DDoS Mitigation Mechanics: Anycast & Scrubbing

1. Introduction: The Physics of the Flood

A Distributed Denial of Service (DDoS) attack is, at its core, a violation of Queueing Theory. In a network, every resource—bandwidth, CPU cycles, memory buffers—has a finite capacity. If the arrival rate of packets ($\lambda$) exceeds the service rate of the resource ($\mu$), the queue length grows exponentially toward infinity.

The goal of an attacker is to reach the Saturation Point, where legitimate users are dropped as "Tail Drop" collateral. The goal of the defender is to identify and discard the "Signal" from the "Noise" at line rate, before it reaches the resource bottleneck.

2. Taxonomy of the Attack Surface

To perform forensic mitigation, we must classify the attack by its target layer and its "Force Multiplier" mechanics.

2.1 Volumetric Attacks (The Brute Force)

Volumetric attacks target the physical or logical capacity of the network link (Layer 3/4). They are measured in Bits Per Second (BPS) or Packets Per Second (PPS).

• UDP Floods: Sending massive, randomized UDP packets to saturate the pipe.
• ICMP Floods: Using "Ping" or "Unreachable" messages to consume bandwidth and CPU on edge routers.

2.2 Reflection & Amplification Math

The most efficient volumetric attacks use UDP Reflection. By spoofing the victim's source IP, an attacker sends requests to public servers (DNS, NTP, SNMP, Memcached) that generate much larger responses.

3. Protocol & State-Exhaustion Forensics

Protocol attacks don't necessarily saturate the link; they saturate the Connection Table of a firewall, load balancer, or server.

3.1 The TCP SYN Flood

By sending SYN packets and ignoring the SYN-ACK, an attacker leaves the server in a SYN_RECV state. The server allocates a Transmission Control Block (TCB), typically 256 to 1024 bytes, for each "half-open" connection.

If a server can handle 1,000,000 concurrent connections and the attacker sends 100,000 SYNs/sec with a 60-second timeout, the server is dead in 10 seconds.

4. Anycast: The Topological Dilution

The most effective defense against volumetric DDoS is Anycast Routing. In an Anycast architecture, the same IP address is announced via BGP from hundreds of geographically dispersed locations.

The Forensic Logic: A botnet is global. If the target is a single Unicast IP in Chicago, 100% of the attack hits Chicago. If the target is an Anycast IP, the bots in Tokyo hit Tokyo PoPs, and bots in London hit London PoPs. The attack is "diluted" across the global backbone.

Geographic Sinkholing: Anycast allows engineers to "sinkhole" an attack in a specific region. If an attack is originating solely from a specific ISP in Brazil, the Anycast routing will naturally trap that traffic in the nearest Brazilian scrubbing center, protecting the rest of the global network.

5. Scrubbing Centers: The Terabit Filtration Lab

When traffic volume exceeds the edge router's capacity, it is diverted to a Scrubbing Center. This is a specialized data center designed to filter "Dirty" packets and return "Clean" traffic to the origin.

5.1 Diversion Mechanics: BGP & GRE

1. BGP Announcement: The scrubber announces the victim's /24 prefix with a higher preference than the origin.
2. Inspection: Traffic enters the scrubber and passes through a Match-Action Pipeline.
3. Injection (Clean Pipe): Filtered traffic is encapsulated in a GRE Tunnel or L2VPN and sent back to the origin server.

6. Application Layer (L7) Forensics: The "Invisible" Attack

In 2026, the most dangerous attacks are L7 Requests per Second (RPS) floods. These look like legitimate user traffic but are designed to exhaust the database or CPU.

6.1 HTTP/2 Rapid Reset (The Modern Nightmare)

Exploiting CVE-2023-44487, attackers use the HTTP/2 "Stream Reset" feature. A single TCP connection can open 100 streams, send 100 requests, and immediately send 100 RST_STREAM frames.

The Forensic Signature: A massive spike in RST_STREAM packets. The server must still perform the expensive work of initializing the stream and parsing headers before the reset is processed. An attacker can generate 30 million RPS with just a few compromised servers.

6.2 Behavior Fingerprinting

To filter L7 attacks, we use Entropy Analysis:

• JA3 Fingerprinting: Analyzing the TLS Client Hello (cipher suites, extensions). Botnets often use specific SSL libraries that differ from browsers.
• TTFB (Time to First Byte): Measuring the delay between the GET request and the first byte of headers. "Slow and Low" attacks like Slowloris are identified by their abnormally high TTFB.
• Honeypot Resources: Placing hidden "invisible" links in the HTML. A human will never click them; a bot crawling the DOM will, leading to an immediate IP ban.

7. Hardware Offload: eBPF, XDP, and DPUs

At 400 Gbps, the Linux kernel's network stack is too slow. Every context switch to user-space is a vulnerability. 2026-standard defense uses Programmable Data Planes.

7.1 XDP (Express Data Path)

XDP allows us to run eBPF programs directly in the NIC driver, before the packet even reaches the kernel.

This allows a single commodity server to drop 20 million packets per second with $< 1\,\%$ CPU usage.

7.2 DPU Offload (BlueField-4)

Modern Data Processing Units (DPUs) act as a "Server before the Server." The DPU performs 100% of the DDoS scrubbing, SSL termination, and stateful tracking, presenting only "Clean" traffic to the host CPU. This ensures that even if the host is under attack, its management plane remains accessible.

8. BGP Flowspec: The Surgical Kill Switch

BGP Flowspec (RFC 5575) allows you to push filtering rules to your ISP's core routers. Unlike RTBH (Remotely Triggered Black Hole), which is all-or-nothing, Flowspec is surgical.

This rule drops ONLY the large DNS responses used in a reflection attack while allowing small DNS queries to pass through. It is the most powerful tool for maintaining Business Continuity during a massive flood.

9. Step-by-Step Incident Response Forensics

When the alert fires, follow this forensic protocol:

1. Analyze the Vector: Is it BPS (Bandwidth), PPS (Packets), or RPS (Requests)?
2. Identify the Signature: Check the tcpdump for common flags (e.g., all fragments have the same ID) or specific source ports (123, 11211, 1900).
3. Deploy Edge Mitigation: Apply RTBH for the most extreme floods or Flowspec for surgical filtering.
4. Verify Anycast Health: Ensure the attack is being distributed evenly. If one PoP is redlining, adjust BGP Local Preference to shift load.
5. Enable L7 Challenges: Turn on "Under Attack Mode" (JS challenges/CAPTCHA) to filter bot-driven HTTP floods.

🎬 Learning Animation Aid

Conclusion

DDoS mitigation is an eternal arms race of economics and physics. By leveraging the distributed nature of the internet (Anycast) and the speed of modern silicon (ASICs/DPUs), we can survive even the largest recorded floods. However, as AI-driven botnets become more human-like, the frontier moves from "filtering packets" to "verifying intent." The future belongs to those who can model the behavior of a user as accurately as they model the arrival of a packet.