Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

blog.cloudflare.com

Post reply on HN
Print view View original

21–30 of 151 posts

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#21

Post by geek_at »

realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

Just for a different perspective, here in the EU I get most of the attacks from US servers. Often times Google cloud or AWS.

But we can't block the IP space of the US for obvious reasons

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#22

Post by blibble »

TimWolla wrote: post #17
blibble wrote: post #6

Earlier quoted context omitted.

indeed I suspect a single machine could put out 71M HTTP requests/second without too much difficulty (but cloudflare never misses an opportunity for a blog post)

71M requests per second gives you about 14ns per request. WolframAlpha says that's about 4 times the latency of a L2 cache access and 0.8 times the latency of a Mutex lock / unlock: https://www.wolframalpha.com/input?i=1+second+%2F+71+million . So even if you have a massive amount of cores in that machine, you still don't really have much time to spend on a single request and a single mutex operation will exceed your…

> So even if you have a massive amount of cores in that machine, you still don't really have much time to spend on a single request and a single mutex operation will exceed your budget.

fortunately it's no longer 2000 and I have more than one core, and my NIC has more than one queue

generating requests is a lot less CPU intensive than parsing requests

how much CPU do I have to spend to get a pre-formed 100 byte request into the NICs queue? not much at all

(the TCP negotiation will likely be the bottleneck)

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#23

Post by Avamander »

realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

If they'd respect abuse complaints things could be different, some do, but way too much is just very malicious.

In the context of email I heavily recommend requiring SPF (just to exist even!) on things originating from China, Russia and VPS providers.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#24

Post by tikkabhuna »

geek_at wrote: post #21
realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

Just for a different perspective, here in the EU I get most of the attacks from US servers. Often times Google cloud or AWS. But we can't block the IP space of the US for obvious reasons

Did you report it to Google/AWS? I feel like they would be proactive about removing malicious users, but whether expectations match reality is another question.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#25

Post by jb1991 »

archerx wrote: post #19
realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

I would add Turkey to that list. Many many years ago I had a kind of popular podcast about computer graphics and all of my grief was coming from Turkey. After I banned all of Turkey‘s IPs my drama was over. Occasionally I would get an email from someone saying they couldn’t listen to the episodes and I would explain to them why their country is blocked and they would say it’s not fair, I couldn’t disagree, its not fa…

I'm curious what kind of grief a country caused you for a podcast. What were they doing?

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#26

Post by moremetadata »

blibble wrote: post #6
silisili wrote: post #4

This just feels like a typical sales team fluff piece. I worked in this space, and constantly read articles of different providers claiming to have blocked the biggest attack ever. Some go by total bandwidth, some by pps, some by number of actors, and apparently some by rps. Not that it isn't impressive, still, but hardly seems newsworthy.

indeed I suspect a single machine could put out 71M HTTP requests/second without too much difficulty (but cloudflare never misses an opportunity for a blog post)

>I suspect a single machine could put out 71M HTTP requests/second without too much difficulty

PacketsPerSecond=TransferRate(bytes/second)/PacketSize(bytes/packet)

https://community.arubanetworks.com/community-home/digestvie...

A single 24port switch with 1Gbps ports would see 48Gbps so with 64byte packets would see 71M packets, 1518byte packets would drop to 3.9M packets.

If you are in the business of being the main auditor of your activities, water companies here in the UK being an example, news organisations as another, then does one ever find a problem with one's work?

I've had DDOS on my systems before, and how it took my firewall out was simply increasing the number of requests the firewall had to handle using a SYN flood. https://en.wikipedia.org/wiki/SYN_flood

Most firewalls are fixed and not adaptive, so a bit of low hanging fruit could be had by firewall systems that can adapt to SYN floods, like shortening the time the handshake process stays in memory, choosing to dump all that dont complete within a short period of time, choosing to dump those from ip address blocks linked to country's or regions your dont normally trade with. There are so many ways to handle these situations, but not all firewalls and switches provide the facilities that are needed.

Hackers will exploit default configurations and industry standard best practices, including RFC's.

During one of my lets see what happens if I push this metaphoric button exercises, I was tracing those random packets that appear at firewalls and I happened to have picked one which tracerouted back to a French IP.

What was interesting and consistent with behaviour I've seen in the 90's with dead submarine internet connections at the New York exchange, was the trace route delivered its hop data until I crossed the English channel at which point a packet killed the machine, forcing the mains to be pulled as the machine went totally unresponsive.

It makes me think the UK internet is like some giant virtual dome like the one seen in the film The Truman Show.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#27

Post by __alexs »

realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

In my experience running large sites most attack traffic has come from EU and US hosts such as Choopa/Vultr, OVH, Hetzner, AWS etc followed closely by major domestic ISPs like Comcast. Any traffic at all from BRICs has been pretty low.

The post doesn't even mention any of the countries you whine about.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#28

Post by TimWolla »

blibble wrote: post #22
TimWolla wrote: post #17

Earlier quoted context omitted.

71M requests per second gives you about 14ns per request. WolframAlpha says that's about 4 times the latency of a L2 cache access and 0.8 times the latency of a Mutex lock / unlock: https://www.wolframalpha.com/input?i=1+second+%2F+71+million . So even if you have a massive amount of cores in that machine, you still don't really have much time to spend on a single request and a single mutex operation will exceed your…

> So even if you have a massive amount of cores in that machine, you still don't really have much time to spend on a single request and a single mutex operation will exceed your budget. fortunately it's no longer 2000 and I have more than one core, and my NIC has more than one queue generating requests is a lot less CPU intensive than parsing requests how much CPU do I have to spend to get a pre-formed 100 byte reque…

I've interpreted the "put out" in the initial comment as in "put out a fire" (i.e. mitigate), instead of "send out".

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#29

Post by archerx »

jb1991 wrote: post #25
archerx wrote: post #19

Earlier quoted context omitted.

I would add Turkey to that list. Many many years ago I had a kind of popular podcast about computer graphics and all of my grief was coming from Turkey. After I banned all of Turkey‘s IPs my drama was over. Occasionally I would get an email from someone saying they couldn’t listen to the episodes and I would explain to them why their country is blocked and they would say it’s not fair, I couldn’t disagree, its not fa…

I'm curious what kind of grief a country caused you for a podcast. What were they doing?

Constantly trying to get to the backend of the site and occasional ddos. Once one of them managed to deface the front page I had enough and just banned all of Turkey.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#30

Post by skepticalloy »

Is there any independent verification of this? Or any way of confirming any of the details?

Just seems like a Cloudflare puff piece otherwise.

I would be more interested in a critical article about where they failed to block a DDoS attack, and why. Plus what could be done in the future to mitigate.

Post reply on HN