DDoS Detection at the Scale of One Hundred Tbps
summary
Canopy implements a distributed DDoS detector that scales past 100 Tbps by combining hash for mice, spray for elephants dynamic load balancing with selective offload to a programmable switch. The switch performs parsing, keyword extraction and assembly compression via recirculation so per-server capacity rises from under 100 Gbps to over 1 Tbps. Production deployment detects a 1.5 Tbps burst within one second while legacy systems drop packets and see only ~80 Gbps, and end-to-end latency is now dominated by server-side analysis.
AI-written summary · about
chapters (11)
- 0:00100 Tbps DDoS detection challenge
- 1:22Thresholds fail in production
- 3:04Production DDoS detection today
- 4:28Balancing elephant and mice flows
- 7:39Canopy system design
- 9:03Offloading to program switches
- 11:14Traffic compression for load
- 13:45Dynamic load balancing results
- 15:29Production insights and trends
- 16:54Latency breakdown and CPU challenges
- 17:57Conclusion
related talks
45mAnatomy of a DDoS
37mAnatomy of a DDoS
52mInvestigating DDOS - Architecture Actors and Attribution
40mThe new reality of DDOS
42mWarding against the Dark Arts: Crafting a Defense Strategy against Botnet DDoS
35mHow We Organize Large-Scale DDoS Exercises in the Netherlands
13mDDoS emotions
05mHow to Analyse a DDoS Quackly