A sweep attack is a network scanning
technique that typically sweeps your network by sending packets, and using the packet responses
to determine live hosts. Typical attacks use ICMP to accomplish this.
The sweep vector tracks packets by source address. Packets from a specific
source that meet the defined single endpoint sweep criteria, and exceed the rate limit, are
dropped. You can also configure the sweep vector to automatically blacklist an IP address from
which the sweep attack originates.
Important: The
sweep mechanism protects against a flood attack from a single source, whether that attack is to a
single destination host, or multiple hosts.
A flood attack is a an attack technique
that floods your network with packets of a certain type, in an attempt to overwhelm the system. A
typical attack might flood the system with SYN packets without then sending corresponding ACK
responses. UDP flood attacks flood your network with a large amount of UDP packets, requiring the
system to verify applications and send responses.
The flood vector tracks packets per destination address. Packets to a
specific destination that meet the defined Single Endpoint Flood criteria, and exceed the rate
limit, are dropped.
The BIG-IP system can detect such
attacks with a configurable detection threshold, and can rate limit packets from a source when
the detection threshold is reached.
You can configure DoS sweep and flood prevention to detect and prevent
floods and sweeps of ICMP, UDP, TCP SYN without ACK, or any IP packets that originate from a
single source address, according to the threshold setting. Both IPv4 and IPv6 are supported. The
sweep vector acts first, so a packet flood from a single source address to a single destination
address is handled by the sweep vector.
You can configure DoS sweep and flood prevention through DoS Protection
>Device Configuration > Network Security.
Task list
Detecting and protecting against DoS sweep attacks
With the DoS Protection Device Configuration screen settings, you can set detection
thresholds and rate limits for DoS sweep attacks, and automatically blacklist IP
addresses that you detect perpetrating such attacks.
-
On the Main tab, click .
The DoS Device Protection
screen opens.
-
At the bottom of the screen, choose Network.
The screen displays the network attack
vectors.
-
Click Single Endpoint Sweep.
The Single Endpoint Sweep
Properties pane opens on the right side of the screen.
-
On the Properties pane, for State, select Mitigate.
-
From the Detection Threshold EPS list,
select Specify or
Infinite.
- Use Specify to set a value
(in events per second) for the attack detection threshold. If packets of the
specified types cross the threshold, an attack is logged and reported. The
system continues to check every second, and registers an attack as long as
the threshold is exceeded.
- Use Infinite to set no value
for the threshold. This specifies that this type of attack is not logged or
reported based on this threshold.
-
From the Mitigation Threshold EPS
list, select Specify
or Infinite.
- Use Specify to set a value
(in events per second), which cannot be exceeded. If the number of events of
this type exceeds the threshold, excess events are dropped until the rate no
longer exceeds the threshold.
- Use Infinite to set no value
for the threshold. This specifies that this type of attack is not
rate-limited.
-
To automatically blacklist bad actor IP addresses,
select Add Source Address to
Category.
Important: For this to work, you need to assign an IP
Intelligence policy to the appropriate context (device, virtual server, or
route domain). For the device, assign a global policy: . For the virtual server or route domain, assign the IP
Intelligence policy on the Security tab.
-
From the Category Name list, select a
black list category to apply to automatically blacklisted addresses.
-
In the Sustained Attack Detection
Time field, specify the duration in seconds after which the
attacking endpoint is blacklisted. By default, the configuration adds an IP
address to the blacklist after one minute (60 seconds).
-
In the Category Duration Time field,
specify the length of time in seconds that the address will remain on the
blacklist. The default is 14400 seconds (4 hours).
-
To allow IP source blacklist entries to be
advertised to edge routers so they will null route their traffic, select
Allow External
Advertisement.
Note: To advertise to edge routers, you must configure a
Blacklist Publisher and Publisher Profile at .
-
In the Packet Type area, select the
packet types you want to detect for this attack type in the Available list, and move them
to the Selected
list.
Now you have configured the system to provide protection against DoS sweep attacks,
to allow such attacks to be identified in system logs and reports, and to automatically
add such attackers to a blacklist of your choice.
Configure flood attack prevention, and configure any other DoS responses, in the
DoS device configuration. Configure whitelist entries for addresses that you
specifically choose to bypass all DoS checks. Configure SNMP traps, logging, and
reporting for DoS attacks, to track threats to your system.
