Because it's not technicaly possible, I mean we're on HN, we all know how internet works.

You should talk to a network engineer before making claims like this. There are mechanisms to curtail DDOS attacks at origin.

For a few reasons (political, economical) there’s little will to enact them, these attacks are so few and far between and you can pay your way out of them in most cases, so the incentives aren’t there for ISPs (whom are a commodity judged primarily on price and bandwidth)

▲

m00x 10 hours ago | parent [-]

How exactly would you keep the origin from sending a command to a botnet?

▲

dijit 10 hours ago | parent [-]

you don’t stop the message to the botnet, thats impossible:

You detect the behaviour downstream and send a signal to the ISP that there is traffic that needs to he rate limited.

One mechanism for this is called RTBH (Remote Triggered BlackHole) which relies on community tagged prefixes of addresses exceeding rate limited to be blackholed from forwarding traffic further in to the internet.

There’s also things like flowspec but a lot of things rely on proper trust between ASNs.

▲

Thaxll 9 hours ago | parent | next [-]

How do you know where it comes from, if they use UDP and change the src of the packets.

▲

Fabricio20 8 hours ago | parent | next [-]

IP spoofing is pretty uncommon nowadays because everyone has anti-spoofing mechanisms in place and most ASNs often don't forward spoofed addresses outbound.

But as the sibling mentioned, even with spoofing, you can still follow the packet trail from your border routers upstream. I think the main thing we are lacking is just responsibility on the ISP side, if someone reaches out complaining that half of your customers are sending ddos attacks, maybe you need to do something about it. Most of these huge attacks are compromised routers or IoT devices (remember Mirai Botnet?).

▲

esseph 7 hours ago | parent [-]

This is clearly not true, or the CAIDA anti-spoofer project wouldn't exist.

https://spoofer.caida.org/summary.php

	▲	Fabricio20 7 hours ago \| parent [-]
		Just because SOME ASNs don't have it in place doesn't mean it's not uncommon. In the link provided, 80% of all tracked network blocks for ipv4 are blocking spoofing. Though they only track 1000 ipv4 /24 blocks and their data is highly biased towards having spoofable ranges, considering their end goal is identifying spoofable networks!

▲

toast0 9 hours ago | parent | prev [-]

The Microsoft blog suggests there was miminal source spoofing (although I don't know how they determine that). But if you can't trust the IP source, packet samples from your border router should indicate which upstream is sending those packets ... then you ask them to find the source... eventually you'll get somewhere ... but when the sources are distributed, it's not so helpful to find the source, unless there's a mechanism to stop the source from sending it.

When I was running servers that would routinely attract DDoSed at ~ 10 Gbps, I ended up always running a low sample rate packet capture. Anytime I noticed a DDoS, I could go and look at the packets. If you've got connectivity to sink and measure 15 Tbps of DDoS, you can probably influence your providers to take some sampled packet captures and look at them too.

Even without clear information from packet captures, 15 Tbps is going to make an impact on traffic graphs, and you can figure out sources from those, although it might be a bit tricky because the attack duration was reported at only 40 seconds, so if someone only has hourly stats, it might be too small to be noticed; but once a minute stats are pretty common.

▲

esseph 7 hours ago | parent | prev [-]

It's not that simple and hasn't been for awhile.

There's layer upon layer of relays now, and meshed C2C networks.

Lots of DNS fastflux too

▲

SirMaster 10 hours ago | parent | prev [-]

I heard it's a series of tubes.