Use Flow Data to Triage DDoS Without Guessing
A defensible workflow for detecting traffic anomalies, identifying blast radius and choosing a safe response.
A defensible workflow for detecting traffic anomalies, identifying blast radius and choosing a safe response.
Flow records answer different questions than counters
An interface graph shows that traffic changed. Flow telemetry helps explain who exchanged it, over which protocol and through which observation point. It is sampled operational evidence, not packet capture, and its limits must remain visible during an incident.
Volume
Bits, packets and flow creation rate compared with a time-aware baseline.
Shape
Source concentration, destination fan-in, port distribution and packet-size pattern.
Scope
Which prefix, subscriber, transit, peering edge or service is affected.
Preserve the observation point
Inbound records at an edge and outbound records after NAT describe different identities. Store exporter, interface, direction, sampling rate and time alongside every record. Without them, a large conversation can be assigned to the wrong customer or multiplied incorrectly.
Detect departures from local behavior
Static thresholds miss attacks against small links and overreact on large ones. Build baselines by interface and time window. Compare bits per second, packets per second, new flows, unique sources and destination concentration. Require more than one signal before escalating.
| Pattern | Possible interpretation | Confirm with |
|---|---|---|
| High pps, small packets | packet-rate exhaustion | interface drops, CPU, destination fan-in |
| Many sources to one target | distributed flood | prefix ownership and upstream view |
| One source, many destinations | scan or compromised host | session/NAT attribution |
| Large outbound amplification | abusable service | source validation and service inventory |
Run a reversible response ladder
- Validate. Exclude maintenance, backup and known traffic shifts.
- Identify impact. Resolve target, owner, links and shared customers.
- Constrain locally. Rate-limit or filter narrowly when capacity permits.
- Coordinate upstream. Provide timestamps, prefixes and traffic signature.
- Withdraw safely. Remove mitigation in stages while watching recurrence.
Retain enough evidence to learn
Record detector version, query window, raw aggregates, operator decisions and mitigation changes. Afterward, compare observed traffic with the hypothesis and tune the rule. Store only what policy and law permit, with controlled access and retention.
Research basis: IPFIX/NetFlow information models and routing-security operational practice. Flow data must be interpreted with exporter and sampling context.