Carpet Bombing: Invisible DDoS Attacks
Carpet Bombing: Invisible DDoS Attacks
A DDoS attack you will not see in per-IP alerts, and which will still saturate your link
The classic DDoS attack scenario is easy to detect: one target address, a sharp jump in traffic, an exceeded threshold, an alert. Most detection systems, and most thresholds configured in operator networks, were created with exactly this scenario in mind. Attackers know this perfectly well. That is why they increasingly spread the same attack volume across hundreds or thousands of addresses at once.
This technique is called carpet bombing (also known as spread spectrum or subnet DDoS). It is not new, but its scale is steadily growing: industry research teams observe thousands of such attacks per day, and the vast majority of them last about a minute. Short, but enough to saturate an operator's link and generate a wave of customer reports.
The math of an attack that "does not exist"
The mechanics are simple. Suppose the attacker has a volume of 20 Gbps, and detection thresholds in the network are set to 1 Gbps per IP address. An attack on a single address is detected immediately. But the same volume spread across 500 addresses in a customer's subnet is only 40 Mbps per address: from the perspective of each individual IP the traffic looks harmless, and no threshold is exceeded.
Meanwhile, at the interconnect with the upstream, these streams add up. The transit link is saturated, routers and stateful devices (firewalls, BRAS, session tables) work under load, customers report internet problems, and the per-IP detection system reports that everything is fine. The NOC team looks for a link failure or a problem at the provider, because nothing points to an attack.
The targets of the attack are, incidentally, often not fixed: attackers can change the attacked addresses during the incident, drawing them at random from the entire prefix. This makes both detection and manual response even harder.
Why classic defense mechanisms fail twice over
Carpet bombing bypasses not only detection but also standard mitigation.
First, RTBH ceases to be a sensible option. Blackholing a single attacked address is an acceptable cost. But when several hundred addresses in a subnet are attacked, blackholing means cutting off the entire subnet, exactly the effect the attacker wanted to achieve, only carried out by the operator's own hands.
Second, systems that initiate mitigation per destination address do not scale to such a scenario. A thousand attacked addresses is potentially a thousand separate detections, a thousand rules, a thousand entries, which can overload the protection system itself or the rule tables on routers. FlowSpec has limited TCAM capacity, and flooding a router with hundreds of per-IP rules is a real operational risk.
Effective defense therefore requires a different approach: looking at traffic not only per address but per subnet, and generating rules that cover the attack as a whole.
Carpet bombing attack
How LiveShield detects and cuts out carpet bombing
LiveShield was designed from the start for operator environments, so detection works in parallel on two levels: individual IP addresses and entire subnets. Traffic thresholds can be defined independently for both levels. As a result, a distributed attack in which no single address exceeds the threshold is detected at the subnet level, because there the anomaly is perfectly visible.
That is not all, though, because detection alone is half the problem. The key elements of mitigation:
- Dynamic mask adjustment. During the attack, the system automatically widens or narrows the mask of the protected subnet, following the actual extent of the attack, even when the attacker changes targets during the incident.
- Aggregation of attacks into the narrowest possible rules. Instead of hundreds of per-IP rules, the system generates rules covering the attacked range and traffic pattern (protocol, ports, packet characteristics), minimizing the impact on unattacked traffic and saving TCAM resources on routers.
- Protection against overloading the system itself. The subnet aggregation mechanism (anti-overload) combines many parallel attacks into one incident, so detection and mitigation remain stable even with a large number of simultaneous targets.
- Analysis of sampled packets in real time. For TCP and UDP traffic, the system learns the attack pattern and refines filtering within a few seconds of detection. The first reaction occurs practically from the first second of the incident.
Rules reach the edge routers via BGP FlowSpec, and for volumes threatening link saturation, selective blackholing is available. Every incident, along with the carpet bombing detection flag, statistics and traffic samples, is documented and visible in reports, which also matters in the context of the reporting obligations arising from KSC/NIS2.
A test worth doing in your own network
If you want to check whether your current protection sees distributed attacks, answer one question: does the detection system in your network monitor thresholds only per IP address? If so, carpet bombing will pass through it unnoticed, and the first "alert" will be phone calls from customers.
LiveShield runs on-premise, in the operator's infrastructure, and detection of distributed carpet bomb attacks is part of the standard license, with no additional modules. How the system works, including the view of incidents flagged as carpet bombing, can be seen at demo.liveshield.net.
