Mitigation of Large DDoS Attacks on Israeli Telecommunication Provider

Full Story

On November 15, 2024, at 01:00 UTC, alerts were triggered indicating a series of DDoS attacks on the Service Provider’s IP address range. These attacks continued for more than 24 hours, and fininshed only on November 16, 2024, at 23:50 UTC. During this period, 541 attacks were recorded, with flags including PUSH, PSH, FIN, SYN, RST, and ACK.

See below reports and diagrams of DDoS attacks.

FlowSec's ISP DDoS Protection system generated an automatic signature to mitigate the attack, which was then sent to the CSP’s routers to effectively block the incoming malicious traffic.

During the incident, email alerts were sent for each new signature created. Following the resolution of the attacks and the return of traffic to normal levels, the signatures were removed from the CSP’s routers.

Given the high-volume nature of these attacks, it was jointly decided with Service Provider representatives to keep the signature and continue monitoring network traffic through the ISP DDoS Protection system.