Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you handle DDoS attacks?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 114 posts

Re: Ask HN: How do you handle DDoS attacks?

#21

Post by tombrossman »

dineshp2 wrote: post #12
tombrossman wrote: post #9

I use and recommend hosting with OVH if you are worried about DDOS and serving a Western market. No affiliation, just a happy customer. OVH include DDOS protection by default[0] and they have a very robust backbone network[1] in Europe and North America that they own and operate themselves (this is how & why anti-DDOS is standard with them). For quick side-projects I still fire up a DigitalOcean instance or two becau…

Tangential, but how do you find OVH? Their hardware, bandwidth, uptime, customer service? I ask because of the conflicting reviews of OVH that a quick google search reveals.

I'm living next to France and in talking to local geeks the name kept coming up (OVH is a French company). I had been using DigitalOcean but needed more storage space so I tried Kimsufi and SoYouStart which are both OVH-related, and then I started A/B comparing performance of VPSs for OVH and DigitalOcean and saw that the VPSs at OVH were consistently out-performing the same size machines at DigitalOcean. So, I moved everything I plan to keep online for more than a month to OVH. OVH's dashboard for creating and managing machines used to be really horrid but it has improved recently.

I don't know what to make of the bad reviews you found, my personal experience has been great for several years now. Multiple products used, the occasional support ticket with quick response, and decent pricing.

Re: Ask HN: How do you handle DDoS attacks?

#22

Post by northwardstar »

+1 to CloudFlare and Incapsula. Content delivery networks inherently distribute traffic and most have security enhancements specific to Distributed Denial-of-Service mitigation.

DDoS protection providers offer a remote solution to protect any server / network, anywhere: https://sharktech.net/remote-network-ddos-protection.php

Re: Ask HN: How do you handle DDoS attacks?

#23

Post by northwardstar »

+1 to CloudFlare and Incapsula. Content delivery networks inherently distribute traffic and most have security enhancements specific to Distributed Denial-of-Service mitigation.

Most DDoS protection providers offer a remote solution: https://sharktech.net/remote-network-ddos-protection.php

Re: Ask HN: How do you handle DDoS attacks?

#24

Post by dineshp2 »

mirashii wrote: post #15
dineshp2 wrote: post #10

Earlier quoted context omitted.

https://www.cloudflare.com/plans/ Look at the "Advanced security" section. I also used Siege to flood a site behind Cloudflare's free plan and brought it down.

That page argues against your point, even the basic plan does quite a bit to fend of DDOS. In particular, the most common and effective type of DDOS, which is volumetric and based on reflected UDP traffic, is defended against, even on their free tier. Using a tool like Siege to bring a site behind Cloudflare down doesn't mean it's not protected. A layer 7 attack against a site which can't handle incoming HTTP request…

> That page argues against your point, even the basic plan does quite a bit to fend of DDOS. In particular, the most common and effective type of DDOS, which is volumetric and based on reflected UDP traffic, is defended against, even on their free tier.

Maybe I'm missing something here, where does it mention that the free plan protects against UDP floods?

> Using a tool like Siege to bring a site behind Cloudflare down doesn't mean it's not protected. A layer 7 attack against a site which can't handle incoming HTTP requests is still possible.

Flooding a site using Siege from a single IP falls under the layer 7 attack (correct me if I'm wrong), which is protected against in the Business plan.

> Cloudflare, or any other service, can't magically make a site scale.

Where did I mention that I expect Cloudflare to magically scale a site? A POST or GET flood falls under layer 7 protection, which Cloudflare offers in paid plans.

If it was not clear, the point was that layer 7 protection is offered in the paid plans(Business and Enterprise), but not in the free plan.

Re: Ask HN: How do you handle DDoS attacks?

#25

Post by wesleytodd »

My startup's site gets DDOS'd about once a week. We have seen a huge range of attacks from UDP floods, to wordpress pingback attacks, to directed attacks on our services.

We have many layers of protection:

* We run iptables and an api we wrote on our ingest servers. We run failtoban on a separate set of servers. When fail2ban sees something, we have it hit the api and add the iptables rules. This offloads the cpu of failtoban from our ingest servers.

* We block groups of known hosting company IP blocks, like digital ocean and linode. These were common sources of attacks.

* Our services all have rate limits which we throttle based on IP

* We have monitoring and auto-scaling which responds pretty quickly when needed. And has service level granularity.

* Recently moved behind cloudflare because google cloud did not protect us from attacks like the UDP floods which didn't even reach our servers.

EDIT: formatting

Re: Ask HN: How do you handle DDoS attacks?

#26

Post by tombrossman »

Urgo wrote: post #20
tombrossman wrote: post #9

I use and recommend hosting with OVH if you are worried about DDOS and serving a Western market. No affiliation, just a happy customer. OVH include DDOS protection by default[0] and they have a very robust backbone network[1] in Europe and North America that they own and operate themselves (this is how & why anti-DDOS is standard with them). For quick side-projects I still fire up a DigitalOcean instance or two becau…

As a word of caution for OVH their anti-ddos protection can be a little too strict at times. The nature of traffic on our site is such that we often get big spikes of traffic via social media. We were testing out OVH earlier this month to see if offloading part of our site to their servers would work well and they ended up shutting our vps server down for an hour when we got a big spike. After working with their supp…

This contradicts what they claim on their DDOS explanation here: https://www.ovh.co.uk/anti-ddos/mitigation.xml First question to ask them is why was their response different from what practice they advertise? That isn't cool. I would open a new support ticket with them and ask for an explanation since that happened to you recently.

If you need something low-cost and dedicated try their SoYouStart range, which is just their last-generation hardware. Going from a VPS to SYS is a huge performance jump for minimal cost. They have a higher guaranteed minimum bandwidth throughput than the VPSs and may get you better support possibilities. Cost is similar to a mid-size VPS.

Re: Ask HN: How do you handle DDoS attacks?

#28

Post by wesleytodd »

wesleytodd wrote: post #25

My startup's site gets DDOS'd about once a week. We have seen a huge range of attacks from UDP floods, to wordpress pingback attacks, to directed attacks on our services. We have many layers of protection: * We run iptables and an api we wrote on our ingest servers. We run failtoban on a separate set of servers. When fail2ban sees something, we have it hit the api and add the iptables rules. This offloads the cpu of…

One other thing to add:

If they attackers are persistent, there is really no way to guarantee zero down time. THEY WILL FIND A WAY. Just make sure your stake holders know you are doing everything in your power to resolve the issues, and then actually do those things.

An anecdote:

We had been seeing DDOS attacks for a few weeks, so we had most everything locked down and working. But then suddenly one of the most important parts of our site started going down under load. That part is a real time chat system. We looked for which chat room had the load and it was one which did not require a user be registered. We switched the room into registered users only mode and thought we had solved it.

About 5 minutes later the attack came back with all registered users. We were amazed, becuase there is no way the attackers could have registered that many accounts in 5 minutes because of our rate limiting on that. Turns out that they had spend the past week or so registering users in case they needed them :)

Re: Ask HN: How do you handle DDoS attacks?

#29

Post by Urgo »

tombrossman wrote: post #26
Urgo wrote: post #20

Earlier quoted context omitted.

As a word of caution for OVH their anti-ddos protection can be a little too strict at times. The nature of traffic on our site is such that we often get big spikes of traffic via social media. We were testing out OVH earlier this month to see if offloading part of our site to their servers would work well and they ended up shutting our vps server down for an hour when we got a big spike. After working with their supp…

This contradicts what they claim on their DDOS explanation here: https://www.ovh.co.uk/anti-ddos/mitigation.xml First question to ask them is why was their response different from what practice they advertise? That isn't cool. I would open a new support ticket with them and ask for an explanation since that happened to you recently. If you need something low-cost and dedicated try their SoYouStart range, which is jus…

Here is the result of the support ticket I had with them explaining that the traffic was not an attack and is expected to spike from time to time. Edited only to remove their upsell links.

"After looking into the matter, it would seem that our VPS do not have a profile that would accomodate your traffic spikes. However should you switch to a dedicated server, we would be able to apply a a custom profile to your server that we better suit your needs.

Our Kimsufi server are extremely affordable and do not cost much more then what you are presently paying. However they do have limitation, among other things, you cannot order additional IPs on the server. I would advise you to think carefully before purchasing such a server.

Another alternative would be to move to our mid range server, our Soyoustart servers, which offer many of the same benefits as our OVH dedicated servers, however at a very competitive price."

Re: Ask HN: How do you handle DDoS attacks?

#30

Post by roblabla »

dineshp2 wrote: post #12
tombrossman wrote: post #9

I use and recommend hosting with OVH if you are worried about DDOS and serving a Western market. No affiliation, just a happy customer. OVH include DDOS protection by default[0] and they have a very robust backbone network[1] in Europe and North America that they own and operate themselves (this is how & why anti-DDOS is standard with them). For quick side-projects I still fire up a DigitalOcean instance or two becau…

Tangential, but how do you find OVH? Their hardware, bandwidth, uptime, customer service? I ask because of the conflicting reviews of OVH that a quick google search reveals.

I found OVH's offer to be very good on every point, except customer service. I'm mostly using Kimsufi dedicated servers, and let's just say that when shit goes wrong, you're left alone in the dark.

Anecdote: I had my dedicated server suddenly go down because it overheated. Wouldn't come back to life. Two days after submitting a ticket and getting no input, the machine suddenly came back up without any explanation. A day later, I got a mail saying the motherboard was broken and got replaced. Overall it was a very unpleasant experience, but it's to be expected given the low price of Kimsufi.

Post reply on HN