Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

121–130 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#121

Post by codedokode »

Swenrekcah wrote: post #108
codedokode wrote: post #90

Earlier quoted context omitted.

I propose to make a special "reject" packet. When a host, let's say 1.1.1.1, sends such packet to 2.2.2.2, all providers that see this packet, MUST reject any traffic from 2.2.2.2 to 1.1.1.1. This is very easy but very efficient and allows a single host to withstand the attack of any size. There is no need for any central authority and no need to maintain any lists.

That actually sounds like a really good idea. This is already implemented in the physical world (in a much less efficient way) in the form of “no spam” stickers and registrations. Is there a reason other than inertia for why it hasn’t been implemented?

ISPs do not want to spend money for fighting against criminals.

Re: The largest DDoS attack to date, peaking above 398M rps

#122

Post by c7DJTLrn »

dudeinjapan wrote: post #10
oldtownroad wrote: post #5

At a previous company, we were subject to semi-frequent attacks (of a much smaller scale). The operating assumption internally was that it’s a competitor trying to undermine us but it remains a mystery. Anyone involved in these type of attacks (at internet-infrastructure scale or targeting specific companies) brave/crazy enough to create a throwaway account and tell hn about the motivations?

Sure, I’ll spill the beans. Some people think it’s related to Gaza or Ukraine but it’s not. We just really don’t like Google, we are trying to shut it down so we can bring back Altavista.

I think the plan went horribly wrong, everybody started using Bing again!

Re: The largest DDoS attack to date, peaking above 398M rps

#124

Post by throwawayqqq11 »

codedokode wrote: post #75

Such attacks are possible because ISPs do not want to adopt a protocol that would allow any host to send a special packet to block malicious traffic on the upstream provider or even at the source network. In this case networks like Cloudflare would become unnecessary.

ISPs could enshitty-sell it though.

Re: The largest DDoS attack to date, peaking above 398M rps

#125

Post by Swenrekcah »

codedokode wrote: post #121
Swenrekcah wrote: post #108

Earlier quoted context omitted.

That actually sounds like a really good idea. This is already implemented in the physical world (in a much less efficient way) in the form of “no spam” stickers and registrations. Is there a reason other than inertia for why it hasn’t been implemented?

ISPs do not want to spend money for fighting against criminals.

That doesn’t sound convincing to me. I mean I understand they don’t want to spend money but if cost is the only barrier it seems like that could be overcome somehow by interested parties.

Re: The largest DDoS attack to date, peaking above 398M rps

#126

Post by blueflow »

paulddraper wrote: post #89
mihaic wrote: post #14

The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.

[flagged]

There is Marek's disease, so you still need to show that GP is in the wrong.

Re: The largest DDoS attack to date, peaking above 398M rps

#127

Post by londons_explore »

londons_explore wrote: post #42
kijin wrote: post #37

Earlier quoted context omitted.

A spamhaus-like blacklist for botnet IPs is an interesting idea. What if Google and Cloudflare collectively reverse-DoSed all the infected IPs, not by sending them any traffic, but simply by refusing to accept any connections from them to any part of their infrastructure? Whoever is on those IPs will suddenly find that half the internet doesn't work anymore. Which is probably a good enough incentive for them to repla…

Google already does this. "Something on your network is causing unusual traffic, please fill in this captcha to continue". And then you have to fill in a new captcha every 5 minutes or so just to keep using google maps/gmail/search. It's kinda annoying, and usually the culprit is someone else who shares my IP, not me (ie. a school, university, workplace, open wifi).

For any googlers reading: This behaviour sometimes hits an ajax request (map data downloads when panning or zooming). The client side javascript then fails badly and the user sees a broken site rather than a captcha request.

Plz fix.

Re: The largest DDoS attack to date, peaking above 398M rps

#128

Post by ilyt »

nonameiguess wrote: post #68
mihaic wrote: post #14

The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.

The actual solutions are: 1) Egress filtering by the ISPs 2) Better malware resistance and vulnerability mitigation on easily-compromised appliance and IoT devices But neither is going to happen. 1 is a coordination problem. It has to be all or nothing, which can only be compelled by law, and we have no global laws and no global law enforcement mechanism. Some countries inevitably don't care and the rest won't partit…

The problem with this type of attack is that you can't really catch it as MITM DDoS protection.

You're not seeing any SYN flood, just a bunch of TCP connections (equivalent of say search crawler), that are encrypted. Only after unpacking on loadbalancer those are visible as one TCP stream sheltering thousand HTTP2 streams.

Re: The largest DDoS attack to date, peaking above 398M rps

#129

Post by papichulo2023 »

sph wrote: post #8

How does DDoS mitigation work? When people say "I put my website behind Cloudflare to mitigate DDoSes", what does it mean exactly? Is it only about having a large enough ingress pipe that you can weather however many Gb/s you are being bombarded with, and still having some spare capacity for legitimate traffic?

I always believed that they have some secret mega routers with massive computation limits that allows smart and complex tcp/udp packages filtering.
Post reply on HN