Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

blog.cloudflare.com

Post reply on HN
Print view View original

41–50 of 151 posts

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#41

Post by iptrans »

realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

I’m interested to hear how you

1) block 2 Tbps of attack traffic

2) save $500k per month in bandwidth charges since blocking at the border means you have to pay for the incoming bandwidth

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#42

Post by [deleted] »

realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

[deleted]

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#43

Post by b3lvedere »

archerx wrote: post #19
realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

I would add Turkey to that list. Many many years ago I had a kind of popular podcast about computer graphics and all of my grief was coming from Turkey. After I banned all of Turkey‘s IPs my drama was over. Occasionally I would get an email from someone saying they couldn’t listen to the episodes and I would explain to them why their country is blocked and they would say it’s not fair, I couldn’t disagree, its not fa…

Fair is not the right word. Your house, your rules.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#44

Post by luckylion »

dec0dedab0de wrote: post #37
realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

Wouldn't it be nice if all the ISPs got together and refused to route traffic from networks that ignored abuse complaints? I suppose that would put cloudflare and anyone else doing ddos mitigation out of business. When I worked at a small ISP and we would get complaints, we would block the user until we could reach them. Then let them online long enough to update their antivirus. I can't imagine Comcast committing to…

I'd love to see that, but I don't think it'd work because most people aren't capable enough to disinfect their machines and you can't just block their access to the internet.

I expect locked down devices like cell phones and tablets to be less problematic in that regard (but maybe that's not true at all), so maybe the home-botnet-issue will resolve itself as more and more people stop using personal computers?

I have no way to tell how the big Cloudproviders actually handle it. I've occasionally reported persistent phishing campaigns to SES & similar providers and never really got a reply. I've reported a DDOS to Azure and it took them 18 days or so to say "thanks, we'll forward it". If Microsoft and Amazon don't respond appropriately, how can we expect smaller ISPs to handle that?

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#45

Post by Aachen »

realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

The startup I work for hasn't ever had issues with any of the things you mentioned. What line of business is this, do you sell weapons to Ukraine or some such?

> absolutely first thing I do at every company and on every project is ask if I can [block various countries]

For side projects?! Blows my mind. This feels like the 2020s version of what used to be in chain emails "don't pick up this phone number or they'll eat your dog". People believe it because it works. They don't pick up the number and their dog wasn't eaten. Doesn't harm them, only the person who owns the number. Better be safe. Use ddos protection (it's free!) and centralize the world's traffic for your hobby website, don't trust your ISP that has a known profit model but rather pay for an additional VPN that promises not to work with law enforcement because that's obviously not shady, similar for using DoH from cloudflare (thanks mozilla for making that the default), etc. The Internet is becoming such a weird place.

I get annoyed when people block Tor, but at least that's somewhat understandable as there is no concept of abuse email addresses to reach out to. Blocking not just ISPs that don't play nice, but an entire country? Multiple? As the first thing you do, before a problem exists? In-sane.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#46

Post by namtab00 »

__alexs wrote: post #27
realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

In my experience running large sites most attack traffic has come from EU and US hosts such as Choopa/Vultr, OVH, Hetzner, AWS etc followed closely by major domestic ISPs like Comcast. Any traffic at all from BRICs has been pretty low. The post doesn't even mention any of the countries you whine about.

why do you disregard South Africa like that?

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#47

Post by 0xy »

realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

The US' foreign policy is to disrupt and steal as well, even to allies (the NSA engaged in industrial espionage on the Germany company Siemens).

Moreover, DDoS attacks orginating from the US are sometimes greater than Chinese originated attacks -- as recently as a year ago [1]

Also don't forget that some of the sketchiest providers on the internet are American, who routinely ignore abuse reports. NameCheap's abuse reports are almost never actioned, happily taking cash from scammers and spammers.

[1] https://blog.cloudflare.com/ddos-attack-trends-for-2022-q1/

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#48

Post by nbadg »

nightfly wrote: post #40
kortilla wrote: post #36

Earlier quoted context omitted.

30k isn’t even noteworthy in size for botnets thanks to shitty iot stuff. Mirai attacked Dyn with 100k unique devices.

Comma in odd place. Could be typo of 30,000 or 300,000. Written the same way in the article

Fun fact: how many digits get lumped together in a digit grouping is not universal and varies between different languages and cultures globally: https://en.wikipedia.org/wiki/Decimal_separator#Digit_groupi...

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#49

Post by afiori »

iptrans wrote: post #41
realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

I’m interested to hear how you 1) block 2 Tbps of attack traffic 2) save $500k per month in bandwidth charges since blocking at the border means you have to pay for the incoming bandwidth

DDoS don't only cost bandwidth.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#50

Post by canadianfella »

realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

[dead]
Post reply on HN