Securing IXP Fabric#

Alessandro Bulletti, Nokia

• Why: An IXP fabric is a giant shared L2 exchange LAN, and the hardening techniques here — proxy ARP/ND, BUM policing, duplicate MAC-IP detection — transfer to any shared L2 fabric including DC interconnect. The talk also carries current, concrete DDoS threat numbers.
• What: Two parts. First, inherent fabric protection with EVPN Proxy-ARP/ND in three "gated lines of defense": (1) static MAC per customer logical interface + ACL filters blocking unknown multicast/broadcast so only assigned MAC/IPv4/v6 can source traffic into the fabric; (2) ingress policers for BUM and ARP per customer interface, with hardware rate-limiters keeping CPU load controlled; (3) Proxy-ARP/ND with static ARP entries, dynamic proxy ARP with MAC lists, and EVPN MAC-duplication detection — eliminating ARP/ND flooding and enforcing that customers only use assigned addresses. Second, DDoS mitigation at the IXP itself: detection keyed on the peering partner's destination MAC (SPM or IPFIX IE315) on L2 interfaces, with auto-mitigation via IP filters in the fabric rather than rerouting to a scrubbing center. Includes Nokia 2025 threat-intelligence data: attacks over 10/20/40 Tbps recorded within a single month (Sep–Oct 2025); 78% of attacks complete within five minutes (up from 44% in 2024), 37% within two minutes; 52% carpet-bomb multiple hosts; AI-orchestrated vector switching and botnet proxy wars.
• How: EVPN proxy-ARP/ND converts flood-and-learn L2 into controlled control-plane learning, with distributed CPU protection so punted ARP is handled in hardware; references DE-CIX's EVPN peering-LAN work and IX.br's SRv6 fabric as real-world precedents.
• Where applicable: The fabric-hardening mechanics apply to any EVPN fabric (all major vendors implement proxy-ARP/ND variants); the DDoS-as-a-service portion is Nokia Deepfield-specific and partly a pitch. Take the techniques and the threat statistics, treat the product framing accordingly.