Live data from Hacker News

Large DDoS hitting CloudFlare

news.ycombinator.com

31–34 of 34 posts

Re: Large DDoS hitting CloudFlare

#31
post #13

Earlier quoted context omitted.

The reason the internet is still online is because people who would ask for this type of thing don't have access to it. Routers shouldn't speak HTTP. People who don't know how to use blackhole communities have no business controlling them.

Your routers wouldn't speak HTTP. Your web service endpoint would talk to your network management middleware, which would then issue your respective IOS/NXOS/JunOS commands to your core or edge gear. You'd grant your customers the ability to null route traffic from IP blocks (/24 or larger, because ain't nobody got memory to route blocks smaller than that in IPv4) so they wouldn't saturate their links with useless tr…

Sorry, but I call shenanigans on your having operated a large scale network.

Every carrier worth its salt will already let you use blackhole communities to mitigate attacks. You tag it, it gets dropped at the edge of your upstreams networks. Simple and effective. You don't need a web service or middleware for any of this.

Also, a route and netmask (generally) take exactly the same amount of memory regardless of the size of the network you're covering.

Re: Large DDoS hitting CloudFlare

#32
post #26

CloudFlare, a product supposed to increase uptime, has been my product's only source of downtime for the past several months.

CloudFlare also caused huge performance issues on a side project which I didn't notice until recently. I was consistently getting 1.2s+ responses on a couple of pages, and 600ms on a completely static page. So, not only did CloudFlare not help on the pages that were truly static, it was actually making everything worse across the board. Hitting the same site with my direct.* DNS cut from 1.2s+ to under 500ms. CopperE…

I've been on the free account for a while now, and when I received a surge of traffic they responded to 460,000 of the 500,000-ish HTTP requests and served 48gb of the 50 that were requested over the course of about 12 hours. My server load sat at 0.01 the whole time and I could not have been happier. The concept is absolutely sound in theory and in practice.

You raise a great point about reliability however. The above example was a personal project so I don't really lose much if there's the odd down-time here and there. I'd love to recommend this for the enterprise-level clients where I work but the idea of a point of failure out of one's direct control is a bit alarming, and I am surprised and disappointed to see them succumb to a DDOS that affects what (I assume?) was their entire network - even paying customers.

I notice even now my homepage is taking seconds to load, when usually it responds instantly. My guess is that they're prioritizing access at this stage due to the DDOS, if it's still ongoing.

Re: Large DDoS hitting CloudFlare

#33
post #31

Earlier quoted context omitted.

Your routers wouldn't speak HTTP. Your web service endpoint would talk to your network management middleware, which would then issue your respective IOS/NXOS/JunOS commands to your core or edge gear. You'd grant your customers the ability to null route traffic from IP blocks (/24 or larger, because ain't nobody got memory to route blocks smaller than that in IPv4) so they wouldn't saturate their links with useless tr…

Sorry, but I call shenanigans on your having operated a large scale network. Every carrier worth its salt will already let you use blackhole communities to mitigate attacks. You tag it, it gets dropped at the edge of your upstreams networks. Simple and effective. You don't need a web service or middleware for any of this. Also, a route and netmask (generally) take exactly the same amount of memory regardless of the s…

If you want to meet me at the next NANOG conference, I can send you my personal email address to get in touch.
Post reply on HN