Extensive software development experience in the TCP/IP protocol suite, Firewall and Security, on Unix/embedded

platforms.

Skills Summary: TCP/IP protocol suite, Firewall/NAT, DOS/DDOS protection, DPDK packet processing framework, TCP/IP

Security, C, C++, Linux, VxWorks, pSOS.

Last Project

Psychz Firewall (Winlintech Solutions) : The Client was facing regular TCP/UDP DDOS attacks on servers

and was looking for a custom-made high(line) rate Firewall. Based on the field requirements, Psychz Firewall

developed on Linux utilizing the DPDK packet processing framework. Packets are received/transmitted directly in

userspace Firewall, bypassing the Linux kernel, through the DPDK poll mode network driver. Successfully

developed and deployed protections for various TCP/UDP DDOS flood attacks while maintaining minimal

processing overhead.

• DDOS mitigation implemented at two levels: Rule/ACL level matching general TCP/IP header fields,

hashlimit buckets level which groups hosts on a hashlimit ACL by hash of one or more fields:

source-IP/mask, destination-IP/mask, source port and destination port. Packets matching a hashlimit ACL

are further classified into a hashlimit bucket and ACL actions like ratelimiting are applied at the bucket

level.

•  TCP state table implementation providing implicit ACK flood mitigation. Only SYNs pass a TCP keepstate

ACL, first SYN adds state to the TCP table and subsequent connection traffic passes through the TCP state

table.

• TCP SYN flood detection by monitoring SYN rate at ACL or hashlimit bucket level. Mitigation is based on

the syncache mechanism. If SYN flood attack is detected, the first SYN is always dropped but recorded in

the syncache hash table. Only subsequent exact SYN results in TCP state entry creation allowing the

connection to pass through.

• UDP flood attacks detection by monitoring new flows rate and/or byte rate on a UDP ACL or hashlimit

bucket. Mitigation provided through ratelimiting or blocking new and recent flows during attacks.

• DNS amplification attack mitigation : Firewall can monitor UDP DNS response traffic to protected

network or host. If DNS response is greater than 512 bytes, it is truncated to 512 or less at a record

boundary and the truncate flag is set in the DNS header. If this is q genuine response to a request from a

protected host then it will make the same query using TCP, otherwise packet is discarded.

• Whitelisting IPs : UDP Rule can be added which allows only whitelisted IPs. IPs can be whitelisted

manually or automatically. Automatic whitelist entry is added on a successful TCP connection from the

source through a keepstate TCP ACL with whitelist flag. The whitelist flag can also be specified for any

ACL which results in only manually whitelisted IPs getting processed by the ACL.

• Rule based filtering and pattern based filtering