High Performance Traffic Shaping for DDoS Mitigation

Markus Goldstein, Matthias Reif, Armin Stahl, Thomas Breuel

In: Proceedings of the 2008 ACM CoNEXT conference. ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT-2008) 4th December 9-12 Madrid Spain ISBN 978-1-60558-264-1 ACM 12/2008.


Distributed Denial of Service (DDoS) attack mitigation systems usually generate a list of filter rules in order to block malicious traffic. In contrast to this binary decision we suggest to use traffic shaping whereas the bandwidth limit is defined by the probability of a source to be a legal user. As a proof of concept, we implemented a simple high performance Linux kernel module nf-HiShape which is able to shape thousands of source IP addresses at different bandwidth limits even under high packet rates. Our shaping algorithm is comparable to Random Early Detection (RED) applied on every single source IP range. The evaluation shows, that our kernel module can handle up to 50,000 IP ranges at nearly constant throughput whereas Linux tc already decreases throughput at about 200 ranges.


Poster.pdf (pdf, 135 KB ) High_Performance_Traffic_Shaping.pdf (pdf, 120 KB )

Deutsches Forschungszentrum für Künstliche Intelligenz
German Research Center for Artificial Intelligence