Realtime DoS mitigation with VELOS BX520 Blade

Key Concepts:

• DDoS Attacks: Distributed Denial of Service attacks, aiming to disrupt service availability.
• F5 Velos: F5's chassis-based platform designed for high-performance application delivery and security.
• Big IP DOS Protection: F5's solution for mitigating DDoS attacks.
• Flood Vector: A specific type of DDoS attack that overwhelms a system with traffic.
• Throughput: The rate of data transfer.
• Concurrent Connections: The number of active connections to a server at a given time.
• API-First Architecture: A design approach where APIs are prioritized for all functionalities.
• Kubernetes: An open-source container orchestration system.

Impact of DDoS Attacks

DDoS attacks are a common reality, leading to several negative consequences:

• Loss of Revenue: Disrupted services directly translate to lost sales and business opportunities.
• Degradation of Infrastructure: Overwhelmed systems can experience performance slowdowns and failures.
• Indirect Costs: These include negative customer experiences and damage to brand image.
• Effectiveness of Small Attacks: DDoS attacks don't need to be large-scale to cause significant disruption.

F5 Velos Key Specifications

F5 Velos is designed to address the challenges of modern application delivery and security:

• Massive Throughput: Capable of handling high volumes of traffic.
• Billions of Concurrent Connections: Supports a large number of simultaneous connections.
• High-Density Chassis: Offers a compact and efficient hardware design.
• Multi-Tenancy and Blade Groupings: Allows for resource isolation and flexible deployment.
• API-First Architecture: Enables full automation and integration with other systems.
• Future-Proof Architecture: Built on Kubernetes for scalability and adaptability.

DDoS Mitigation Demo

The demo illustrates the effectiveness of Big IP DOS Protection against modern DDoS attacks:

• Attack Characteristics: The demo highlights that even attacks of shorter duration can negatively impact performance.
• Demo Environment: Utilizes simulated application tools to generate realistic traffic patterns.
• Attack Launch: A DDoS attack is launched, causing performance degradation.
• Flood Vector Mitigation: Big IP DOS Protection is enabled to mitigate the flood vector.
• Performance Recovery: Performance recovers within seconds after mitigation is activated.

Simulated Application Tools and Attack Details

The demo provides specific details about the simulated environment and the attack:

• Initial State: The BIG IP dashboard shows good performance before the attack.
• Traffic Mix: The generated traffic includes a mix of applications and protocols.
• Attack Intensity: The attack reaches 10 Gbits per second and over 8 million connections per second.
• Impact on BIG IP: The BIG IP dashboard shows a rapid increase in open connections, transaction failures, and high memory and CPU utilization.

DDoS Flood Mitigation Results

The demo demonstrates the effectiveness of Big IP DOS Protection in real-time:

• Throughput Restoration: Throughput is restored in real-time after enabling DDoS flood mitigation.
• Resource Recovery: CPU and memory utilization are restored in real-time.

Conclusion

The demonstration effectively shows that F5's Big IP DOS Protection, especially when deployed on the Velos platform, can rapidly mitigate DDoS attacks, even those that are not massive in scale. The key takeaway is that modern DDoS protection solutions must be able to quickly identify and respond to attacks to minimize disruption and maintain service availability. The demo highlights the importance of real-time mitigation and the ability to handle high volumes of traffic and connections.