Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How is DDoS protection implemented?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 58 posts

Re: Ask HN: How is DDoS protection implemented?

#31

Post by madsushi »

tptacek wrote: post #27
madsushi wrote: post #23

Earlier quoted context omitted.

Yeah, custom hardware (ASIC/FPGA depending). Liveness is trying to detect things like Slowloris [0], with things like timeouts, SYN cookies (which ask the client to do some minor work), etc. [0] - https://en.wikipedia.org/wiki/Slowloris_(computer_security)

It was silicon (or, at least, optimized general compute) in the mid-2000s, but who knows anymore? It could all be user land TCP/IP on Linux today. High speed network processing got weird.

A10 actually lists the number of FPGAs in their mitigation appliances for sizing purposes.

"Select Thunder TPS models have high-performance FPGA-based Flexible Traffic Acceleration (FTA) technology to detect and mitigate up to 60 common attack vectors immediately in hardware — before data CPUs are involved. "

Re: Ask HN: How is DDoS protection implemented?

#32

Post by bogomipz »

tptacek wrote: post #27
madsushi wrote: post #23

Earlier quoted context omitted.

Yeah, custom hardware (ASIC/FPGA depending). Liveness is trying to detect things like Slowloris [0], with things like timeouts, SYN cookies (which ask the client to do some minor work), etc. [0] - https://en.wikipedia.org/wiki/Slowloris_(computer_security)

It was silicon (or, at least, optimized general compute) in the mid-2000s, but who knows anymore? It could all be user land TCP/IP on Linux today. High speed network processing got weird.

>"High speed network processing got weird."

I was curious about this statement. Can you elaborate, weird how?

Re: Ask HN: How is DDoS protection implemented?

#33

Post by ceejayoz »

yeukhon wrote: post #26

I wonder if anyone has ever tried counter attack. The downside is in turn DoS the origin, which often are victims like infected host in a botnet. Double-edged sword. But it would be very interesting to see how quickly one could defeat the attack. I also wonder why attack often last only a few hours.

> I also wonder why attack often last only a few hours.

Using the botnets costs either money (if you're renting one) or opportunity (if you own one and could be renting it out).

Re: Ask HN: How is DDoS protection implemented?

#34

Post by colanderman »

bogomipz wrote: post #32
tptacek wrote: post #27

Earlier quoted context omitted.

It was silicon (or, at least, optimized general compute) in the mid-2000s, but who knows anymore? It could all be user land TCP/IP on Linux today. High speed network processing got weird.

>"High speed network processing got weird." I was curious about this statement. Can you elaborate, weird how?

Not the GP, but I worked in the DDoS space for a spell a few years ago, helping develop the company's 3rd generation product. Their 1st generation was ASIC-based; 2nd generation a manycore CPU (Tilera) running a custom OS mostly written in assembly; 3rd generation used the next generation of that CPU (Tile GX) which provided lots of dedicated highly-parallel network processing hardware (including a programmable coprocessor), some of which was designed following feedback from our CTO.

The Tile GX (including the hardware) was available for general-purpose use from Linux (which we ran), but could also be programmed directly to do lots of packet classification even before the packets got to the CPU and main memory (which we did). The Cavium network processor worked similarly.

Re: Ask HN: How is DDoS protection implemented?

#35

Post by jedberg »

bogomipz wrote: post #19
jedberg wrote: post #12

I worked on the eBay DDOS prevention system in the early 2000's. My coworkers filed a patent on part of the system. https://patents.google.com/patent/US7992192 Once the traffic was detected, the signature was sent to a second system that was a series of hardware optimized for layer 7 packet inspection. The devices were updated with signatures of current attacks, and then checked every incoming packet for that signatu…

>"Once the traffic was detected, the signature was sent to a second system that was a series of hardware optimized for layer 7 packet inspection." Was this custom DPI hardware or something from a vendor?

It was off the shelf hardware but then the software was customized by my coworker. He had to write some C and assembly for it.

Re: Ask HN: How is DDoS protection implemented?

#36

Post by bo1024 »

bArray wrote: post #8

From my personal low-end server perspective (which has stood up to simple attacks from Russian IPs), I have the following: 1. Static page caching (in RAM ideally) - dynamically generated content will kill you quicker than anything else, especially calls to a database. WordPress is very easy to kill in it's default state. 2. Kill high frequency requests from the same location as quickly as possible (make sure your res…

For #2 -- how do you "kill" high frequency requests? By ignoring them?

Re: Ask HN: How is DDoS protection implemented?

#37

Post by jedberg »

grepthisab wrote: post #21
jedberg wrote: post #12

I worked on the eBay DDOS prevention system in the early 2000's. My coworkers filed a patent on part of the system. https://patents.google.com/patent/US7992192 Once the traffic was detected, the signature was sent to a second system that was a series of hardware optimized for layer 7 packet inspection. The devices were updated with signatures of current attacks, and then checked every incoming packet for that signatu…

What does a "signature" look like specifically, or generally if you can't be specific? Would love to hear about what is actually getting sent to the L7 optimized hardware.

It would look at the http request and break it down by uri, host, parameters, cookies, etc. A signature was some combo of those.

It also did layer 2 and 3 detection and looked for the stuff mentioned below like IP and port and if the 3 way handshake was “normal”. Stuff like that.

Re: Ask HN: How is DDoS protection implemented?

#38

Post by colanderman »

grepthisab wrote: post #21
jedberg wrote: post #12

I worked on the eBay DDOS prevention system in the early 2000's. My coworkers filed a patent on part of the system. https://patents.google.com/patent/US7992192 Once the traffic was detected, the signature was sent to a second system that was a series of hardware optimized for layer 7 packet inspection. The devices were updated with signatures of current attacks, and then checked every incoming packet for that signatu…

What does a "signature" look like specifically, or generally if you can't be specific? Would love to hear about what is actually getting sent to the L7 optimized hardware.

Not the GP though I've also worked in the DDoS space. Think fancy regexps (augmented with e.g. fast string search engines, counters, etc.), running inside a protocol-specific interpreter.

At least in the product I worked on, L7 processing was done purely in software. You could probably make hardware to do that but there's not a ton of benefit as you're pretty much constrained by memory bandwidth, not CPU power, once you start looking at anything past fixed headers.

(Our product also performed deep-packet inspection – in fact that was its original function – so the L7 processing was probably a bit more general than DDoS-only products.)

Re: Ask HN: How is DDoS protection implemented?

#39

Post by jauer »

bogomipz wrote: post #32
tptacek wrote: post #27

Earlier quoted context omitted.

It was silicon (or, at least, optimized general compute) in the mid-2000s, but who knows anymore? It could all be user land TCP/IP on Linux today. High speed network processing got weird.

>"High speed network processing got weird." I was curious about this statement. Can you elaborate, weird how?

Shifted from hardware intensive (ASICs, FPGAs) to software so we can do high-speed packet mangling on commodity hardware. Initially pretty involved with DPDK etc but much easier as of late with XDP+eBPF.

e.g. https://jvns.ca/blog/2017/04/07/xdp-bpf-tutorial/ https://netdevconf.org/2.1/papers/Gilberto_Bertin_XDP_in_pra... https://people.netfilter.org/hawk/presentations/OpenSourceDa...

Re: Ask HN: How is DDoS protection implemented?

#40

Post by colanderman »

bo1024 wrote: post #36
bArray wrote: post #8

From my personal low-end server perspective (which has stood up to simple attacks from Russian IPs), I have the following: 1. Static page caching (in RAM ideally) - dynamically generated content will kill you quicker than anything else, especially calls to a database. WordPress is very easy to kill in it's default state. 2. Kill high frequency requests from the same location as quickly as possible (make sure your res…

For #2 -- how do you "kill" high frequency requests? By ignoring them?

Yep. Add the source address (or some more specific yet easily computed identifier) to a table that is checked early in the network path (in hardware if possible).

Or, if you want to be fancy, "tarpit" them (complete TCP handshake and then ignore, forcing attacker to actually commit resources), but apparently that's of questionable value these days. [1]

[1] https://en.wikipedia.org/wiki/Tarpit_(networking)

Post reply on HN