<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-ddos-mitigation
description: >-
  Implement DDoS detection and mitigation using traffic analysis, rate limiting,
  SYN flood protection, BGP flowspec, scrubbing center integration, and Suricata-based
  volumetric attack detection for network resilience.
domain: cybersecurity
subdomain: network-security
tags:
  - ddos
  - rate-limiting
  - syn-flood
  - flowspec
  - mitigation
  - traffic-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1498", "T1498.001", "T1499"]
  nist-csf: ["DE.CM-1", "DE.AE-1", "PR.PT-4"]
  uuid: a1b2c3d4-1010-4a00-b010-f00d00000010
---

# Implementing DDoS Mitigation

## Overview

DDoS attacks overwhelm network capacity, exhaust server resources, or exploit application
logic to deny service. Effective mitigation requires layered detection at network,
transport, and application layers, combined with automated response including rate
limiting, SYN cookies, BGP flowspec rules, and traffic scrubbing. This skill covers
volumetric attack detection, protocol abuse identification, and automated mitigation.

Mode: `[MODE: BLUE]` for detection and mitigation; `[MODE: INCIDENT]` for active attack response.

## Prerequisites

| Requirement | Details |
|---|---|
| Suricata 7.0+ or Zeek for traffic analysis | Required |
| Linux kernel with SYN cookie support | Required |
| iptables/nftables for rate limiting | Required |
| BGP-capable router for flowspec (optional) | Required |
| NetFlow/sFlow collector for volumetric analysis | Required |

## Key Concepts

### Linux Kernel-Level Mitigations

```bash
# Enable SYN cookies
sysctl -w net.ipv4.tcp_syncookies=1

# Increase SYN backlog
sysctl -w net.ipv4.tcp_max_syn_backlog=65536
sysctl -w net.core.somaxconn=65536

# Reduce SYN-ACK retries
sysctl -w net.ipv4.tcp_synack_retries=2

# Enable reverse path filtering
sysctl -w net.ipv4.conf.all.rp_filter=1
```

### nftables Rate Limiting

```bash
# Rate-limit new connections per source IP
nft add table inet ddos_filter
nft add chain inet ddos_filter input '{ type filter hook input priority 0; policy accept; }'

# Limit SYN packets
nft add rule inet ddos_filter input tcp flags syn limit rate 25/second burst 50 packets accept
nft add rule inet ddos_filter input tcp flags syn drop

# Rate-limit ICMP
nft add rule inet ddos_filter input icmp type echo-request limit rate 10/second burst 20 packets accept
nft add rule inet ddos_filter input icmp type echo-request drop

# Rate-limit per source IP with meters
nft add rule inet ddos_filter input tcp flags syn \
  meter syn_flood '{ ip saddr limit rate 20/second burst 40 packets }' accept
nft add rule inet ddos_filter input tcp flags syn drop
```

### Suricata DDoS Detection Rules

```
# SYN flood detection
alert tcp any any -> $HOME_NET any ( \
  msg:"DDoS - SYN flood detected"; \
  flags:S,12; \
  threshold:type both, track by_dst, count 1000, seconds 10; \
  classtype:attempted-dos; \
  sid:3001080; rev:1; \
  metadata:mitre_attack_technique T1498.001;)

# UDP amplification attack (DNS reflection)
alert udp any 53 -> $HOME_NET any ( \
  msg:"DDoS - DNS amplification attack"; \
  dsize:>512; \
  threshold:type both, track by_dst, count 200, seconds 10; \
  sid:3001081; rev:1;)

# NTP amplification
alert udp any 123 -> $HOME_NET any ( \
  msg:"DDoS - NTP amplification attack"; \
  content:"|17|"; offset:0; depth:1; \
  dsize:>200; \
  threshold:type both, track by_dst, count 100, seconds 10; \
  sid:3001082; rev:1;)

# HTTP flood
alert http any any -> $HOME_NET any ( \
  msg:"DDoS - HTTP request flood"; \
  flow:established,to_server; \
  threshold:type both, track by_src, count 500, seconds 60; \
  sid:3001083; rev:1;)
```

### Zeek DDoS Monitoring

```zeek
# ddos-detect.zeek — volumetric attack detection
@load base/protocols/conn

module DDoSDetect;

export {
    redef enum Notice::Type += {
        SYN_Flood_Detected,
        UDP_Amplification,
    };
    const syn_threshold = 1000 &redef;
}

global syn_counter: table[addr] of count = {} &default=0 &create_expire=1min;

event new_connection(c: connection) {
    if ( c$conn$proto == tcp ) {
        ++syn_counter[c$id$resp_h];
        if ( syn_counter[c$id$resp_h] > syn_threshold ) {
            NOTICE([$note=SYN_Flood_Detected,
                    $msg=fmt("SYN flood: %d SYNs to %s in 1 min",
                             syn_counter[c$id$resp_h], c$id$resp_h),
                    $conn=c]);
        }
    }
}
```

### Traffic Analysis Commands

```bash
# Monitor connection rate in real-time
ss -s | grep -E "TCP:|synrecv"

# Check SYN_RECV backlog
netstat -ant | grep SYN_RECV | wc -l

# Top source IPs by connection count
conntrack -L 2>/dev/null | awk '{print $4}' | sort | uniq -c | sort -rn | head -20

# NetFlow top talkers
nfdump -r /var/cache/nfdump/current -s srcip -n 20 -o extended
```

## Workflow

### Step 1: Baseline Normal Traffic

Establish connection rates, bandwidth, and protocol distribution baselines.

### Step 2: Deploy Kernel Mitigations

Enable SYN cookies, tune TCP stack, and enable reverse path filtering.

### Step 3: Configure Rate Limiting

Deploy nftables rules with appropriate thresholds.

### Step 4: Enable Detection

Load Suricata rules and Zeek scripts for DDoS indicators.

### Step 5: Incident Response

```bash
# During active attack — identify top attackers
cat /var/log/suricata/eve.json | \
  jq 'select(.alert.signature | contains("DDoS")) | .src_ip' | sort | uniq -c | sort -rn

# Emergency blackhole via iptables
iptables -I INPUT -s <attacker_ip> -j DROP
```

## Detection

```yaml
title: Ddos Mitigation Detection
id: 1a6c411e-b9e4-4be9-a751-8b4e9749268c
status: experimental
description: Detects suspicious activity related to implementing ddos mitigation techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1498
  - attack.t1498.001
  - attack.t1499
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Ddos Mitigation Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1498, T1498.001, T1499 |

## Verification

- [ ] SYN cookies enabled and functional under load
- [ ] Rate limiting drops excessive SYN packets
- [ ] Suricata alerts on volumetric attack patterns
- [ ] Amplification attacks (DNS, NTP) detected
- [ ] HTTP flood detection functional
- [ ] Alert-to-mitigation pipeline under 60 seconds

## References

- [Linux Kernel Networking Tuning](https://www.kernel.org/doc/Documentation/networking/)
- [nftables Wiki](https://wiki.nftables.org/)
- MITRE ATT&CK T1498 — Network Denial of Service
- NIST SP 800-61: Computer Security Incident Handling Guide
