Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Second large Hetzner outage in a week caused by DDoS attack

status.hetzner.com

Post reply on HN
Print view View original

11–20 of 55 posts

Re: Second large Hetzner outage in a week caused by DDoS attack

#11

Post by rstupek »

ricardobeat wrote: post #10

At their size, don’t they have some kind of hardware-level packet filtering ability like cloudflare to protect against these attacks?

Not if the level of incoming bandwidth exceeds the available bandwidth of the circuits involved.. you can't filter it when the link is saturated. Cloudflare uses other techniques like global distribution so aggregate bandwidth is higher than the attack bandwidth

Re: Second large Hetzner outage in a week caused by DDoS attack

#12

Post by ascar »

deathanatos wrote: post #6
_-david-_ wrote: post #3

>This concerns UDP traffic on port 9000-65535. Does anybody know what usually runs on those ports?

That's 56,536 different ports. Half of everything (that uses UDP), more or less.

I would expect 95%+ of TCP traffic to run on 22 (ssh), 25(smtp), 53(dns), 80(http), 443(https) plus another handful of lower than 1000 ports. Even common dev ports (3000,5000,8080) are below 9000. I don't think that's much different for UDP. Even most games probably rely on something <10,000.

Re: Second large Hetzner outage in a week caused by DDoS attack

#13

Post by booi »

ricardobeat wrote: post #10

At their size, don’t they have some kind of hardware-level packet filtering ability like cloudflare to protect against these attacks?

This depends on what type of attack it is. If it's volumetric, no amount of packet filtering is going to help you. If it's protocol-level attack then yes, some form of high performance WAF will be helpful if you have the filtering capacity.

Likely the attack isn't an overwhelming volumetric attack as I assume they have some fat pipes and big routers, but there's likely a bottleneck somewhere in their network.

Re: Second large Hetzner outage in a week caused by DDoS attack

#16

Post by xmpir »

ricardobeat wrote: post #10

At their size, don’t they have some kind of hardware-level packet filtering ability like cloudflare to protect against these attacks?

They state using hardware DDoS protection but it seems not to be sufficient: https://www.hetzner.com/unternehmen/ddos-schutz

Re: Second large Hetzner outage in a week caused by DDoS attack

#17

Post by unnouinceput »

Maybe, just maybe, rely less on embedded framework on embedded framework that spit JavaScript that gets 95% unused. If for a simple outage apology page the output was 1.7MB, I can only imagine for their normal pages how much it is. At this size I feel only like 10k legit users would unwillingly do the outage anyway. But hey, Kubernetes and Node.js is all the rage nowadays.

Re: Second large Hetzner outage in a week caused by DDoS attack

#19

Post by tempnow987 »

I thought OVH and Hetzner were the source of a ton of these DDoS attacks. Their IP ranges always seem to be in abuse logs.

Cloudflare write in a recent attack:

The top networks included the German provider Hetzner Online GmbH (Autonomous System Number 24940), Azteca Comunicaciones Colombia (ASN 262186), OVH in France (ASN 16276), as well as other cloud providers.

https://blog.cloudflare.com/15m-rps-ddos-attack/

Re: Second large Hetzner outage in a week caused by DDoS attack

#20

Post by scottlamb »

_-david-_ wrote: post #3

>This concerns UDP traffic on port 9000-65535. Does anybody know what usually runs on those ports?

Besides games, I think many AV things, including VOIP and perhaps WebRTC (definitely UDP, less sure about port number). Possibly also HTTP/3; the server picks the UDP port number IIUC.
Post reply on HN