{"id":240,"date":"2026-05-15T17:57:32","date_gmt":"2026-05-15T20:57:32","guid":{"rendered":"https:\/\/flowspec.net.br\/blog\/?p=240"},"modified":"2026-05-29T21:45:03","modified_gmt":"2026-05-30T00:45:03","slug":"mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos","status":"publish","type":"post","link":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/","title":{"rendered":"Mitigando DDoS volum\u00e9trico no vetor DNS com Wanguard Anti DDOS"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">Por que seu tr\u00e2nsito IP precisa oferecer <strong>Flowspec<\/strong> \u2014 e o que fazer quando ele oferece<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Abrint 2026<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Arquitetura em duas camadas (ACL\/MQC local + <strong>BGP Flowspec<\/strong> est\u00e1tico no upstream) Validado em Huawei NetEngine 8000 F1A \u00b7 VRP V800R023<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Quem sou eu<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Raphael Rodrigues<br>CTO na Flowspec Solutions<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>23 anos em opera\u00e7\u00e3o de<\/li>\n\n\n\n<li>redes para ISP<\/li>\n\n\n\n<li>Foco em arquitetura de<br>borda, BGP e mitiga\u00e7\u00e3o<br>DDoS<\/li>\n\n\n\n<li>Pai, marido, Nerd,<br>apaixonado por suf, jiu-jitsu<br>e tudo que envolve o mundo<br>digital.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Contato<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>LinkedIn: linkedin.com\/in\/raphaelisp<\/li>\n\n\n\n<li>E-mail: raphael@flowspec.net.br<\/li>\n\n\n\n<li>QR Code no slide final para baixar o artigo t\u00e9cnico completo<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">O que voc\u00ea vai levar daqui<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ao final desta palestra, voc\u00ea vai saber:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Por que<\/strong> nenhuma defesa local do seu ISP, por mais sofisticada, mitiga volumetria<\/li>\n\n\n\n<li><strong>Como<\/strong> <strong>BGP Flowspec<\/strong> usa a rede do seu upstream pra proteger seu uplink<\/li>\n\n\n\n<li><strong>Quais<\/strong> s\u00e3o as 6 assinaturas de ataque <strong>DNS<\/strong> que voc\u00ea deve bloquear hoje<\/li>\n\n\n\n<li><strong>Como<\/strong> implementar a solu\u00e7\u00e3o completa em Huawei NE8000<\/li>\n\n\n\n<li><strong>O que exigir<\/strong> do seu tr\u00e2nsito IP na pr\u00f3xima renova\u00e7\u00e3o contratual<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Material t\u00e9cnico completo distribu\u00eddo por QR code ao final.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">A hist\u00f3ria: novembro de 2025, o maior <strong>DDoS<\/strong> j\u00e1 registrado<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>31,4 Tbps.<\/strong> Trinta e um terabits por segundo.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Isso \u00e9 o pico do maior ataque <strong>DDoS<\/strong> volum\u00e9trico j\u00e1 registrado na hist\u00f3ria da Internet. Mitigado pela Cloudflare em novembro de 2025.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Para contextualizar o tamanho<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cerca de <strong>tr\u00eas mil vezes<\/strong> a banda de um ISP regional brasileiro m\u00e9dio<\/li>\n\n\n\n<li>Suficiente para saturar o link de <strong>qualquer<\/strong> provedor brasileiro simultaneamente<\/li>\n\n\n\n<li>Originado da botnet <strong>Aisuru<\/strong>, estimada em <strong>1 a 4 milh\u00f5es de dispositivos<\/strong> infectados (IoT, NVRs, Android TVs, roteadores SOHO)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dura\u00e7\u00e3o do ataque<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>35 segundos.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tempo curto demais para qualquer mitiga\u00e7\u00e3o manual. E isso \u00e9 o padr\u00e3o em 2025.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">O <strong>DDoS<\/strong> cresceu absurdamente nos \u00faltimos 24 meses<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Dados da Cloudflare para 2025:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>M\u00e9trica<\/th><th>2024<\/th><th>2025<\/th><th>Crescimento<\/th><\/tr><\/thead><tbody><tr><td>Total de ataques mitigados<\/td><td>21,3 milh\u00f5es<\/td><td>~46 milh\u00f5es<\/td><td><strong>+116%<\/strong><\/td><\/tr><tr><td>Ataques hiper-volum\u00e9tricos (&gt;1 Tbps)<\/td><td>~50\/trimestre<\/td><td>6.500+ s\u00f3 no Q2<\/td><td><strong>+13.000%<\/strong><\/td><\/tr><tr><td>Ataques <strong>DDoS<\/strong> por hora (m\u00e9dia)<\/td><td>2.400<\/td><td><strong>5.376<\/strong><\/td><td>+124%<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">E o mais importante pra n\u00f3s<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">O <strong>Brasil \u00e9 o 2\u00ba pa\u00eds mais atacado do mundo<\/strong> em 2025, atr\u00e1s s\u00f3 da China.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Telecoms e ISPs s\u00e3o a <strong>ind\u00fastria mais atacada<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Se voc\u00ea opera ISP no Brasil, voc\u00ea vai sofrer DDoS. N\u00e3o \u00e9 quest\u00e3o de &#8220;se&#8221;, \u00e9 quest\u00e3o de &#8220;quando&#8221;.<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Agora a sua realidade<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Voc\u00ea \u00e9 provedor regional brasileiro. Seu tr\u00e2nsito IP \u00e9 de <strong>1 a 10 Gbps<\/strong> por upstream.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Um ataque <strong>DDoS<\/strong> moderno, mesmo pequeno para os padr\u00f5es de 2025, facilmente atinge <strong>30 a 100 Gbps<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">O que acontece quando 30 Gbps chegam no seu link de 1 Gbps?<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>O buffer do upstream enche e come\u00e7a a <strong>descartar pacotes aleatoriamente<\/strong><\/li>\n\n\n\n<li>Tr\u00e1fego leg\u00edtimo dos seus clientes \u00e9 descartado junto com o ataque<\/li>\n\n\n\n<li>Seu NOC v\u00ea lat\u00eancia subindo, perda de pacotes em tudo<\/li>\n\n\n\n<li>Clientes residenciais ligam reclamando &#8220;a internet caiu&#8221;<\/li>\n\n\n\n<li>Clientes corporativos com SLA come\u00e7am a exigir cr\u00e9dito na fatura<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>N\u00e3o importa o firewall, ACL ou engine que voc\u00ea tem dentro da sua rede.<\/strong> <strong>O jogo j\u00e1 acabou no uplink.<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">A assimetria estrutural<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th><\/th><th>Voc\u00ea (ISP regional)<\/th><th>O atacante<\/th><\/tr><\/thead><tbody><tr><td>Banda contratada<\/td><td>1 a 10 Gbps<\/td><td>Zero \u2014 usa recursos de terceiros<\/td><\/tr><tr><td>Custo por Gbps<\/td><td>R$ caro, recorrente<\/td><td>Praticamente zero<\/td><\/tr><tr><td>Escalabilidade<\/td><td>Limitada pelo contrato<\/td><td>Limitada s\u00f3 pela botnet<\/td><\/tr><tr><td>Tempo pra escalar<\/td><td>Meses (aumentar tr\u00e2nsito)<\/td><td>Minutos (adicionar bots)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Esta assimetria \u00e9 permanente.<\/strong> Voc\u00ea nunca vai contratar tr\u00e2nsito suficiente para &#8220;absorver&#8221; um ataque <strong>DDoS<\/strong> moderno. Ningu\u00e9m vai.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A \u00fanica sa\u00edda \u00e9 usar uma rede maior do que a sua.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">E a \u00fanica rede maior do que a sua, \u00e0 qual voc\u00ea tem acesso contratual, \u00e9 a <strong>rede do seu upstream<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Por que defesa local n\u00e3o resolve volumetria<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Defesa<\/th><th>Onde atua<\/th><th>Mitiga volumetria?<\/th><\/tr><\/thead><tbody><tr><td>Firewall L4<\/td><td>Host<\/td><td>\u274c<\/td><\/tr><tr><td>ACL\/MQC no roteador de borda<\/td><td>Borda do ISP<\/td><td>\u274c<\/td><\/tr><tr><td>Engine <strong>DDoS<\/strong> local (Wanguard, FastNetMon)<\/td><td>Dentro do ISP<\/td><td>\u274c (detecta, mas n\u00e3o para sozinho)<\/td><\/tr><tr><td>RTBH<\/td><td>Upstream<\/td><td>\u26a0\ufe0f Sim, mas derruba o alvo junto<\/td><\/tr><tr><td>Scrubbing center<\/td><td>Externo (desvio BGP)<\/td><td>\u2705 Caro, lat\u00eancia adicional<\/td><\/tr><tr><td><strong>BGP Flowspec<\/strong><\/td><td><strong>Upstream<\/strong><\/td><td>\u2705 <strong>Granular, r\u00e1pido, barato<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Defesa local protege recursos internos<\/strong> (CPU, sess\u00f5es, buffers). <strong>Defesa no upstream protege o uplink.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Voc\u00ea precisa das duas. Mas sem a defesa no upstream, volumetria te derruba sempre.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>BGP Flowspec<\/strong> \u2014 a ideia central<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Use a rede da sua operadora pra impedir que a volumetria chegue at\u00e9 voc\u00ea.<\/strong><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">O seu upstream tem:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>PE routers de <strong>100, 400, 1000 Gbps<\/strong> por placa<\/li>\n\n\n\n<li>Capacidade agregada de <strong>centenas de Tbps<\/strong> na rede deles<\/li>\n\n\n\n<li>Filtros ASIC que operam em velocidade de linha, custo zero de CPU<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Voc\u00ea tem:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Uma sess\u00e3o BGP com eles, que j\u00e1 existe<\/li>\n\n\n\n<li>Os prefixos da sua rede (que voc\u00ea anuncia por ela)<\/li>\n\n\n\n<li>Controle sobre o que acontece dentro da sua rede \u2014 mas n\u00e3o fora<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>BGP Flowspec<\/strong> te d\u00e1 um jeito padronizado de <strong>estender esse controle para dentro da rede do upstream<\/strong>, sem precisar de acesso administrativo nenhum. Voc\u00ea anuncia uma regra via BGP, ele instala em hardware. Em segundos.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A volumetria nunca chega no seu link. Morre no PE do upstream.<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>BGP Flowspec<\/strong> \u2014 como funciona tecnicamente<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>RFC 5575<\/strong> (2009) e <strong>RFC 8955<\/strong> (2020)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Funciona assim:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Voc\u00ea cria a regra<\/strong> no seu roteador: &#8220;descarte UDP com porta origem 53 indo pro meu \/24&#8221;<\/li>\n\n\n\n<li><strong>Ela vira uma rota BGP especial<\/strong> \u2014 n\u00e3o \u00e9 rota de prefixo, \u00e9 rota de &#8220;filtro&#8221;<\/li>\n\n\n\n<li><strong>Sua sess\u00e3o BGP anuncia essa rota<\/strong> ao upstream (NLRI <code>ipv4-flow<\/code>)<\/li>\n\n\n\n<li><strong>O upstream instala a regra em hardware<\/strong> nos PE routers dele<\/li>\n\n\n\n<li><strong>O ataque morre no upstream<\/strong>, nunca chega no seu link<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Mesma sess\u00e3o TCP do BGP que voc\u00ea j\u00e1 usa. Mesma capability negociada no OPEN. Filtro instalado em ASIC, na velocidade do link do upstream.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Instala\u00e7\u00e3o em segundos. Remo\u00e7\u00e3o em segundos. Granularidade cir\u00fargica.<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Flowspec<\/strong> vs RTBH: a diferen\u00e7a que muda tudo<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>RTBH<\/strong> (Remote Triggered Black Hole) \u2014 ferramenta antiga, granularidade grossa:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>IP alvo em ataque?  \u2192  Descartar TODO tr\u00e1fego pra esse IP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Resultado: ataque parou. Servi\u00e7o do cliente tamb\u00e9m parou. <strong>Para o atacante, isso \u00e9 vit\u00f3ria.<\/strong> Ele derrubou o servi\u00e7o sem precisar saturar seu link.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>BGP Flowspec<\/strong> \u2014 granularidade cir\u00fargica:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>IP alvo em ataque por DNS amp?  \u2192  Descartar s\u00f3 UDP src:53 + dst &lt;1024 pra esse IP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Resultado: ataque parou. Servi\u00e7o do cliente (webserver na 443, SSH na 22, qualquer outra coisa) <strong>continua funcionando normalmente<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>BGP Flowspec \u00e9 &#8220;RTBH cir\u00fargico&#8221;.<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Flowspec<\/strong> est\u00e1tico vs din\u00e2mico<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Duas abordagens complementares \u2014 as duas convivem bem no mesmo ambiente:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Est\u00e1tico (foco desta palestra)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Regras criadas manualmente pelo administrador<\/li>\n\n\n\n<li>Sempre ativas, 24\/7<\/li>\n\n\n\n<li>Apropriado para <strong>padr\u00f5es que s\u00e3o sempre inv\u00e1lidos<\/strong> (ex: UDP src:53 + dst:53)<\/li>\n\n\n\n<li>Zero overhead operacional depois de configurado<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Din\u00e2mico<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Regras geradas automaticamente por traffic analyzer (Wanguard, FastNetMon)<\/li>\n\n\n\n<li>Analisa sFlow\/NetFlow\/IPFIX em tempo real<\/li>\n\n\n\n<li>Gera regras quando detecta padr\u00e3o de ataque<\/li>\n\n\n\n<li>Remove quando ataque cessa<\/li>\n\n\n\n<li>Apropriado para <strong>padr\u00f5es vari\u00e1veis<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Est\u00e1tico<\/strong> cobre o \u00f3bvio e permanente. <strong>Din\u00e2mico<\/strong> cobre o resto.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Topologia do cen\u00e1rio<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"704\" src=\"https:\/\/flowspec.net.br\/blog\/wp-content\/uploads\/2026\/05\/topologia-linkedin-sanitizada-4-1024x704.png\" alt=\"\" class=\"wp-image-242\" srcset=\"https:\/\/flowspec.net.br\/blog\/wp-content\/uploads\/2026\/05\/topologia-linkedin-sanitizada-4-1024x704.png 1024w, https:\/\/flowspec.net.br\/blog\/wp-content\/uploads\/2026\/05\/topologia-linkedin-sanitizada-4-300x206.png 300w, https:\/\/flowspec.net.br\/blog\/wp-content\/uploads\/2026\/05\/topologia-linkedin-sanitizada-4-768x528.png 768w, https:\/\/flowspec.net.br\/blog\/wp-content\/uploads\/2026\/05\/topologia-linkedin-sanitizada-4-1536x1056.png 1536w, https:\/\/flowspec.net.br\/blog\/wp-content\/uploads\/2026\/05\/topologia-linkedin-sanitizada-4.png 1920w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Tr\u00eas zonas:<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Internet<\/strong> (esquerda): botnet + refletores <strong>DNS<\/strong> geram o ataque<\/li>\n\n\n\n<li><strong>Upstream<\/strong> (centro): AS64501 \u2014 zona de mitiga\u00e7\u00e3o onde o <strong>Flowspec<\/strong> atua<\/li>\n\n\n\n<li><strong>ISP<\/strong> (direita): AS64500 \u2014 NE8000 recebe s\u00f3 tr\u00e1fego limpo<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Dados sanitizados: ASNs e prefixos substitu\u00eddos por blocos reservados nas RFCs 5398 e 5737 para proteger a confidencialidade do ambiente real.<\/em><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Sem <strong>Flowspec<\/strong> vs com <strong>Flowspec<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Sem <strong>Flowspec<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>30 Gbps de ataque\n      \u2193\nPE do upstream encaminha tudo\n      \u2193\nLink contratado (1 Gbps) satura\n      \u2193\nNE8000 recebe link 100% lixo\n      \u2193\nTodos os clientes prejudicados\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Com <strong>BGP Flowspec<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>30 Gbps de ataque\n      \u2193\nPE do upstream aplica filtro (ASIC, custo zero)\n      \u2193\nS\u00f3 ~50 Mbps de DNS leg\u00edtimo passam\n      \u2193\nLink contratado calmo\n      \u2193\nNE8000 opera normalmente\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A volumetria morre na borda do upstream.<\/strong> Voc\u00ea nem percebe o ataque.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Por que <strong>DNS<\/strong> \u00e9 o vetor preferido dos atacantes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Tr\u00eas caracter\u00edsticas do <strong>DNS<\/strong> sobre UDP\/53:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Resposta maior que pergunta<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Query &#8220;ANY&#8221; de 60 bytes \u2192 resposta de at\u00e9 4.000 bytes (EDNS0 + DNSSEC) <strong>Amplifica\u00e7\u00e3o de 28\u00d7 a 54\u00d7<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. UDP sem handshake<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Servidor responde sem validar origem. <strong>Spoofing de IP \u00e9 trivial.<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Abund\u00e2ncia de refletores<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Mais de <strong>1,5 milh\u00e3o<\/strong> de resolvedores abertos (ShadowServer)<\/li>\n\n\n\n<li><strong>Todos<\/strong> os servidores autoritativos do mundo<\/li>\n\n\n\n<li>Qualquer um responde pra qualquer IP<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Matem\u00e1tica do atacante<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">10.000 queries\/s \u00d7 3.000 B por resposta = <strong>240 Mbps por refletor<\/strong> 200 refletores \u2192 <strong>48 Gbps<\/strong> chegando na v\u00edtima Tudo isso com uma botnet modesta.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">As 6 assinaturas de ataque <strong>DNS<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Todo pacote de ataque <strong>DNS<\/strong> tem marca. Estas s\u00e3o as 6 que voc\u00ea precisa bloquear:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>#<\/th><th>Assinatura<\/th><th>A\u00e7\u00e3o<\/th><th>Por qu\u00ea<\/th><\/tr><\/thead><tbody><tr><td>1<\/td><td>UDP src:53 + dst&lt;1024<\/td><td><strong>Drop<\/strong><\/td><td>Resposta pra porta privilegiada \u2014 sem uso leg\u00edtimo<\/td><\/tr><tr><td>2<\/td><td>TCP src:53 + dst&lt;1024<\/td><td><strong>Drop<\/strong><\/td><td>Idem em TCP<\/td><\/tr><tr><td>3<\/td><td>UDP src:53 + len&lt;45B<\/td><td><strong>Drop<\/strong><\/td><td>Menor que pacote <strong>DNS<\/strong> m\u00ednimo poss\u00edvel<\/td><\/tr><tr><td>4<\/td><td>UDP src:53 + len&gt;512B<\/td><td><strong>Rate-limit<\/strong><\/td><td>Respostas amplificadas (preserva EDNS0 leg\u00edtimo)<\/td><\/tr><tr><td>5<\/td><td>UDP src:53 + dst:53<\/td><td><strong>Drop<\/strong><\/td><td>Reflex\u00e3o cl\u00e1ssica \u2014 nunca \u00e9 leg\u00edtimo<\/td><\/tr><tr><td>6<\/td><td>UDP src:53 + fragmentado<\/td><td><strong>Rate-limit<\/strong><\/td><td>Vetor comum de amp e evas\u00e3o<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Drop<\/strong> = comportamento que <strong>nunca<\/strong> \u00e9 leg\u00edtimo <strong>Rate-limit<\/strong> = comportamento que pode ser leg\u00edtimo <strong>mas \u00e9 abusado<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Por que n\u00e3o bloquear tudo com src:53?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A tenta\u00e7\u00e3o \u00e9 simples: &#8220;vou dropar todo tr\u00e1fego UDP porta origem 53 exceto da minha whitelist de <strong>DNS<\/strong> p\u00fablico&#8221;.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Voc\u00ea quebra metade dos seus clientes.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Muitos clientes rodam resolvedores recursivos pr\u00f3prios. Esses resolvedores consultam <strong>servidores autoritativos do mundo inteiro<\/strong> \u2014 todos respondendo com src-port 53 leg\u00edtimo.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Voc\u00ea n\u00e3o tem como listar todos os autoritativos do mundo.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">A abordagem correta<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Whitelist de DNS p\u00fablicos conhecidos \u2192 rate-limit 10 Mbps por IP\nQualquer outro src:53 \u2192 drop\nResto do tr\u00e1fego \u2192 passa intocado\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Whitelist granular + drop agressivo no que sobra = voc\u00ea pega o ataque sem quebrar o cliente.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Arquitetura em duas camadas<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Camada 1: Local (NE8000)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Onde:<\/strong> dentro do seu roteador de borda <strong>Como:<\/strong> ACL avan\u00e7ada + MQC (traffic-policy) <strong>Protege:<\/strong> exaust\u00e3o de recursos internos (CPU, sess\u00f5es, buffers) <strong>Vantagem:<\/strong> resposta imediata, controle total, sem depender de terceiros<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Camada 2: Upstream (<strong>BGP Flowspec<\/strong>)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Onde:<\/strong> nos PE routers do seu tr\u00e2nsito <strong>Como:<\/strong> flow-routes est\u00e1ticas anunciadas via BGP <strong>Protege:<\/strong> satura\u00e7\u00e3o do uplink contratado (volumetria) <strong>Vantagem:<\/strong> mata o tr\u00e1fego antes de tocar seu link<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Voc\u00ea precisa das duas.<\/strong> Cada uma resolve um problema que a outra n\u00e3o resolve.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Camada local no NE8000 \u2014 estrutura MQC<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Modular QoS CLI \u2014 tr\u00eas objetos encadeados:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Classifier (identifica)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>traffic classifier C-DNS-WHITELIST operator or\n if-match acl 3100\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Behavior (age)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>traffic behavior B-DNS-CAR\n car cir 10000 pir 10000 red discard    # 10 Mbps\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Policy (amarra e aplica)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>traffic policy TP-DNS-MITIGATION\n classifier C-DNS-WHITELIST behavior B-DNS-CAR\n classifier C-DNS-ANY        behavior B-DNS-DROP\n\ninterface GigabitEthernet0\/1\/2\n traffic-policy TP-DNS-MITIGATION inbound\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>L\u00f3gica:<\/strong> first-match-wins. Whitelist casa primeiro, pega CAR. Resto cai no drop. Tr\u00e1fego n\u00e3o-<strong>DNS<\/strong> passa intocado.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Camada upstream \u2014 habilitar <strong>Flowspec<\/strong> no BGP<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A family <code>ipv4-flow<\/code> roda na <strong>mesma sess\u00e3o TCP<\/strong> do BGP unicast que voc\u00ea j\u00e1 tem. N\u00e3o \u00e9 uma nova sess\u00e3o BGP. \u00c9 uma nova NLRI na sess\u00e3o existente.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>bgp 64500\n ipv4-family flow\n  peer 192.0.2.10 enable\n  peer 192.0.2.10 advertise-community\n  peer 192.0.2.10 route-limit 200\n  commit\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Pr\u00e9-requisitos contratuais com o upstream<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sess\u00e3o eBGP com family <code>ipv4-flow<\/code> habilitada do lado deles<\/li>\n\n\n\n<li><code>route-limit<\/code> de pelo menos 200 rotas<\/li>\n\n\n\n<li>Pol\u00edtica clara sobre valida\u00e7\u00e3o de destination-prefix<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Sem isso do lado do upstream, os comandos acima n\u00e3o fazem nada.<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Flow-routes de assinaturas \u2014 exemplo<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Cada flow-route \u00e9 uma regra com matching (<code>if-match<\/code>) e a\u00e7\u00e3o (<code>apply<\/code>). M\u00faltiplos <code>if-match<\/code> na mesma rota = l\u00f3gica <strong>AND<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Exemplo: assinatura 4 (respostas amplificadas)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>flow-route FS-DNS-AMP-HOMOLOG\n if-match destination 192.0.2.0 24\n if-match protocol udp\n if-match source-port equal 53\n if-match packet-length greater-than 512\n apply traffic-rate 2500        # 20 Mbps\n commit\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6 flow-routes \u00d7 3 prefixos do ISP = 18 rotas<\/strong> para cobrir todas as assinaturas em toda a rede.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Flow-routes de whitelist \u2014 o problema da granularidade<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Diferente do MQC local, <strong>Flowspec<\/strong> <strong>n\u00e3o aceita pools de IP<\/strong>. Cada IP da whitelist vira <strong>uma rota separada<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Conta r\u00e1pida<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>13 root servers<\/li>\n\n\n\n<li>8 DNS p\u00fablicos principais (Google \u00d72, Cloudflare \u00d72, Quad9 \u00d72, OpenDNS \u00d72)<\/li>\n\n\n\n<li>= <strong>21 rotas de whitelist por prefixo<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Mais 2 rotas catch-all (UDP + TCP) + 6 de assinaturas = <strong>29 rotas por prefixo<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Para 3 prefixos do ISP = <strong>87 flow-routes no deploy completo<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Por isso o <code>route-limit 200<\/code> no contrato<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Provedores que oferecem <code>route-limit<\/code> baixo (20, 50 rotas) inviabilizam a solu\u00e7\u00e3o completa. Negocie antes de fechar.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Whitelist \u2014 exemplo de flow-route<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>flow-route FS-DNS-WL-GOOGLE-1-HOMOLOG\n if-match destination 192.0.2.0 24\n if-match protocol udp\n if-match source 8.8.8.8 32\n if-match source-port equal 53\n apply traffic-rate 1250        # 10 Mbps\n commit\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Preced\u00eancia autom\u00e1tica (RFC 5575 \u00a75.1)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Flowspec<\/strong> ordena regras por <strong>especificidade do matching<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>source 8.8.8.8\/32 + source-port 53<\/code> <strong>vence<\/strong> <code>source 0.0.0.0\/0 + source-port 53<\/code><\/li>\n\n\n\n<li>Mais campos de match = mais espec\u00edfica = aplicada primeiro<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Voc\u00ea n\u00e3o precisa ordenar manualmente.<\/strong> A whitelist sempre vence o catch-all.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Catch-all \u2014 dropar tudo que sobrou<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Depois das 21 rotas de whitelist em <code>\/32<\/code>, qualquer outro pacote com src:53 cai aqui:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>flow-route FS-DNS-DENY-UDP-HOMOLOG\n if-match destination 192.0.2.0 24\n if-match protocol udp\n if-match source-port equal 53\n apply deny\n commit\n\nflow-route FS-DNS-DENY-TCP-HOMOLOG\n if-match destination 192.0.2.0 24\n if-match protocol tcp\n if-match source-port equal 53\n apply deny\n commit\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Sem pools, \u00e9 uma rota gen\u00e9rica para UDP e outra para TCP. A especificidade garante que a whitelist <code>\/32<\/code> vence antes de chegar aqui.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Matriz de comportamento resultante<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Com as 29 flow-routes ativas no prefixo:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Tipo de pacote<\/th><th>A\u00e7\u00e3o<\/th><\/tr><\/thead><tbody><tr><td>UDP src:53 de IP da whitelist \u2192 sua rede<\/td><td>Rate-limit 10 Mbps<\/td><\/tr><tr><td>UDP src:53 de IP fora da whitelist, tamanho normal<\/td><td><strong>Drop<\/strong><\/td><\/tr><tr><td>UDP src:53, dst&lt;1024<\/td><td><strong>Drop<\/strong> (assinatura 1)<\/td><\/tr><tr><td>UDP src:53, len&gt;512<\/td><td>Rate-limit 20 Mbps (assinatura 4)<\/td><\/tr><tr><td>UDP src:53, len&lt;45<\/td><td><strong>Drop<\/strong> (assinatura 3)<\/td><\/tr><tr><td>UDP src:53, dst:53<\/td><td><strong>Drop<\/strong> (assinatura 5)<\/td><\/tr><tr><td>UDP src:53 fragmentado<\/td><td>Rate-limit 10 Mbps (assinatura 6)<\/td><\/tr><tr><td>TCP src:53 \u2192 sua rede<\/td><td><strong>Drop<\/strong> (catch-all TCP)<\/td><\/tr><tr><td>Qualquer outro tr\u00e1fego<\/td><td><strong>Passa intocado<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Teto total de DNS entrando:<\/strong> 21 IPs \u00d7 10 Mbps = <strong>210 Mbps por prefixo<\/strong> Volumetria acima disso \u00e9 imposs\u00edvel \u2014 o upstream mata.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Homologa\u00e7\u00e3o \u2014 nunca \u00e9 big bang<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Deploy em produ\u00e7\u00e3o <strong>sempre<\/strong> por etapas:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Etapa<\/th><th>A\u00e7\u00e3o<\/th><th>Tempo de observa\u00e7\u00e3o<\/th><\/tr><\/thead><tbody><tr><td>1<\/td><td>Deploy s\u00f3 das 6 assinaturas em <strong>1 prefixo<\/strong><\/td><td>24-72h<\/td><\/tr><tr><td>2<\/td><td>Adicionar whitelist + catch-all no mesmo prefixo<\/td><td>24-72h<\/td><\/tr><tr><td>3<\/td><td>Replicar tudo para o 2\u00ba prefixo<\/td><td>2-6h<\/td><\/tr><tr><td>4<\/td><td>Replicar tudo para o 3\u00ba prefixo<\/td><td>2-6h<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">O que monitorar em cada etapa<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>display bgp flow routing-table peer X advertised-routes<\/code> \u2014 as rotas chegaram no upstream?<\/li>\n\n\n\n<li><code>display flowspec statistics &lt;reindex><\/code> \u2014 est\u00e3o batendo tr\u00e1fego?<\/li>\n\n\n\n<li>Tickets do suporte \u2014 algum cliente reclamando de DNS?<\/li>\n\n\n\n<li>Dashboard de bps\/pps do uplink \u2014 comportamento mudou?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Qualquer sinal estranho \u2192 rollback imediato \u2192 investigar \u2192 repetir.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Comandos de verifica\u00e7\u00e3o essenciais<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Aprenda estes 5 comandos. Resolvem 90% dos problemas:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>display bgp flow peer\n\u2192 Sess\u00e3o Flowspec est\u00e1 Established? Quantas rotas trocadas?\n\ndisplay bgp flow routing-table\n\u2192 Lista todas as rotas conhecidas (suas e recebidas)\n\ndisplay bgp flow routing-table peer &lt;ip&gt; advertised-routes\n\u2192 Suas rotas chegaram no upstream?\n\ndisplay flowspec statistics\n\u2192 Quantos pacotes bateram em cada regra? Passaram ou foram dropados?\n\ndisplay flowspec rule &lt;reindex&gt; slot N\n\u2192 A regra est\u00e1 programada em hardware na placa N?\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Matched sem Passed\/Dropped<\/strong> = rota no RIB mas n\u00e3o em forwarding. Investigar.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Rollback \u2014 tenha o script pronto<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Sempre antes de aplicar qualquer regra, tenha o script de remo\u00e7\u00e3o pronto em outra janela.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Rollback da camada <strong>Flowspec<\/strong><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>system-view\nundo flow-route FS-DNS-LOWPORT-UDP-HOMOLOG\nundo flow-route FS-DNS-LOWPORT-TCP-HOMOLOG\nundo flow-route FS-DNS-TINY-HOMOLOG\nundo flow-route FS-DNS-AMP-HOMOLOG\nundo flow-route FS-DNS-REFLECTION-HOMOLOG\nundo flow-route FS-DNS-FRAG-HOMOLOG\n# ...whitelist e catch-all tamb\u00e9m\ncommit\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Rollback da camada local<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>interface GigabitEthernet0\/1\/2\n undo traffic-policy TP-DNS-MITIGATION inbound\ncommit\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Script pronto = rollback em segundos. Confian\u00e7a pra aplicar.<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>DNS<\/strong> \u00e9 s\u00f3 o come\u00e7o \u2014 outros vetores de amplifica\u00e7\u00e3o<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A mesma arquitetura (flow-routes por <code>source-port<\/code> + a\u00e7\u00e3o) serve para qualquer protocolo amplific\u00e1vel:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Protocolo<\/th><th>Porta<\/th><th>Amp factor<\/th><th>Nota<\/th><\/tr><\/thead><tbody><tr><td>Memcached<\/td><td>UDP\/11211<\/td><td><strong>at\u00e9 51.000\u00d7<\/strong><\/td><td>GitHub 2018, 1,35 Tbps<\/td><\/tr><tr><td>NTP monlist<\/td><td>UDP\/123<\/td><td>at\u00e9 556\u00d7<\/td><td>V\u00e1rios ataques 2013-2014<\/td><\/tr><tr><td>CLDAP<\/td><td>UDP\/389<\/td><td>at\u00e9 70\u00d7<\/td><td>Recorrente em 2020-2025<\/td><\/tr><tr><td>Chargen<\/td><td>UDP\/19<\/td><td>at\u00e9 358\u00d7<\/td><td>Antigo mas ainda usado<\/td><\/tr><tr><td>SSDP<\/td><td>UDP\/1900<\/td><td>at\u00e9 30\u00d7<\/td><td>IoT dom\u00e9stico<\/td><\/tr><tr><td><strong>DNS<\/strong><\/td><td><strong>UDP\/53<\/strong><\/td><td><strong>at\u00e9 54\u00d7<\/strong><\/td><td><strong>Mais comum no dia-a-dia<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Depois do <strong>DNS<\/strong> funcionando, replique a l\u00f3gica para os outros.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Controles complementares obrigat\u00f3rios<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Flowspec<\/strong> resolve tr\u00e1fego de ataque entrando. Voc\u00ea tamb\u00e9m precisa resolver tr\u00e1fego de ataque <strong>saindo<\/strong> da sua rede:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>RRL (Response Rate Limiting)<\/strong> nos seus resolvedores\/autoritativos \u2192 impede sua rede ser usada como amplificador contra terceiros<\/li>\n\n\n\n<li><strong>uRPF strict<\/strong> nas interfaces de clientes \u2192 impede spoofing de origem saindo<\/li>\n\n\n\n<li><strong>BCP38<\/strong> (ingress filtering) em toda a borda \u2192 pol\u00edtica de rede alinhada ao uRPF<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Voc\u00ea n\u00e3o quer que seu ISP apare\u00e7a na lista p\u00fablica de amplificadores abusivos<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Quando isso acontece, outros ISPs come\u00e7am a bloquear sua rede. Sua reputa\u00e7\u00e3o BGP vai pro ch\u00e3o.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Case real: ISP regional brasileiro<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Perfil do ISP<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Provedor regional, alguns milhares de clientes<\/li>\n\n\n\n<li>3 prefixos anunciados<\/li>\n\n\n\n<li>Tr\u00e2nsito IP com ~[X] Gbps contratados por upstream<\/li>\n\n\n\n<li>2 upstreams eBGP + PTT<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Situa\u00e7\u00e3o antes<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ataques <strong>DNS<\/strong> amp semanais, escalando em frequ\u00eancia<\/li>\n\n\n\n<li>Satura\u00e7\u00e3o de uplink por 15 a 40 min durante cada evento<\/li>\n\n\n\n<li>Tickets de clientes residenciais + corporativos acumulando<\/li>\n\n\n\n<li>Escalada para o NOC do upstream cada vez com resposta diferente (\u00e0s vezes RTBH, \u00e0s vezes &#8220;n\u00e3o tem como&#8221;)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Decis\u00e3o t\u00e9cnica<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Migrar para upstream que oferecesse <strong>BGP Flowspec<\/strong> no contrato<\/li>\n\n\n\n<li>Implementar solu\u00e7\u00e3o em duas camadas (MQC + <strong>Flowspec<\/strong> est\u00e1tico)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Resultado ap\u00f3s implementa\u00e7\u00e3o<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">M\u00e9tricas observadas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Zero<\/strong> satura\u00e7\u00f5es de uplink por <strong>DNS<\/strong> amp nos meses seguintes<\/li>\n\n\n\n<li>Volumetria detectada em <code>display flowspec statistics<\/code> sem impacto no uplink<\/li>\n\n\n\n<li>Tempo m\u00e9dio de mitiga\u00e7\u00e3o de novos vetores: minutos, n\u00e3o horas<\/li>\n\n\n\n<li>Tickets de cliente por indisponibilidade ca\u00edram para patamares normais<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Aprendizados operacionais<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Homologa\u00e7\u00e3o foi cr\u00edtica<\/strong> \u2014 peguei dois falsos positivos em assinatura 4 que teriam quebrado clientes<\/li>\n\n\n\n<li><strong>Alinhamento com o NOC do upstream<\/strong> sobre comportamento p\u00f3s-reboot do PE foi fundamental<\/li>\n\n\n\n<li><strong>Ter script de rollback pronto<\/strong> deu confian\u00e7a pra aplicar em produ\u00e7\u00e3o<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Requisitos contratuais \u2014 o que exigir do tr\u00e2nsito IP<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Antes de fechar contrato de tr\u00e2nsito novo, <strong>pergunte ao comercial e pe\u00e7a por escrito<\/strong>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Habilitam <strong>BGP Flowspec<\/strong> (RFC 5575\/8955) na sess\u00e3o eBGP?<\/li>\n\n\n\n<li>Quais matching fields s\u00e3o aceitos? Especialmente <code>packet-length<\/code>, <code>fragment-type<\/code>, <code>tcp-flags<\/code>?<\/li>\n\n\n\n<li>Quais a\u00e7\u00f5es? <code>discard<\/code>, <code>traffic-rate<\/code>, <code>redirect<\/code>, <code>mark DSCP<\/code>?<\/li>\n\n\n\n<li>Qual o <code>route-limit<\/code> no peer?<\/li>\n\n\n\n<li>H\u00e1 valida\u00e7\u00e3o de destination-prefix? Como funciona?<\/li>\n\n\n\n<li>SLA de instala\u00e7\u00e3o em hardware ap\u00f3s an\u00fancio?<\/li>\n\n\n\n<li>As regras se aplicam em todos os PoPs por onde seu tr\u00e1fego pode entrar?<\/li>\n\n\n\n<li>Comportamento p\u00f3s-reboot do PE \u2014 reinstala\u00e7\u00e3o autom\u00e1tica?<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Se o comercial n\u00e3o sabe responder<\/strong>, pe\u00e7a para escalar para engenharia antes de fechar.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Respostas-alerta do upstream<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Frases comuns que devem disparar aten\u00e7\u00e3o:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u274c &#8220;Temos RTBH, cobre a mesma necessidade&#8221;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">N\u00e3o cobre. Granularidade IP inteiro derruba o servi\u00e7o junto com o ataque.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u274c &#8220;Temos Anti-<strong>DDoS<\/strong> gerenciado por R$ X\/m\u00eas&#8221;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Provavelmente scrubbing terceirizado. \u00datil como extra. <strong>N\u00e3o substitui<\/strong> <strong>BGP Flowspec<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u274c &#8220;<strong>Flowspec<\/strong> \u00e9 inseguro, n\u00e3o habilitamos&#8221;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Preocupa\u00e7\u00e3o resolvida pela pr\u00f3pria RFC h\u00e1 15 anos via valida\u00e7\u00e3o de destination-prefix. Provedor que diz isso <strong>n\u00e3o investiu no assunto<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u274c &#8220;Pode habilitar, mas precisa abrir ticket pra cada regra&#8221;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Isso n\u00e3o \u00e9 Flowspec.<\/strong> \u00c9 pol\u00edtica de filtro manual. <strong>BGP Flowspec<\/strong> \u00e9 an\u00fancio via BGP com aplica\u00e7\u00e3o autom\u00e1tica em segundos.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Mensagem final<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>BGP Flowspec<\/strong> deixou de ser <em>nice to have<\/em>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u00c9 <strong>depend\u00eancia estrutural<\/strong> para operar ISP com SLA decente em 2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nenhuma defesa local, por mais sofisticada, substitui bloqueio no upstream para tr\u00e1fego volum\u00e9trico \u2014 isso \u00e9 <strong>restri\u00e7\u00e3o f\u00edsica do caminho dos pacotes<\/strong>, n\u00e3o opini\u00e3o.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">A\u00e7\u00e3o concreta saindo daqui<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Verifique hoje se seus upstreams oferecem <strong>BGP Flowspec<\/strong> real<\/li>\n\n\n\n<li>Se n\u00e3o oferecem, coloque isso como crit\u00e9rio da pr\u00f3xima renova\u00e7\u00e3o<\/li>\n\n\n\n<li>Comece com as 6 assinaturas em 1 prefixo \u2014 ganho imediato, risco baixo<\/li>\n\n\n\n<li>Expanda para whitelist + catch-all quando tiver o <code>route-limit<\/code> contratual certo<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Operadoras s\u00e9rias oferecem. N\u00e3o aceite menos.<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Obrigado<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Raphael Rodrigues<br>CTO na Flowspec Solutions<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Contato<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>LinkedIn: linkedin.com\/in\/raphaelisp<\/li>\n\n\n\n<li>E-mail:<br>raphael@flowspec.net.br<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Dados do ambiente real sanitizados conforme RFCs 5398 e 5737.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Por que seu tr\u00e2nsito IP precisa oferecer Flowspec \u2014 e o que fazer quando ele oferece Abrint 2026 Arquitetura em duas camadas (ACL\/MQC local + BGP Flowspec est\u00e1tico no upstream) Validado em Huawei NetEngine 8000 F1A \u00b7 VRP V800R023 Quem sou eu Raphael RodriguesCTO na Flowspec Solutions Contato O que voc\u00ea vai levar daqui Ao [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":243,"comment_status":"open","ping_status":"open","sticky":true,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[12],"class_list":["post-240","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-protecao-contra-ataques-ddos","tag-banner-principal"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Mitigando DDoS volum\u00e9trico no vetor DNS com Wanguard Anti DDOS - Flowspec Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Mitigando DDoS volum\u00e9trico no vetor DNS com Wanguard Anti DDOS - Flowspec Blog\" \/>\n<meta property=\"og:description\" content=\"Por que seu tr\u00e2nsito IP precisa oferecer Flowspec \u2014 e o que fazer quando ele oferece Abrint 2026 Arquitetura em duas camadas (ACL\/MQC local + BGP Flowspec est\u00e1tico no upstream) Validado em Huawei NetEngine 8000 F1A \u00b7 VRP V800R023 Quem sou eu Raphael RodriguesCTO na Flowspec Solutions Contato O que voc\u00ea vai levar daqui Ao [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/\" \/>\n<meta property=\"og:site_name\" content=\"Flowspec Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-15T20:57:32+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-05-30T00:45:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/flowspec.net.br\/blog\/wp-content\/uploads\/2026\/05\/Raphael-Rodrigues-apresentacao-abrint-2026-flowspec-solutions.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1536\" \/>\n\t<meta property=\"og:image:height\" content=\"864\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"flowspec\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"flowspec\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"16 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/\"},\"author\":{\"name\":\"flowspec\",\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/#\\\/schema\\\/person\\\/5117ef0b5eab88e039773cd18a8f2c15\"},\"headline\":\"Mitigando DDoS volum\u00e9trico no vetor DNS com Wanguard Anti DDOS\",\"datePublished\":\"2026-05-15T20:57:32+00:00\",\"dateModified\":\"2026-05-30T00:45:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/\"},\"wordCount\":2818,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Raphael-Rodrigues-apresentacao-abrint-2026-flowspec-solutions.webp\",\"keywords\":[\"banner principal\"],\"articleSection\":[\"Prote\u00e7\u00e3o contra ataques DDoS\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/\",\"url\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/\",\"name\":\"Mitigando DDoS volum\u00e9trico no vetor DNS com Wanguard Anti DDOS - Flowspec Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Raphael-Rodrigues-apresentacao-abrint-2026-flowspec-solutions.webp\",\"datePublished\":\"2026-05-15T20:57:32+00:00\",\"dateModified\":\"2026-05-30T00:45:03+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/#\\\/schema\\\/person\\\/5117ef0b5eab88e039773cd18a8f2c15\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/#primaryimage\",\"url\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Raphael-Rodrigues-apresentacao-abrint-2026-flowspec-solutions.webp\",\"contentUrl\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/Raphael-Rodrigues-apresentacao-abrint-2026-flowspec-solutions.webp\",\"width\":1536,\"height\":864},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"In\u00edcio\",\"item\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Mitigando DDoS volum\u00e9trico no vetor DNS com Wanguard Anti DDOS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/\",\"name\":\"Flowspec Blog\",\"description\":\"Flowspec Solutions \u00e9 uma empresa de Telecomunica\u00e7\u00f5es focada em mitiga\u00e7\u00e3o de ataques DDoS\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/#\\\/schema\\\/person\\\/5117ef0b5eab88e039773cd18a8f2c15\",\"name\":\"flowspec\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c3a082caca1a9a15a83dbfe4975070ea89416d363c4dab9664a8eb940f5c53a7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c3a082caca1a9a15a83dbfe4975070ea89416d363c4dab9664a8eb940f5c53a7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c3a082caca1a9a15a83dbfe4975070ea89416d363c4dab9664a8eb940f5c53a7?s=96&d=mm&r=g\",\"caption\":\"flowspec\"},\"sameAs\":[\"https:\\\/\\\/flowspec.net.br\\\/blog\"],\"url\":\"https:\\\/\\\/flowspec.net.br\\\/blog\\\/author\\\/flowspec\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Mitigando DDoS volum\u00e9trico no vetor DNS com Wanguard Anti DDOS - Flowspec Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/","og_locale":"pt_BR","og_type":"article","og_title":"Mitigando DDoS volum\u00e9trico no vetor DNS com Wanguard Anti DDOS - Flowspec Blog","og_description":"Por que seu tr\u00e2nsito IP precisa oferecer Flowspec \u2014 e o que fazer quando ele oferece Abrint 2026 Arquitetura em duas camadas (ACL\/MQC local + BGP Flowspec est\u00e1tico no upstream) Validado em Huawei NetEngine 8000 F1A \u00b7 VRP V800R023 Quem sou eu Raphael RodriguesCTO na Flowspec Solutions Contato O que voc\u00ea vai levar daqui Ao [&hellip;]","og_url":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/","og_site_name":"Flowspec Blog","article_published_time":"2026-05-15T20:57:32+00:00","article_modified_time":"2026-05-30T00:45:03+00:00","og_image":[{"width":1536,"height":864,"url":"https:\/\/flowspec.net.br\/blog\/wp-content\/uploads\/2026\/05\/Raphael-Rodrigues-apresentacao-abrint-2026-flowspec-solutions.webp","type":"image\/webp"}],"author":"flowspec","twitter_card":"summary_large_image","twitter_misc":{"Escrito por":"flowspec","Est. tempo de leitura":"16 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/#article","isPartOf":{"@id":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/"},"author":{"name":"flowspec","@id":"https:\/\/flowspec.net.br\/blog\/#\/schema\/person\/5117ef0b5eab88e039773cd18a8f2c15"},"headline":"Mitigando DDoS volum\u00e9trico no vetor DNS com Wanguard Anti DDOS","datePublished":"2026-05-15T20:57:32+00:00","dateModified":"2026-05-30T00:45:03+00:00","mainEntityOfPage":{"@id":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/"},"wordCount":2818,"commentCount":0,"image":{"@id":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/#primaryimage"},"thumbnailUrl":"https:\/\/flowspec.net.br\/blog\/wp-content\/uploads\/2026\/05\/Raphael-Rodrigues-apresentacao-abrint-2026-flowspec-solutions.webp","keywords":["banner principal"],"articleSection":["Prote\u00e7\u00e3o contra ataques DDoS"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/","url":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/","name":"Mitigando DDoS volum\u00e9trico no vetor DNS com Wanguard Anti DDOS - Flowspec Blog","isPartOf":{"@id":"https:\/\/flowspec.net.br\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/#primaryimage"},"image":{"@id":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/#primaryimage"},"thumbnailUrl":"https:\/\/flowspec.net.br\/blog\/wp-content\/uploads\/2026\/05\/Raphael-Rodrigues-apresentacao-abrint-2026-flowspec-solutions.webp","datePublished":"2026-05-15T20:57:32+00:00","dateModified":"2026-05-30T00:45:03+00:00","author":{"@id":"https:\/\/flowspec.net.br\/blog\/#\/schema\/person\/5117ef0b5eab88e039773cd18a8f2c15"},"breadcrumb":{"@id":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/#primaryimage","url":"https:\/\/flowspec.net.br\/blog\/wp-content\/uploads\/2026\/05\/Raphael-Rodrigues-apresentacao-abrint-2026-flowspec-solutions.webp","contentUrl":"https:\/\/flowspec.net.br\/blog\/wp-content\/uploads\/2026\/05\/Raphael-Rodrigues-apresentacao-abrint-2026-flowspec-solutions.webp","width":1536,"height":864},{"@type":"BreadcrumbList","@id":"https:\/\/flowspec.net.br\/blog\/mitigando-ddos-volumetrico-no-vetor-dns-com-wanguard-anti-ddos\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"In\u00edcio","item":"https:\/\/flowspec.net.br\/blog\/"},{"@type":"ListItem","position":2,"name":"Mitigando DDoS volum\u00e9trico no vetor DNS com Wanguard Anti DDOS"}]},{"@type":"WebSite","@id":"https:\/\/flowspec.net.br\/blog\/#website","url":"https:\/\/flowspec.net.br\/blog\/","name":"Flowspec Blog","description":"Flowspec Solutions \u00e9 uma empresa de Telecomunica\u00e7\u00f5es focada em mitiga\u00e7\u00e3o de ataques DDoS","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/flowspec.net.br\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Person","@id":"https:\/\/flowspec.net.br\/blog\/#\/schema\/person\/5117ef0b5eab88e039773cd18a8f2c15","name":"flowspec","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/c3a082caca1a9a15a83dbfe4975070ea89416d363c4dab9664a8eb940f5c53a7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/c3a082caca1a9a15a83dbfe4975070ea89416d363c4dab9664a8eb940f5c53a7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c3a082caca1a9a15a83dbfe4975070ea89416d363c4dab9664a8eb940f5c53a7?s=96&d=mm&r=g","caption":"flowspec"},"sameAs":["https:\/\/flowspec.net.br\/blog"],"url":"https:\/\/flowspec.net.br\/blog\/author\/flowspec\/"}]}},"views":283,"_links":{"self":[{"href":"https:\/\/flowspec.net.br\/blog\/wp-json\/wp\/v2\/posts\/240","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/flowspec.net.br\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/flowspec.net.br\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/flowspec.net.br\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/flowspec.net.br\/blog\/wp-json\/wp\/v2\/comments?post=240"}],"version-history":[{"count":1,"href":"https:\/\/flowspec.net.br\/blog\/wp-json\/wp\/v2\/posts\/240\/revisions"}],"predecessor-version":[{"id":244,"href":"https:\/\/flowspec.net.br\/blog\/wp-json\/wp\/v2\/posts\/240\/revisions\/244"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/flowspec.net.br\/blog\/wp-json\/wp\/v2\/media\/243"}],"wp:attachment":[{"href":"https:\/\/flowspec.net.br\/blog\/wp-json\/wp\/v2\/media?parent=240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/flowspec.net.br\/blog\/wp-json\/wp\/v2\/categories?post=240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/flowspec.net.br\/blog\/wp-json\/wp\/v2\/tags?post=240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}