Enterprise QoS Solution Reference Network Design Guide

Chapter 1 Quality of Service Design Overview
Version 3.3
How Can I Use QoS Tools to Mitigate DoS/Worm Attacks?
Worms, on the other hand, exploit security vulnerabilities in their targets and disguisedly carry harmful
payloads that usually include a self-propagating mechanism. Network infrastructure usually isn’t the
direct target of a worm attack, but can become collateral damage as worms exponentially self-propagate.
The rapidly multiplying volume of traffic flows eventually drowns the CPU/hardware resources of
routers and switches in their paths, indirectly causing Denial of Service to legitimate traffic flows, as
shown in Figure 1-11.
Figure 1-11 Direct and Indirect Collateral Damage from DoS/Worm Attacks
System
under
attack
End systems overload
High CPU
Applications impacted
Access
Distribution
A reactive approach to mitigating such attacks is to reverse-engineer the worm and set up intrusion
detection mechanisms and/or ACLs and/or NBAR policies to limit its propagation. However, the
increased sophistication and complexity of worms make them harder and harder to separate from
legitimate traffic flows. This exacerbates the finite time lag between when a worm begins to propagate
and when the following can take place:
Sufficient analysis has been performed to understand how the worm operates and what its network
characteristics are.
An appropriate patch, plug or ACL is disseminated to network devices that may be in the path of worm;
this task may be hampered by the attack itself, as network devices may become unreachable for
administration during the attacks.
These time lags may not seem long in absolute terms, such as in minutes, but the relative window of
opportunity for damage is huge. For example, in 2003, the number of hosts infected with the Slammer
worm (a Sapphire worm variant) doubled every 8.5 seconds on average, infecting over 75,000 hosts in
just 11 minutes and performing scans of 55 million more hosts within the same time period.
Note Interestingly, a 2002 CSI/FBI report stated that the majority of network attacks occur from within an
organization, typically by disgruntled employees. This underscores the need to protect the Access-Edges
of enterprise networks as well as their Internet edges.
A proactive approach to mitigating DoS/worm flooding attacks within enterprise networks is to
immediately respond to out-of-profile network behavior indicative of a DoS or worm attack using
Campus Access-Layer policers. Such policers meter traffic rates received from endpoint devices and
markdown excess traffic spikes to the Scavenger class (DSCP CS1) when these exceed specified
watermarks (at which point they are no longer considered normal flows).
Core
Network links overload
High packet loss
Mission critical
Applications impacted
Routers overloaded
High CPU
Instability
Loss of management
Enterprise QoS Solution Reference Network Design Guide
119480
1-29