This might give you a nice idea of how HAProxy provides the feature. https://www.haproxy.com/blog/use-a-load-balancer-as-a-first-...
Ask HN: How is DDoS protection implemented?
41–50 of 58 posts
Re: Ask HN: How is DDoS protection implemented?
#42Earlier quoted context omitted.
It was silicon (or, at least, optimized general compute) in the mid-2000s, but who knows anymore? It could all be user land TCP/IP on Linux today. High speed network processing got weird.
It's a mix depending on what market segment you're looking at. I watch it from afar. There's still a lot of silicon use, esp for accelerating TCP/IP or decryption. I also found one recently you all might enjoy with slides on using a GPU: http://on-demand.gputechconf.com/gtc/2017/presentation/s7468...
Thanks for the link. This is really interesting. Might you know if the talk that accompanied this is available somewhere?
Re: Ask HN: How is DDoS protection implemented?
#43Earlier quoted context omitted.
>"Once the traffic was detected, the signature was sent to a second system that was a series of hardware optimized for layer 7 packet inspection." Was this custom DPI hardware or something from a vendor?
It was off the shelf hardware but then the software was customized by my coworker. He had to write some C and assembly for it.
I wonder if someone with more industry knowledge might be able to hazard a guess what kind of off the shelf hardware.
You didn't say VHDL (or maybe this was irrelevant for switching circa 2000?), so I'm really curious what architecture was in use. (That's really all my question is; CPU architecture / system design)
Re: Ask HN: How is DDoS protection implemented?
#44I use remote black hole routine announcements to the upstream ISPs to filter source or destination addresses from traversing the congested link.
I wonder where you are, very vaguely speaking. (Just in case people might be near (downstream of) you unaware that they could take advantage of these announcements.) Maybe this is a tricky question (because of domain nontriviality, or because of privacy), which is fine.
PSA: this user's profile definitely deserves reading, everyone go look
Re: Ask HN: How is DDoS protection implemented?
#45One "trick" to know is that transit links are generally billed as the higher of inbound or outbound traffic. If you have a service which is unbalanced and pushing out a lot of data (like most hosting services), your inbound is thus essentially "free" up to a very high volume.
Re: Ask HN: How is DDoS protection implemented?
#46Earlier quoted context omitted.
For #2 -- how do you "kill" high frequency requests? By ignoring them?
Yep. Add the source address (or some more specific yet easily computed identifier) to a table that is checked early in the network path (in hardware if possible). Or, if you want to be fancy, "tarpit" them (complete TCP handshake and then ignore, forcing attacker to actually commit resources), but apparently that's of questionable value these days. [1] [1] https://en.wikipedia.org/wiki/Tarpit_(networking)
Interesting, thanks.
Re: Ask HN: How is DDoS protection implemented?
#47From my personal low-end server perspective (which has stood up to simple attacks from Russian IPs), I have the following: 1. Static page caching (in RAM ideally) - dynamically generated content will kill you quicker than anything else, especially calls to a database. WordPress is very easy to kill in it's default state. 2. Kill high frequency requests from the same location as quickly as possible (make sure your res…
For #2 -- how do you "kill" high frequency requests? By ignoring them?
In addition to @colanderman's suggestion I also do this on an application level - although not everyone will be able to do this.
Re: Ask HN: How is DDoS protection implemented?
#48I was lead developer on Arbor Network's DDoS product in the early 2000s (I left in 2005 to start Matasano Security). My information on this is surely dated, but people seem to still be using the same terminology now as then. You can break down DDoS into roughly three categories: 1. Volumetric (brute force) 2. Application (targeting specific app endpoints) 3. Protocol (exploiting protocol vulnerabilities) DDoS mitigat…
What happens when it doesn't work? For instance why does something like Mirai happen? The first D is too D?
You call up krebs and the FBI and they'll dox/arrest the attacker.
Re: Ask HN: How is DDoS protection implemented?
#49Re: Ask HN: How is DDoS protection implemented?
#50I'm working on DDoS protection at Cloudflare. AMA
We try to publish most of what we do, the more obvious links:
https://blog.cloudflare.com/how-cloudflares-architecture-all...
https://blog.cloudflare.com/meet-gatebot-a-bot-that-allows-u...
https://blog.cloudflare.com/the-root-cause-of-large-ddos-ip-...
https://blog.cloudflare.com/memcrashed-major-amplification-a...
https://blog.cloudflare.com/syn-packet-handling-in-the-wild/
https://blog.cloudflare.com/reflections-on-reflections/
https://blog.cloudflare.com/say-cheese-a-snapshot-of-the-mas...
https://blog.cloudflare.com/the-new-ddos-landscape/
https://blog.cloudflare.com/unmetered-mitigation/
https://blog.cloudflare.com/introducing-the-p0f-bpf-compiler...
And maany more.
Also two talks:
https://idea.popcount.org/2016-02-01-enigma---building-a-dos...
https://idea.popcount.org/2015-11-16-black-hat-eu---defendin...
> But how does that prevent severe service degradation
It doesn't. You DROP the most specific thing you can. To avoid collateral damage we are able to do "Scattering" (move client across IPs with the hope the attack won't follow), and for example apply the controversial limits only in certain geographical areas (anycast network allows this).
> you still have to do some kind of work (in computation and energy) on the listening side
Yes. BPF for L3 works like charm. Read on XDP.
> or can fat edge-servers just eat that up?
Yes and no. You have to specifically optimize, whatever you do probably won't make Apache or IIS work under DDoS. Most vendors use "scrubbing centres", when they can have small number of beefy dedicated servers. We didn't find this architecture sufficient though, so in our case edge servers do handle the load. But we do spend time on tuning the servers and our applications.