Managing Mission - Critical Domains and DNS

Mitigation devices

The market abounds with hardware and virtual appliance DDoS mitigation devices and they are nice to have. The issue I have with these is no matter how good they are, if the attack fills up the pipes going into the POP where these devices reside, it doesn't matter if they can rinse out all that attack traffic. The attack is still going to crowd out your legitimate traffic.

These devices are effective when the volume of attack traffic is below the threshold of the POP they are protecting. These can be invaluable for protecting TCP/web-based assets, where the attack may be more about the number of packets than it is the bandwidth volume of the attack.

But when it comes to UDP and DNS in particular, I find mitigation appliances ...