How to launch and defend against a DDoS attack [pdf]

Post by yeukhon » Fri, Oct 25, 2013, 4:54 PM UTC

Post by jeanjq » Fri, Oct 25, 2013, 6:19 PM UTC

yeukhon wrote: post #2

I am quite surprised by "Dreamhost" listed in the spoofed IP list? What is the reason Dreamhost servers are comprised? Are those the old server accounts? I am also amazed by the durability of our infrastructure able to sustain this huge flow everyday. But good work, CF.

Post by madsushi » Fri, Oct 25, 2013, 6:36 PM UTC

bigdubs wrote: post #5

SteveLivesInSLO wrote: post #3

Set your DNS records TTL to something relatively small like an hour. If you are hit with a DDOS and want to direct traffic through a DDOS mitigation service you will often need to point your domain at their servers. If your DNS TTL is 48 hours then you will be up a creek for quite a while.

What are the downsides of a small TTL? Why wouldn't a low TTL be default?

Post by tokenizerrr » Fri, Oct 25, 2013, 7:18 PM UTC

imbriaco wrote: post #7

madsushi wrote: post #6

Earlier quoted context omitted.

If your TTL is very low, you end up creating/handling a lot more DNS traffic, because your records are flushed from the cache more often and have to be re-retrieved. Also, many public DNS servers (e.g. your ISP's, or Google's) set a minimum TTL on all records (overwriting any lower value) to minimize DNS traffic/requests. Setting your TTL to an hour is fairly standard, but some DNS hosts (especially old ones) will le…

Very few resolvers break DNS TTLs in that way anymore. Google certainly honors TTLs down to at least 30 seconds. I'm not aware of any major ISPs that get this wrong anymore either. This hasn't been a significant problem in years. When I execute a DNS change on a record with a 30 second TTL, I expect to see 95+% of the traffic move within a couple of minutes. The things that tend to get it wrong these days are applica…

Post by richbradshaw » Fri, Oct 25, 2013, 7:43 PM UTC