Ask HN: How is DDoS protection implemented?

Post by grepthisab » Mon, May 14, 2018, 1:03 AM UTC

jedberg wrote: post #12

I worked on the eBay DDOS prevention system in the early 2000's. My coworkers filed a patent on part of the system. https://patents.google.com/patent/US7992192 Once the traffic was detected, the signature was sent to a second system that was a series of hardware optimized for layer 7 packet inspection. The devices were updated with signatures of current attacks, and then checked every incoming packet for that signatu…

Post by madsushi » Mon, May 14, 2018, 1:50 AM UTC

bogomipz wrote: post #18

tptacek wrote: post #5

I was lead developer on Arbor Network's DDoS product in the early 2000s (I left in 2005 to start Matasano Security). My information on this is surely dated, but people seem to still be using the same terminology now as then. You can break down DDoS into roughly three categories: 1. Volumetric (brute force) 2. Application (targeting specific app endpoints) 3. Protocol (exploiting protocol vulnerabilities) DDoS mitigat…

>"The scrubbing centers buy or build mitigation boxes that take large volumes of traffic in and then do heuristic checks (liveness of sender, protocol anomalies, special queueing) before passing it to the target. There's some in-line layer 7 filtering happening, and there's continuous source' Where these heuristics done in hardware then? ASICs FPGAs? Could you elaborate what the "liveness of sender" and "special queu…

Post by oneplane » Mon, May 14, 2018, 2:01 AM UTC

amorphid wrote: post #4

One way these companies mitigate DDoS attacks is by being huge. If you have a small house w/ one entrance, there's no great way to manage 1000 people trying to get through the front door. If you have a huge house w/ dozens of entrances, dealing with 1000 people trying to get in the building is much more manageable :) From https://en.wikipedia.org/wiki/DDoS_mitigation : One technique is to pass network traffic address…

Post by tptacek » Mon, May 14, 2018, 2:21 AM UTC

madsushi wrote: post #23

bogomipz wrote: post #18

Earlier quoted context omitted.

>"The scrubbing centers buy or build mitigation boxes that take large volumes of traffic in and then do heuristic checks (liveness of sender, protocol anomalies, special queueing) before passing it to the target. There's some in-line layer 7 filtering happening, and there's continuous source' Where these heuristics done in hardware then? ASICs FPGAs? Could you elaborate what the "liveness of sender" and "special queu…

Yeah, custom hardware (ASIC/FPGA depending). Liveness is trying to detect things like Slowloris [0], with things like timeouts, SYN cookies (which ask the client to do some minor work), etc. [0] - https://en.wikipedia.org/wiki/Slowloris_(computer_security)

Post by Analemma_ » Mon, May 14, 2018, 2:29 AM UTC

yeukhon wrote: post #26

I wonder if anyone has ever tried counter attack. The downside is in turn DoS the origin, which often are victims like infected host in a botnet. Double-edged sword. But it would be very interesting to see how quickly one could defeat the attack. I also wonder why attack often last only a few hours.