Black-hole filtering

Black-hole filtering is a common technique to defend against botnets and, thus, to prevent DoS attacks

• Black holes refer to network nodes wherein incoming traffic is discarded or dropped without informing the source that the data did not reach the intended recipient
• Undesirable traffic can be dropped before it enters a protected network with a technique called remotely triggered black-hole (RTBH) filtering
• As this is a remotely triggered process, this filtering must be performed in conjunction with the ISP
• It uses Border Gateway Protocol (BGP) host routes to route traffic to the victim’s servers to a “null0” next hop.

The sources define Black Hole Filtering as a technique used to defend against Botnets and Denial-of-Service (DoS) attacks.

Here is a detailed breakdown of Black Hole Filtering:

Definition and Mechanism

• Nature of the "Black Hole": A "black hole" refers to a network node where incoming traffic is discarded or dropped. Crucially, the source of the data is not informed that the data failed to reach its intended recipient.
• Filtering Method: Black hole filtering specifically refers to discarding packets at the routing level.
• Purpose: It is a common technique to defend against botnets and prevent DoS attacks.
• Remotely Triggered Black-Hole (RTBH) Filtering: Undesirable traffic can be dropped before it enters a protected network using a technique called remotely triggered black-hole (RTBH) filtering.
  • Since RTBH is a remotely triggered process, this filtering must be performed in conjunction with the Internet Service Provider (ISP).
  • RTBH uses Border Gateway Protocol (BGP) host routes to route traffic destined for the victim's servers to a "nullo" next hop, effectively dropping the traffic.

Context in Botnet Defense

Black Hole Filtering is listed as one of four key techniques to defend against botnets. The other three techniques mentioned are RFC 3704 Filtering, Cisco IPS Source IP Reputation Filtering, and DDoS Prevention Offerings from ISP or DDoS Services.

Related Concepts and Attacks

• Traffic Redirection: The concept of sending traffic to a routing black hole is also mentioned in the context of routing security, where an attacker can send specific routes to "nullo," effectively kicking IP addresses off the network.
• Snort_inline Honeypot: Attackers analyzing the outgoing packets of a snort_inline honeypot (a modified IDS) may interpret the dropping of an outgoing packet as a black hole.
• Layer 2 Tar Pits: A similar concept is seen in Layer 2 Tar Pits, which block network penetration. An attacker can detect the presence of the daemon by looking for responses with the unique MAC address 0:0:f:ff:ff:ff, which acts as a kind of black hole.