How We Organize Large-Scale DDoS Exercises in the Netherlands
summary
A national voluntary coalition of 17 ISPs, banks, exchanges, scrubbing centers and government agencies runs twice‑yearly DDoS drills using a purpose‑built open testbed: a 16,000‑container botnet simulator, command servers on Power9 capable of ~900 Gbit/s per node and a theoretical 2.7 Tbit/s peak, driven by Ansible and Slurm. Exercises use real unused IPv4 subnets to avoid collateral damage, shared packet‑capture fingerprints feed a Concordia clearing house, and an open game‑board dashboard shows red/blue/purple actions in real time; most tests hit high Gbit/s and validate mitigation workflows.
AI-written summary · about
chapters (12)
- 0:00Dutch DDoS exercise coalition
- 1:49Disruptive DDoS attacks rise
- 3:37Coalition structure and goals
- 8:25Exercise working group role
- 11:10Blue, red, purple team dynamics
- 16:09DDoS simulation infrastructure
- 20:11Attack planning and execution
- 24:46Real-time exercise monitoring
- 28:22Purple teaming and validation
- 30:50Customizing test attacks
- 32:39Open source tools
- 33:47Cooperation for internet resilience
