1. 2 of 3 Dyn’s Three-Phased DDoS Mitigation Strategy
INTERNET
PERFORMANCE.
DELIVERED.
SOLUTIONS OVERVIEW
Dyn’s Three-Phased DDoS
Mitigation Strategy
There are distinct benefits to including Dyn as part of your DDoS mitigation strategy. Dyn takes a three-
phased approach to deliver a comprehensive DDoS mitigation strategy that incorporates planning,
mitigation, and a full postmortem.
Planning
Dyn’s routing method and operational architecture are the first line of defense in mitigating DDoS attacks
against our clients. The Anycast network allows multiple, identical, globally deployed DNS servers to
advertise the same IP address. Dyn connects from 18 locations to four Anycast nameservers.
Dyn monitors DDoS hotspots to ensure appropriate coverage for those regions. Dyn’s routing strategy also
tempers the nature of the attack itself. When DDoS activity is discovered, traffic can be shifted to a better
provisioned site.
Dyn’s next layer of defense is reducing the risk to your assets in a multitenant environment. Dyn
employs a nameserver pooling strategy which reduces the number of accounts on each nameserver
announcement.
Mitigation
Before you can mitigate an attack, you need to know when an attack is happening. Dyn provides a fully
staffed global Network Operations Center (NOC), which monitors network activity and automatically
sends notifications when a threat threshold is met. If this occurs, Dyn can trigger automatic packet capture
and alert emails which aid in determining the size and scope of an attack and can yield information
regarding what is actually being attacked. Other alerts include bandwidth and various plugin timeouts,
which again can serve as an early warning for an attack.
We hold transparency as a core pillar of our business philosophy at Dyn. As soon as an attack is determined,
Dyn creates an Incident Report for internal stakeholders, and posts a report on dynstatus.com.
Utilization of tools that display DNS query sources and that can be run from various instances to ascertain
the usage of adjacent DNS servers helps Dyn examine the size and scope of an attack. This strategy can
provide information about what is being queried and how many requests are being made and helps Dyn
determine if the attacks are occurring in or out of protocols like UDP or TCP, versus IP Fragments.
Another method of DNS DDoS mitigation that Dyn employs is developing and deploying firewall rules to
block incoming traffic based on specified criteria such as, source IP, source TTL, and so on.
Upstream from the network, Dyn and its transit providers can perform filtering with both hardware and
software utilities on criteria matching the attack vector to scrub the traffic inbound to our network.
Utilizing these devices enables Dyn to perform deep packet inspection to analyze incoming packets, and
only allow certain requests through to our network. This will usually eliminate the attack threat altogether.

2. dyn.com/contact Regional HQ: London, UK / Sydney, AUS / San Francisco, CAGlobal HQ: Manchester, NH USA3 of 3 @dyn
INTERNET
PERFORMANCE.
DELIVERED.
SOLUTIONS OVERVIEW
The final step of BGP “black-holing” can also be utilized to remove a resource from the network either
from a local attack hotspot, or on a wider range.
Post Mortem
Any time a DNS DDoS mitigation takes place, it is very important that your business continuity and
network incident response plans are employed and held to a detailed retrospective. Attacks will often
help Dyn and your team uncover information like specific protocols and tactics employed by the attackers
and can be added to your team’s playbooks and forensics strategies to forestall the impact of future
attacks.
Dyn creates an Incident Report at the first identification of an attack in order to provide the best post
mortem coverage. Should an incident increase in business impact and visibility, all parties have full insight
into what has happened and what is occurring.
Keeping detailed records is necessary for a successful post mortem; packet captures can engender new
filtering rules, playbooks can be reviewed and altered as needed, and new processes can be put into place
as needed.
Conclusion
Dyn can help you quickly identify and defend against DDoS attacks and provides mitigation and postmortem
strategies to ensure your online infrastructure is under control and available.
About Dyn
Dyn is a cloud-based Internet Performance company. Dyn helps companies monitor, control, and optimize
online infrastructure for an exceptional end-user experience. Through a world-class network and unrivaled,
objective intelligence into Internet conditions, Dyn ensures traffic gets delivered faster, safer, and more
reliably than ever.