Information would be nice. You can't properly stop a DDoS if you don't know anything about it.
Ask HN: How to survive indefinite DDoS attack?
51–60 of 62 posts
Re: Ask HN: How to survive indefinite DDoS attack?
#52Earlier quoted context omitted.
but all how are all these services able to let in valid traffic? won't they simply cut me off altogether to protect my infrastructure at the cost of no access for my users?
The entire business model is in not cutting you off, but cutting off the requests. E.g. by forwarding them to the cloudflare captcha first. This does mean occasional false positives.
Unfortunately, the captcha is a deal breaker for anyone who is running APIs instead of regular, boring, human-accessible websites.
We can barely tell humans and robots apart, and have no idea how to tell good robots from bad robots.
Re: Ask HN: How to survive indefinite DDoS attack?
#53Assuming this is an API and not a website, my approach would be (other than just paying cloudflare to handle it). Application servers that aren't listed on DNS and their IPs kept secret. A _lot_ of proxy servers that take requests, check the auth, and forward the valid requests to the application servers. For invalid requests, just let them time out. If checking the auth is expensive enough to cause problems, require…
That's "building your own cloudflare". > Make it cheap to handle the DDOS traffic and expensive to generate the DDOS traffic The traffic is from compromised devices, so it's very cheap.
If you can make it take 10x as long to send a request, the DDOS attack becomes 1/10 the size.
Re: Ask HN: How to survive indefinite DDoS attack?
#54Earlier quoted context omitted.
That's "building your own cloudflare". > Make it cheap to handle the DDOS traffic and expensive to generate the DDOS traffic The traffic is from compromised devices, so it's very cheap.
If you can make it take 10x as long to send a request, the DDOS attack becomes 1/10 the size.
Only for some categories - SYN floods aren't limited by responses at all.
Re: Ask HN: How to survive indefinite DDoS attack?
#55My question is, what did people do before Cloudflare? There are different types of DDoS attacks. I vaguely remember what we did over a decade ago, which was blackhole IPs. I'm not sure if people still do this directly with iptables, but at the time, this was the bread-and-butter approach for transport DDoS. If your issue was web application related, then you'd move up to fail2ban. DDoS protection for web applications…
what did people do before Cloudflare?
DDoS scrubbing centers. They are still used today but add some latency and are very expensive. There are also some expensive appliances that learn legit traffic and can be put into a defense mode that drops anything it did not learn at a certain volume. CDN's have incentives to be more cost effective as they want to have your traffic 100% of the time. DDoS scrubbing centers are on-demand via BGP changes.
Re: Ask HN: How to survive indefinite DDoS attack?
#56Assuming this is an API and not a website, my approach would be (other than just paying cloudflare to handle it). Application servers that aren't listed on DNS and their IPs kept secret. A _lot_ of proxy servers that take requests, check the auth, and forward the valid requests to the application servers. For invalid requests, just let them time out. If checking the auth is expensive enough to cause problems, require…
sacrificial proxies make sense although they would all have to be essentially located in the same local network as the target server to avoid routing traffic over different geozones and essentially function like a more advanced firewall. still, it is possible solution and not even expensive.
Re: Ask HN: How to survive indefinite DDoS attack?
#57Earlier quoted context omitted.
Yeah essentially this. Then have something crawl your database and find IP's that are crawling your dummy pages, and block those. Most of it is EC2/GCP instances and Azure VMs that people spin up with stolen cards, so you have to block a lot of 3rd party vendors. OVH and some others came up often. Lot's of crawling companies were using end user VPNs, so those are harder to block. The best thing I found was dummy page…
Cloudflare's layer-7 protection is crap, but it's still orders of magnitude more effective than anything Linode or Hetzner can pull off. Any major cloud or datacenter can block an old-fashioned UDP flood these days, but botnets have evolved too. Now they speak TLS and HTTP/2, and can send (relatively) small amounts of traffic to select endpoints to generate a large load. In addition to blocking layer-3 and layer-4 fl…
why would i care about udp when i run only tcp?
Re: Ask HN: How to survive indefinite DDoS attack?
#58Given the frequent mentions of Cloudflare in this post, I'd like to offer an alternative suggestion.
Consider migrating your website to web hosting providers renowned for their DDoS protection, such as OVH or Path. By doing so, you can ensure that your server performance remains unaffected even during ongoing attacks.
Re: Ask HN: How to survive indefinite DDoS attack?
#59[dead]
Re: Ask HN: How to survive indefinite DDoS attack?
#60Earlier quoted context omitted.
Cloudflare's layer-7 protection is crap, but it's still orders of magnitude more effective than anything Linode or Hetzner can pull off. Any major cloud or datacenter can block an old-fashioned UDP flood these days, but botnets have evolved too. Now they speak TLS and HTTP/2, and can send (relatively) small amounts of traffic to select endpoints to generate a large load. In addition to blocking layer-3 and layer-4 fl…
why would i care about udp when i run only tcp?
If I saturate your uplink with UDP, none of your TCP is going to get through. Before you have a chance to drop it at your firewall. You have to get your ISP to do that for you, and hope there isn't too much traffic for their uplink.