Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

blog.cloudflare.com

Post reply on HN
Print view View original

51–60 of 151 posts

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#51

Post by Aachen »

TimWolla wrote: post #17
blibble wrote: post #6

Earlier quoted context omitted.

indeed I suspect a single machine could put out 71M HTTP requests/second without too much difficulty (but cloudflare never misses an opportunity for a blog post)

71M requests per second gives you about 14ns per request. WolframAlpha says that's about 4 times the latency of a L2 cache access and 0.8 times the latency of a Mutex lock / unlock: https://www.wolframalpha.com/input?i=1+second+%2F+71+million . So even if you have a massive amount of cores in that machine, you still don't really have much time to spend on a single request and a single mutex operation will exceed your…

But it's not one machine if you do anycast.

It's a lot, but at cloudflare's scale you either have the budget for a crapton of machines per point of presence (hope I'm using the term correctly) or custom hardware that can deal with this sort of thing. It's kind of their core business.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#52

Post by robertlagrant »

blibble wrote: post #22
TimWolla wrote: post #17

Earlier quoted context omitted.

71M requests per second gives you about 14ns per request. WolframAlpha says that's about 4 times the latency of a L2 cache access and 0.8 times the latency of a Mutex lock / unlock: https://www.wolframalpha.com/input?i=1+second+%2F+71+million . So even if you have a massive amount of cores in that machine, you still don't really have much time to spend on a single request and a single mutex operation will exceed your…

> So even if you have a massive amount of cores in that machine, you still don't really have much time to spend on a single request and a single mutex operation will exceed your budget. fortunately it's no longer 2000 and I have more than one core, and my NIC has more than one queue generating requests is a lot less CPU intensive than parsing requests how much CPU do I have to spend to get a pre-formed 100 byte reque…

Could you do this and write it up? I'd love to see how you tune this stuff in hardware and software to get that sort of throughput.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#53

Post by favaq »

Aachen wrote: post #45
realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

The startup I work for hasn't ever had issues with any of the things you mentioned. What line of business is this, do you sell weapons to Ukraine or some such? > absolutely first thing I do at every company and on every project is ask if I can [block various countries] For side projects?! Blows my mind. This feels like the 2020s version of what used to be in chain emails "don't pick up this phone number or they'll ea…

Lots of garbage traffic comes from countries such as Russia, China, India, Brazil, etc and if you don't intend to sell anything to them it makes sense to just block them.

If you wrote your website in some shitty language and you need lots of server power just to serve the home page you will end up saving a lot of money from blocking those countries.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#54

Post by admax88qqq »

afiori wrote: post #49
iptrans wrote: post #41

Earlier quoted context omitted.

I’m interested to hear how you 1) block 2 Tbps of attack traffic 2) save $500k per month in bandwidth charges since blocking at the border means you have to pay for the incoming bandwidth

DDoS don't only cost bandwidth.

OP literally said 500k of bandwidth charges.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#55

Post by themoonisachees »

traceroute66 wrote: post #39
geek_at wrote: post #21

Earlier quoted context omitted.

Just for a different perspective, here in the EU I get most of the attacks from US servers. Often times Google cloud or AWS. But we can't block the IP space of the US for obvious reasons

> I get most of the attacks from US servers. Often times Google cloud or AWS. Yup. The block $insert_country IP range "solution" is an outdated mentality that should have died off in the 90's. These days most attacks originate from US/Western cloud and other rent-a-box providers. They are a gift to attackers because they can hop around at the click of the button and they know the victims can't block the IP ranges bec…

I agree that cloud providers are a blessing to attackers, but blocking russian, chinese and even generally SEA ip space is still a very effective way of stopping the bottom 70% of all attacks. Sure, they're trying such outdated methods that there is very little chance of them suceeding, but honestly when just banning china reduces sshd logs by 50% you wonder why you didn't do it sooner.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#56

Post by realistik1 »

Aachen wrote: post #45
realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

The startup I work for hasn't ever had issues with any of the things you mentioned. What line of business is this, do you sell weapons to Ukraine or some such? > absolutely first thing I do at every company and on every project is ask if I can [block various countries] For side projects?! Blows my mind. This feels like the 2020s version of what used to be in chain emails "don't pick up this phone number or they'll ea…

> The startup I work for hasn't ever had issues with any of the things you mentioned. What line of business is this, do you sell weapons to Ukraine or some such?

Well, not directly,but this is the first time I was morally willing to work in parallel to the defense industry.

My previous startups were fintech. The customer I had who was attacked by China was Slideshare. Ultimately they bent over for China, and blocked them for a year.

Setup an IPS on a server exposed to the net. Record all attacks for a month, then look up the IP addresses, then you will understand.

I worked in network security at banks for a decade, really Russia and China are responsible for millions of attacks against westerm infrastrucuture in this century causing $10s of billions of damage. It is war.

I’ve been in the industry for over 30 years and I’ve seem some shit. Russia once took Estonia offlone for over a month.

Cloudflare and every other CDN understand that China and Russia is a liability, thats wht they make it easy to null route them.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#57

Post by themoonisachees »

iptrans wrote: post #41
realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

I’m interested to hear how you 1) block 2 Tbps of attack traffic 2) save $500k per month in bandwidth charges since blocking at the border means you have to pay for the incoming bandwidth

Supposedly the traffic being blocked would have generated more outgoing traffic, costing more. Also, GP is managing their connections at the bgp level, meaning the requests don't ever hit their firewall, they just are unroutable from these countries ips.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#58

Post by throwaway67743 »

realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

[flagged]

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#59

Post by throwaway67743 »

kortilla wrote: post #38

This is blogspam complete with made up terms (“hyper-volumetric”), self-congratulatory back-patting, and no technical content. It’s an ad to scare you into signing up for cloudflare.

Which is why they're colloquially known as blogflare ;)

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#60

Post by realistik1 »

iptrans wrote: post #41
realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

I’m interested to hear how you 1) block 2 Tbps of attack traffic 2) save $500k per month in bandwidth charges since blocking at the border means you have to pay for the incoming bandwidth

1. Not sure where you got 2tbps? I said 10gbps, but we use Alamai’s manages Prolexic ddos mitigation. At previous companies we would buy a half dozen of these, put them at different exchanges and buy transit from the biggest aggregators. This would cost about $4m to get started

2. I meant $50k per month, edited. This does not count loss of productivity.

Post reply on HN