运营商的网络安全体系解决方案

©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID1cleanpipeservicesolution200612©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID2ƒTypesofDDoSattacksƒEvolutionofSPDDoSdefenceƒCleanpipeƒCleanpipeƒCleanpipeƒCleanpipe©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID3InternetDDoSƒ8internet.eCommerceƒPC,PC,ƒ,.ƒDDoS:,,,,,,,…ƒ:4%,16%,1©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID4DDoSAttacksAreHereToStaySymantecInternetSecurityReport–June‘05ƒDoSattacksgrowfrom119to927perday-anincreaseof679%ƒLarge%ofDDoSattacksaremotivatedbyextortiondemandsƒ75MillioncomputersestimatedtobeinfestedwithbotsoftwareƒAttacksizeisinthe2-7GigrangeƒTheDoSproblemisnota100yearfloodanymore!‘Zombie'ringallegedlyhit1.5millioncomputers–“onlyadropintheocean.©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID5BOTNETS–DDOSCECE:,,…‘’LastMileConnectionISPƒBOTNET!ƒBOTNET’’,,.ƒBOTNETsDDOS:ICMPAttacks,TCPAttacks,andUDPAttacks,httpoverloadƒBOTNET,.ƒBOTNET.©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID6DDoSƒ/TCP/HTTP,,.ƒƒ,DNS/DHCP,.ƒ©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID7Denial-of-service(DoS)1988112RobertMorrisJr.—internet90DoSƒ90InternetDoS90DoSPingofdeath,smurf,SYNflooding,ƒ“”2000DDoSYahoo,AmazonCodered,SQLslammerƒ“”DDoS’botnet’‘DDoS’DDoS©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID8DDoSƒSYNfloodingTCPTCP3---SYNƒUDPfloodingUDPUDPUDPICMPƒSmurf‘’ICMPICMPƒLandUDPƒTeardropfragementƒPingofdeath65535pingƒTCPIPDDOS©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID9DDoSƒHTTPTCPDDoSTCPƒDNSDNSUDPDNSƒSQLSQLSQLCPU©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID10CiscoGuardBroadestAttackProtection1.SpoofedandNon-SpoofedFloodAttacks–TCPFlag(SYN,SYN-ACK,ACK,FIN)–ICMP–UDP–Examples:SYNFlood,Smurf,LAND,UDPFlood2.Zombie/BotnetAttacks–EachzombieorbotsourceopensmultipleTCPconnections–EachzombieorbotsourceopensmultipleTCPsessionsandissuerepetitiveHTTPrequests3.DNSAttacks–DNSRequestFlood1.PacketSizeAttacksFragmentedPacketsLargePacketsExamples:Teardrop,Ping-of-Death2.LowRateZombie/BotnetAttacks–SimilartoBandwidthconsumptionattacksexceptthateachattacksourcesendsmultiplerequestsatlowrate3.DNSAttacks–DNSRecursiveLookupƒSIPProtection–SIPAnti-SpoofingBandwidthConsumptionAttacksResourceStarvationAttacks©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID11DOSvs.DDOSƒDOSDOSTearDropLandICMPFloodƒDDOS“”©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID12ƒTypesofDDoSattacksƒEvolutionofSPDDoSdefenceƒCleanpipeƒCleanpipeƒCleanpipeƒCleanpipe©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID13DDOSƒISPƒIDCƒISPMailServerDNSServerƒISP©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID14ƒTypesofDDoSattacksƒEvolutionofSPDDoSdefenceƒCleanpipeƒCleanpipeƒCleanpipeƒCleanpipe©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID15EvolutionofSPDDoSdefenceƒƒURPFƒSinkhole/blackholeƒCleanpipe©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID16uRPFƒuRPFstrict(uRPFCEFDCEF)interfacepos1/0ipverifyunicastreverse-pathACLinterfacepos1/0ipverifyunicastreverse-path190access-list190permitip{customernetwork}{customernetworkmask}anyaccess-list190denyipanyany[log]Looseinterfacepos1/0ipverunicastsourcereachable-viaany©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID17SinkHoleRouters/Networks©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID18SinkHoleRouters/Networks©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID19BlackHoleFiltering©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID20RemotelyTriggeredBlackHoleFiltering-Preparation©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID21RemotelyTriggeredBlackHoleFiltering-Activation©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID22RemotelyTriggeredBlackHoleFiltering-Activation©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID23ƒTypesofDDoSattacksƒEvolutionofSPDDoSdefenceƒCleanpipeƒCleanpipeƒCleanpipeƒCleanpipe©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID24“,DDOS,”242424©2003CiscoSystems,Inc.Allrightsreserved.Presentation_IDCleanPipes:DDoSCleanpipes,DDoS,,.“CleanPipes”©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID25CleanPipesInjectDivertDefenseMitigateCiscoNFP,.CiscoGuardCiscoNetflowDetector’’Detect©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID26Cleanpipe?,Defend&LearnDetectionDiversionCleaningRe-InjectionYesYesNoNo©2006CiscoSystems,Inc.Allrightsreserved.CiscoConfidentialPresentation_ID27CleanPipes‘’ƒCleanPipesDDOSƒCleanPipesover-subscriberGuard30Zone()1:10GuardGuardƒGuardGuard‘’GuardDDoS