大学悉尼大学毕业证offer】
我们从事工作十余年的有着丰富经验的业务顾问，熟悉海外各国大学的学制及教育体系，并且以挂科生解决毕业材料不全问题为基础，为客户量身定制1对1方案，未能毕业的回国留学生成功搭建回国顺利发展所需的桥梁。我们一直努力以高品质的教育为起点，以诚信、专业、高效、创新作为一切的行动宗旨，始终把“诚信为主、质量为本、客户第一”作为我们全部工作的出发点和归宿点。同时为海内外留学生提供大学毕业证购买、补办成绩单及各类分数修改等服务；归国认证方面，提供《留信网入库》申请、《国外学历学位认证》申请以及真实学籍办理等服务，帮助众多莘莘学子实现了一个又一个梦想。
专业服务，请勿犹豫联系我
如果您真实毕业回国，对于学历认证无从下手，请联系我，我们免费帮您递交
诚招代理：本公司诚聘当地代理人员，如果你有业余时间，或者你有同学朋友需要，有兴趣就请联系我
你赢我赢，共创双赢
你做代理，可以帮助悉尼大学同学朋友
你做代理，可以拯救悉尼大学失足青年
你做代理，可以挽救悉尼大学一个个人才
你做代理，你将是别人人生悉尼大学的转折点
你做代理，可以改变自己，改变他人，给他人和自己一个机会过暑假的小学生快乐的日子总是过得飞快山娃尚未完全认清那几位小朋友时他们却一个接一个地回家了山娃这时才恍然发现二个月的暑假已转到了尽头他的城市生活也将划上一个不很圆满的句号了值得庆幸的是山娃早记下了他们的学校和联系方式说也奇怪在山娃离城的头一天父亲居然请假陪山娃耍了一天那一天父亲陪着山娃辗转长隆水上乐园疯了一整天水上漂流高空冲浪看大马戏大凡里面有的父亲都带着他去疯一把山娃算了算这一次足足花了老爸元很
快速办理(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书一模一样
学校原件一模一样【微信：741003700 】《(新加坡SMU毕业证书)新加坡管理大学毕业证文凭证书》【微信：741003700 】学位证，留信认证（真实可查，永久存档）原件一模一样纸张工艺/offer、雅思、外壳等材料/诚信可靠,可直接看成品样本，帮您解决无法毕业带来的各种难题！外壳，原版制作，诚信可靠，可直接看成品样本。行业标杆！精益求精，诚心合作，真诚制作！多年品质 ,按需精细制作，24小时接单,全套进口原装设备。十五年致力于帮助留学生解决难题，包您满意。
本公司拥有海外各大学样板无数，能完美还原。
1:1完美还原海外各大学毕业材料上的工艺：水印，阴影底纹，钢印LOGO烫金烫银，LOGO烫金烫银复合重叠。文字图案浮雕、激光镭射、紫外荧光、温感、复印防伪等防伪工艺。材料咨询办理、认证咨询办理请加学历顾问Q/微741003700
【主营项目】
一.毕业证【q微741003700】成绩单、使馆认证、教育部认证、雅思托福成绩单、学生卡等！
二.真实使馆公证(即留学回国人员证明,不成功不收费)
三.真实教育部学历学位认证（教育部存档！教育部留服网站永久可查）
四.办理各国各大学文凭(一对一专业服务,可全程监控跟踪进度)
如果您处于以下几种情况：
◇在校期间，因各种原因未能顺利毕业……拿不到官方毕业证【q/微741003700】
◇面对父母的压力，希望尽快拿到；
◇不清楚认证流程以及材料该如何准备；
◇回国时间很长，忘记办理；
◇回国马上就要找工作，办给用人单位看；
◇企事业单位必须要求办理的
◇需要报考公务员、购买免税车、落转户口
◇申请留学生创业基金
留信网认证的作用:
1:该专业认证可证明留学生真实身份
2:同时对留学生所学专业登记给予评定
3:国家专业人才认证中心颁发入库证书
4:这个认证书并且可以归档倒地方
5:凡事获得留信网入网的信息将会逐步更新到个人身份内，将在公安局网内查询个人身份证信息后，同步读取人才网入库信息
6:个人职称评审加20分
7:个人信誉贷款加10分
8:在国家人才网主办的国家网络招聘大会中纳入资料，供国家高端企业选择人才
Recently uploaded (12)
HijackLoader Evolution: Interactive Process Hollowing
HijackLoader Evolution: Interactive Process Hollowing
Honeypots Unveiled: Proactive Defense Tactics for Cyber Security, Phoenix Sum...
Honeypots Unveiled: Proactive Defense Tactics for Cyber Security, Phoenix Sum...
Securing BGP: Operational Strategies and Best Practices for Network Defenders...
Securing BGP: Operational Strategies and Best Practices for Network Defenders...
FastNetMon - ENOG9 speech about DDoS mitigation
- 1. http://bit.ly/fastnetmon FastNetMon Open source DDoS mitigation toolkit Pavel Odintsov odintsov@fastvps.ee 1
- 2. http://bit.ly/fastnetmon 0 10 20 30 40 2014-12 2015-01 2015-02 2015-03 2015-04 2015-05 2015-06 Number of DDoS attacks per month 2
- 8. http://bit.ly/fastnetmon What we could do? • Save NOC’s sleep :) • Detect any DoS/DDoS attack for channel overflow or equipment overload • Partially or completely block traffic from/to own host (target of attack) • Save your network (routers, switches, servers) • Save your SLA 8
- 9. http://bit.ly/fastnetmon FastNetMon supported packet capture engines • sFlow v5 (sampled traffic collection from switches) • NetFlow v5, v9, v10 (sampled traffic data from routers) • IPFIX (sampled traffic data from routers) • Span/mirror (routers/switches deep inspection mode) 9
- 10. http://bit.ly/fastnetmon How we could block attack? • BGP announce (community 666, blackhole, selective blackhole) • BGP flow spec/RFC 5575 (selective traffic blocking) • ACL on switch • Custom script 10
- 11. http://bit.ly/fastnetmon Supported platforms • Hyper-V, ESXi, KVM - we offer appliance based on VyOS • CentOS/RHEL/Fedora Linux • Debian/Ubuntu Linux • FreeBSD 11
- 12. http://bit.ly/fastnetmon Hardware requirements • 1 GE NIC (10GE recommended for mirror/span modem, Intel NIC’s only) • Intel Xeon CPU (E5 v3 recommended for high speed capture from mirror) • 10GB hard disk drive 12
- 13. http://bit.ly/fastnetmon Performance • sFLOW - 40-100GE • NetFLOW - 40-100GE • Span/mirror - 10-40GE per node (tested up to 10 MPPS) 13
- 14. http://bit.ly/fastnetmon Supported vendors • Cisco • Juniper • Extreme • Huawei • Linux (ipt_NETFLOW) 14
- 15. http://bit.ly/fastnetmon Attack detection logic • By number of packets per second to/from /32 • By number of mbps per second from/to /32 • By number of flows per second from/to /32 • By number of fragmented packets from/to /32 • By number of tcp syn packets from/to /32 • By number of udp packets from/to /32 15
- 16. http://bit.ly/fastnetmon Complete support for most popular attacks for channel overflow • SYN flood • UDP amplification (SSDP, Chargen, DNS, SNMP, NTP) • IP fragmentation 16
- 17. http://bit.ly/fastnetmon Example attack report IP: 10.10.10.221 Attack type: syn_flood Initial attack power: 546475 packets per second Peak attack power: 546475 packets per second Attack direction: incoming Attack protocol: tcp Total incoming traffic: 245 mbps Total outgoing traffic: 0 mbps Total incoming pps: 99059 packets per second Total outgoing pps: 0 packets per second Total incoming flows: 98926 flows per second Total outgoing flows: 0 flows per second Average incoming traffic: 45 mbps Average outgoing traffic: 0 mbps Average incoming pps: 99059 packets per second Average outgoing pps: 0 packets per second Incoming ip fragmented traffic: 250 mbps Outgoing ip fragmented traffic: 0 mbps Incoming ip fragmented pps: 546475 packets per second Outgoing ip fragmented pps: 0 packets per second Incoming tcp traffic: 250 mbps Outgoing tcp traffic: 0 mbps Incoming tcp pps: 546475 packets per second Outgoing tcp pps: 0 packets per second Incoming syn tcp traffic: 250 mbps Outgoing syn tcp traffic: 0 mbps Incoming syn tcp pps: 546475 packets per second Outgoing syn tcp pps: 0 packets per second Incoming udp traffic: 0 mbps Outgoing udp traffic: 0 mbps Incoming udp pps: 0 packets per second 17
- 19. http://bit.ly/fastnetmon Attack visualization in Graphite 19
- 20. http://bit.ly/fastnetmon How I can help? • If you are Internet Carrier, please offer BGP blackhole for customers • If you are Home ISP or Data Center, please filter outgoing attacks with big attention • Contribute to FastNetMon on GitHub! • Share knowledge about DDoS mitigation 20
- 21. http://bit.ly/fastnetmon Thank you for attention! 21 pavel.odintsov@gmail.com