DiamWall's Mitigation Against 1Tbps DDoS Attacks: A Comprehensive Analysis

DiamWall's Proactive Defense Against Gigantic DDoS Attacks

In the world of cybersecurity, dealing with Distributed Denial of Service (DDoS) attacks is a major challenge. Recently, these attacks have grown to be very large and difficult to handle, with DiamWall technologies leading the charge in defending against them. In this article, we explore how DiamWall effectively fights off multiple DDoS attacks, reaching over 1 terabit per second, highlighting our strength and knowledge in protecting digital spaces.

The Escalation of DDoS Threats

While many past incidents have aimed at disrupting specific client-hosted services, the attack we're delving into targeted our network infrastructure directly. Throughout these incidents, we identified a plethora of vectors at play. However, this discussion will primarily concentrate on the extraordinary DDoS attempts exceeding 1TB. Broadening our lens to include DDoS attacks over 300Gbps, we observed a distribution: 33% were UDP-based, 22% leveraged TCP-ACK, another 22% utilized GRE, with the remaining attacks split among ICMP (5%), MFU (5%), FRGU (5%), and LFU (5%).

It's reasonable to expect that the largest attack we observed, peaking at 1.56 Tbps, might have used UDP, a typical choice for such assaults. Surprisingly, however, it utilized TCP-ACK. This detail isn't just a minor technicality; it speaks volumes about the attack's complexity and the strategic thinking behind it, marking it as a notable event in cybersecurity history. For those interested in a deeper dive into this incident, our comprehensive report is available: DiamWall Mitigation Report on the 1.56 Tbps DDoS Attack

Figure 1: Distribution of DDoS Attack Vectors

Attack Overview

Between September 11, 2023, and February 25, 2024, we observed eight DDoS attacks exceeding 1 Tbps, with the most massive reaching 1.56 Tbps and 134 Mpps, and the smallest peaking at 1.01 Tbps and 86.86 Mpps. Remarkably, most of these attacks employed TCP-ACK, a method notable for its potential to significantly impact network stability. This recurrence is both impressive and record-setting. Below, we detail the eight DDoS assaults that DiamWall effectively neutralized.

1.56 Tbps Attack (February 25, 2024)

Peak Metrics: 1.56 Tbps and 134.00 Mpps.
Attack Vector: TCP ACK packets targeting port 443.
Analysis: This attack's sophistication aimed to drain network resources significantly.
Report Link: Detailed Report and Graph

Figure 2: Graphical Analysis of the 1.56 Tbps Attack

1.45 Tbps Attack (February 24, 2024)

Peak Metrics: 1.45 Tbps and 355.19 Mpps.
Attack Vector: TCP ACK packets impacting ports 443 and 80.
Analysis: Indicates a deliberate strategy to interrupt service across multiple network channels.
Report Link: Detailed Report and Graph

(Being two graphs in two different ports, to reduce space occupation you can find the graphs on the report)

1.26 Tbps Attack (December 7, 2023)

Peak Metrics: 1.26 Tbps and 145.22 Mpps.
Attack Vector: Leveraged GRE protocol, not targeting any specific port.
Analysis: Demonstrates the use of GRE protocol to maximize attack potency.
Report Link: Detailed Report and Graph

Figure 4: Graphical Analysis of the 1.26 Tbps Attack

1.08 Tbps Attack (October 20, 2023)

Peak Metrics: 1.08 Tbps and 150.47 Mpps.
Attack Vector: Used UDP packets, targeting port 80.
Analysis: Aimed at inundating the target with excessive UDP traffic.
Report Link: Detailed Report and Graph

Figure 5: Graphical Analysis of the 1.08 Tbps Attack

1.06 Tbps Attack (September 11, 2023)

Peak Metrics: 1.06 Tbps and 228.22 Mpps.
Attack Vector: Conducted via GRE protocol, targeting port 80.
Analysis: Illustrates an exploitation of GRE protocol weaknesses at a high transaction rate.
Report Link: Detailed Report and Graph

Figure 6: Graphical Analysis of the 1.06 Tbps Attack

1.02 Tbps Attack (December 4, 2023)

Peak Metrics: 1.02 Tbps and 129.50 Mpps.
Attack Vector: Executed using UDP packets, concentrating on port 80.
Analysis: Designed to flood the network layer with an overwhelming volume of UDP packets.
Report Link: Detailed Report and Graph

Figure 7: Graphical Analysis of the 1.02 Tbps Attack

1.01 Tbps Attack (December 4, 2023, 2:40 AM)

Peak Metrics: 1.01 Tbps and 127.96 Mpps.
Attack Vector: Utilized UDP packets, aiming at port 80.
Analysis: This strategy likely sought to saturate network capabilities through UDP traffic volume.
Report Link: Detailed Report and Graph

Figure 8: Graphical Analysis of the 1.01 Tbps Attack at 2:40 AM

1.01 Tbps Attack (February 25, 2024, 10:39 PM)

Peak Metrics: 1.01 Tbps and 86.86 Mpps.
Attack Vector: Employed TCP ACK packets, focusing on port 443.
Analysis: Reveals a tactical deployment of ACK packets to exploit network protocols.
Report Link: Detailed Report and Graph

Figure 9: Graphical Analysis of the 1.01 Tbps Attack at 10:39 PM

Strategic Impact

Facing these intense cybersecurity threats, we're relieved and proud to say that our customers didn't face any downtime. Their operations ran as smoothly as usual, a clear testament to the strength of our defense strategies and our unwavering commitment to keep things running, no matter the challenge. By adding more Points of Presence (PoPs) to our network, we've significantly upped our game, making our Anycasted network more robust and scalable in no time.

As we keep building and expanding our infrastructure, our ability to fend off the ever-growing DDoS attack threats gets stronger. This progress doesn't just toughen up our network but also broadens our protective reach. It's a solid step forward in our mission to secure the digital space for everyone. We're not just patting ourselves on the back for the present success; we see it as a crucial stepping stone towards achieving greater heights in operational excellence and leading the way in cybersecurity

Conclusion

Wrapping up, our in-depth examination of the DDoS attacks that DiamWall has countered underscores the growing complexity and intensity of cyber threats in today's tech-driven world. Thanks to their strategic planning, solid infrastructure, and cutting-edge mitigation tactics, DiamWall has effectively protected its clients from significant disruptions, setting new standards in cyber defense. These events remind us of the continuous evolution of cyber threats, highlighting the critical need for ongoing innovation in cybersecurity measures.

Moving forward, the insights gained from these incidents will undoubtedly inform and refine our future defense strategies, helping to ensure a safer digital space for everyone. DiamWall's dedication to cybersecurity excellence demonstrates a proactive approach that not only addresses current threats but also anticipates and mitigates future risks, thus preserving the digital ecosystem's integrity for years to come.

For more insights into DiamWall's mitigation efforts and detailed reports, visit our knowledge center.