[deleted]
Ask HN: How is DDoS protection implemented?
11–20 of 58 posts
Re: Ask HN: How is DDoS protection implemented?
#12I worked on the eBay DDOS prevention system in the early 2000's. My coworkers filed a patent on part of the system.
https://patents.google.com/patent/US7992192
Once the traffic was detected, the signature was sent to a second system that was a series of hardware optimized for layer 7 packet inspection. The devices were updated with signatures of current attacks, and then checked every incoming packet for that signature. Any packet that matched was parsed for where it was coming from, and then the router was updated to drop traffic from that source for a period of time.
As far as I know, today's techniques are fairly similar, along with just having a whole lot of computers that can absorb the traffic.
Re: Ask HN: How is DDoS protection implemented?
#13I was lead developer on Arbor Network's DDoS product in the early 2000s (I left in 2005 to start Matasano Security). My information on this is surely dated, but people seem to still be using the same terminology now as then. You can break down DDoS into roughly three categories: 1. Volumetric (brute force) 2. Application (targeting specific app endpoints) 3. Protocol (exploiting protocol vulnerabilities) DDoS mitigat…
[deleted]
Re: Ask HN: How is DDoS protection implemented?
#14I was lead developer on Arbor Network's DDoS product in the early 2000s (I left in 2005 to start Matasano Security). My information on this is surely dated, but people seem to still be using the same terminology now as then. You can break down DDoS into roughly three categories: 1. Volumetric (brute force) 2. Application (targeting specific app endpoints) 3. Protocol (exploiting protocol vulnerabilities) DDoS mitigat…
It sounds like we were working on the same problem at the same time and came to roughly the same conclusion (see my sibling comment about eBay's DDOS mitigation system). :)
Re: Ask HN: How is DDoS protection implemented?
#15The easy answer: Load balancing Anycast is the most important piece of the puzzle, allowing you to route traffic to a bunch of different locations. Let's say you can handle 10 Gbps at a single location. If the traffic is evenly split between 100 destinations then you can have a single IP that can handle 1 Tbps of traffic. Of course, the setup behind these IPs might vary a lot, and one might even use DNS load balancin…
Load balancing is in place for all but the most trivial sites, though, so what you're really saying is horizontal scaling. Which is fine but expensive compared to pattern based mitigation techniques.
I don't think this is about regular load balancing. DDoS is coming from a large number of infected machines, but they can't control how their traffic is routed. By using anycast you're splitting the machines that are used to attack into small groups that your pattern based mitigation or even your regular reverse proxies can handle.
Re: Ask HN: How is DDoS protection implemented?
#16Earlier quoted context omitted.
Load balancing is in place for all but the most trivial sites, though, so what you're really saying is horizontal scaling. Which is fine but expensive compared to pattern based mitigation techniques.
I don't think this is about regular load balancing. DDoS is coming from a large number of infected machines, but they can't control how their traffic is routed. By using anycast you're splitting the machines that are used to attack into small groups that your pattern based mitigation or even your regular reverse proxies can handle.
CDN networks are well equipped for this because of their large geographical footprint. If they can terminate "bad" requests closer to their origin then they don't add up nearly as badly for the application server.
Re: Ask HN: How is DDoS protection implemented?
#17I use remote black hole routine announcements to the upstream ISPs to filter source or destination addresses from traversing the congested link.
Re: Ask HN: How is DDoS protection implemented?
#18I was lead developer on Arbor Network's DDoS product in the early 2000s (I left in 2005 to start Matasano Security). My information on this is surely dated, but people seem to still be using the same terminology now as then. You can break down DDoS into roughly three categories: 1. Volumetric (brute force) 2. Application (targeting specific app endpoints) 3. Protocol (exploiting protocol vulnerabilities) DDoS mitigat…
>"The scrubbing centers buy or build mitigation boxes that take large volumes of traffic in and then do heuristic checks (liveness of sender, protocol anomalies, special queueing) before passing it to the target. There's some in-line layer 7 filtering happening, and there's continuous source'
Where these heuristics done in hardware then? ASICs FPGAs? Could you elaborate what the "liveness of sender" and "special queueing" heuristics are?
Re: Ask HN: How is DDoS protection implemented?
#19I worked on the eBay DDOS prevention system in the early 2000's. My coworkers filed a patent on part of the system. https://patents.google.com/patent/US7992192 Once the traffic was detected, the signature was sent to a second system that was a series of hardware optimized for layer 7 packet inspection. The devices were updated with signatures of current attacks, and then checked every incoming packet for that signatu…
>"Once the traffic was detected, the signature was sent to a second system that was a series of hardware optimized for layer 7 packet inspection."
Was this custom DPI hardware or something from a vendor?
Re: Ask HN: How is DDoS protection implemented?
#20I was lead developer on Arbor Network's DDoS product in the early 2000s (I left in 2005 to start Matasano Security). My information on this is surely dated, but people seem to still be using the same terminology now as then. You can break down DDoS into roughly three categories: 1. Volumetric (brute force) 2. Application (targeting specific app endpoints) 3. Protocol (exploiting protocol vulnerabilities) DDoS mitigat…
What happens when it doesn't work? For instance why does something like Mirai happen? The first D is too D?