Pinpoint Culprits During an Attempted DDoS Attack

Open

Problem:

Conventional tools (that stores a smaller sample of network traffic data) such as NetFlow and traditional network monitoring tools are not able to obtain critical information when a network experiences a surge in bandwidth utility. This company has experienced a significant surge in their network that deprived some of their network devices (e.g. firewalls, routers) from functioning normally.

Solution:

This company was well prepared for this type of situation. By leveraging the full packet versatility of the QP, they were able to deploy network data collectors,9 such as the QP4000 and QP500, so that they can gain 24/7/365 visibility before and after network traffic passes the firewall. The QP’s ”absorbed ” whole packet data. Using collected full packet data they found out that hundreds of unsolicited large file transfers are targeting a public server. The traffic was blocked to stop the DDoS from growing.