Vocus acts on DDoS

Vocus has taken steps to mitigate future distributed denial of service (DDoS) attacks on its network after coming under attack earlier this year.

The ASX-listed IP transit provider said it had bedded down Arbor's Peakflow SP platform in its network architecture in late July after several months of tests.

The company suffered a DDoS attack in May, months after a DDoS attack on one of its customers also caused flow-on effects on the Vocus network.

Vocus chief technical officer McDonald Richards told iTnews the company had Arbor test gear in its racks when it was hit by the May attack "but the statistics [the gear] was collecting weren't helpful for [mitigating] that attack".

"A number of our customers run hosting businesses," Richards said.

"Unfortunately those particular services tend to attract attention and a fair bit of malicious traffic against them."

He said the company had "no pervasive monitoring" system for traffic that might indicate a DDoS attack prior to it buying Arbor's boxes.

Attacks were manually dealt with, from writing scripts to capture a sample of the increased traffic to "looking in detail at what traffic it was, working out if it was malicious" and working out a way to mitigate it so it didn't impact Vocus customers.

The Arbor system would allow monitoring and mitigation of attacks "in seconds rather than minutes," Richards said.

Arbor said its Peakflow SP platform was "the de facto standard for IP flow-based network security, visibility and analysis".