Baby DDOS Attacks Triggering AWS Shield Standard Throttling ? Causing ICMP to Fail.

To answer your query regarding what is preventing ICMP during DDOS despite your server being able to handle the traffic . Here are a few possible explanations and suggestions for addressing the issue:

1. Network congestion: DDoS attacks often flood the network with a massive volume of traffic, overwhelming the available bandwidth. Even if your service can handle the traffic at the application layer, network congestion can still impact ICMP functionality. To address this, you can place your EC2 instance behind ELB ( Elastic Load Balancing ), which will provide Shield Standard DDoS resiliency. Additionally, if your application is being hit by DDoS attack, then you need the ELB to be behind a CloudFront Distribution

2. Firewall settings: It's possible that your firewalls are configured to drop or rate-limit ICMP traffic during a DDoS attack. This is often done to conserve network resources and prioritize other types of traffic. Review your firewall and IPS settings to ensure that ICMP traffic is not being blocked or heavily restricted during an attack. Adjustments may be needed to allow ICMP traffic for diagnostic purposes or to ensure proper network functionality.

3. Attack targeting ICMP specifically: Some DDoS attacks may specifically target the ICMP protocol to disrupt network connectivity and monitoring. This type of attack is known as an ICMP flood attack. In such cases, it can be challenging to maintain ICMP functionality even if your service can handle the overall traffic. Consider implementing additional mitigation techniques such as traffic filtering, rate limiting, or using specialized DDoS protection services that can detect and mitigate ICMP flood attacks.

In any case, mitigating the impact on ICMP functionality during a DDoS attack requires a combination of network infrastructure optimization, fine-tuning of security measures, and potentially implementing specialized DDoS protection services.

We don't make layer 3/4 detections unless total traffic towards the target instance threatens to exceed the network capacity of the target instance type, and the mitigation placed is intended to protect other customers on the same hardware from 'noisy neighbor' impact. Do you know what the traffic composition of the attack was? If it contained ICMP then our default Shield Standard mitigations would not necessarily be able to tell 'good' ICMP from malicious ICMP (if the malicious traffic was well-formed).

If you have any level of technical support you can raise a case in the Shield or DDoS queue and ask to know whether or not we made a detection for instance/ip at date/time - we do have that information available, even for Shield Standard customers. If we did make a detection then we would have placed a mitigation which would have dropped some traffic, however if we did not make a detection then we would not have interfered with your traffic.

Note that the gaming sector are some of our biggest users of Shield Advanced. We specialize in protecting multi-player games on large EC2 instances using UDP. We can create custom mitigations that fit your specific use-case. Again, please raise a technical support case to discuss your options.