Protection against reflection distributed denial of service attacks

An apparatus comprising:

• a network interface, which is arranged to monitor outgoing request packets transmitted by a node in a protected network over a link connecting the protected network to an external network, and to monitor incoming response packets that originate in the external network and are destined for transmission to the node;
• and
• a processor, which is arranged to identify, responsively to monitoring the outgoing request packets and the incoming response packets, one or more of the incoming response packets that were not solicited by any of the outgoing request packets, to determine a characteristic that differentiates between the identified incoming response packets and incoming response packets that were solicited by the outgoing request packets, and to instruct a guard device in the external network to inhibit the transmission over the link of subsequent unsolicited response packets based on the characteristic.

A system comprising:

• a detector device, which is arranged to monitor outgoing request packets transmitted by a node in a protected network over a link connecting the protected network to an external network, to monitor incoming response packets that originate in the external network and are destined for transmission to the node, to identify, responsively to monitoring the outgoing request packets and the incoming response packets, one or more of the incoming response packets that were not solicited by any of the outgoing request packets, to determine a characteristic that differentiates between the identified incoming response packets and incoming response packets that were solicited by the outgoing request packets, and to send an alert comprising the characteristic;
• and
• a guard device, which is located in the external network and is arranged to accept the alert from the detector device, and to inhibit the transmission over the link of subsequent unsolicited response packets based on the characteristic.