Protecting against DDoS on the 5555-x

Question

Hi,
according our SIEM we were under DDoS.
I set some TCP restriction ( based on the Mitigatind DoS article  http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00809763ea.shtml )
So i set:
set connection conn-max 100
set connection embryonic-conn-max 200
set connection per-client-embryonic-max 10
set connection per-client-max 5
set connection random-sequence-number enable
set connection timeout embryonic 0:0:45
set connection timeout half-closed 0:25:0
set connection timeout tcp 2:0:0
However it was too restricitve and it also block the legal traffic.
How can i properly tune those values ?
What kind of show command should i use to set it properly ?
Our usual throughput is about 200 Mb/s
Thanks

Answer 1

It will depend on your network topology.  
DDoS comes in various size and shapes.  If you have ample IPS/IDS/FW you will be able to stop or mitigate a significant portion of any DDoS directed from the outside.  
The biggest threat to corporate network nowadays is a set of recently discovered DDoS tools that any person, without any knowledge of scripting, can use that can bring any network down in a matter of minutes.  I am talking about the "terrible twins":  Low Orbit(al) Ion Cannon (LOIC) and High Orbit(al) Ion Cannon (HIOC).
Both softwares are freely available over the net and, currently, nothing can truely mitigate HIOC.  There are advisories on stopping LOIC but HIOC is truly the "King Kong" of them all.   One of the temporary way of slowing down (not stopping) an HOIC attack is to cooperate/coordinate with your ISP upstream and ask them to throttle any HTTP/HTTPS traffic down to, for example, 512 kbps connection.  This will alleviate any sustained attack from multiple sources.