Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My cat alerted me to a DDoS attack

dannyguo.com

Post reply on HN
Print view View original

61–70 of 107 posts

Re: My cat alerted me to a DDoS attack

#61

Post by nyjah »

exabrial wrote: post #51

We don’t have very many earthquakes in Kansas… but I remember the first/only one I felt. I was sound asleep when my Siamese woke me up by pawing my face… he then went and sat on the edge of the bed and growled aggressively (very out of character)… Not 30s later, things started shaking. No idea how he knew, but it was pretty wild. He passed away in 2020, still miss him.

Dang, sorry for your loss. That’s a dope memory of the cat tho. As someone that happened find themselves in Taipei a couple weeks ago for the 7.4, my only thought was getting back to my dog, whom I promised I would get back to. She was sorta freaking out before I left; either could sense me leaving, or sense the earthquake I was heading to…

Re: My cat alerted me to a DDoS attack

#65

Post by kijin »

toast0 wrote: post #50
ahmedfromtunis wrote: post #16

> With horrible grammar Ah, the days before ChatGPT! On a more serious note, do you think there will ever be a way to stop ddos attacks once and for all? While all threats are bad, ddos is the most lame type of attacks there is; no special skill or knowledge are needed, just load a script or, heck, pay someone who'll execute it for you as a service.

There's application level DDoS, which you generally stop by not doing expensive work for clients that haven't done expensive work for you. Sometimes, easier said than done. And then there's volumetric DDoS. You can stop this by having more bandwidth than everyone else... but that's pretty hard and it makes you a potential attacker. Innovation here is in the form of using BGP to disseminate traffic filters. Null routi…

> Null routing is the MVP here: this IP is being attacked, so drop traffic to it as soon as possible.

Oh, this poor guy is being DDoS'd, so we're going to make sure that their service remains denied.

Null-routing the target IP helps everybody except the customer who is being attacked: namely, the network operator and their other customers. From the victim's point of view, it's just as frustrating as the attack itself, and gets in the way of troubleshooting.

With modern tooling and a bit of ML, it shouldn't be too hard for multiple ISPs to collectively determine which IPs are currently part of a large botnet. Drop packets from them, not to the victim. DoS the ones who are causing the DDoS.

Re: My cat alerted me to a DDoS attack

#66

Post by btilly »

exabrial wrote: post #51

We don’t have very many earthquakes in Kansas… but I remember the first/only one I felt. I was sound asleep when my Siamese woke me up by pawing my face… he then went and sat on the edge of the bed and growled aggressively (very out of character)… Not 30s later, things started shaking. No idea how he knew, but it was pretty wild. He passed away in 2020, still miss him.

I know how he knew.

There are two types of sound in rock. P and S waves. P waves are pressure waves and go faster. S waves go side to side and are a bit slower. So you cat was woken by a hiss from the P waves, which arrive a bit before the earthquake that you can feel.

See https://manoa.hawaii.edu/exploringourfluidearth/physical/oce... to verify that there are two types of waves, and the P waves arrive first.

Re: My cat alerted me to a DDoS attack

#67

Post by btilly »

jmprspret wrote: post #52
exabrial wrote: post #51

We don’t have very many earthquakes in Kansas… but I remember the first/only one I felt. I was sound asleep when my Siamese woke me up by pawing my face… he then went and sat on the edge of the bed and growled aggressively (very out of character)… Not 30s later, things started shaking. No idea how he knew, but it was pretty wild. He passed away in 2020, still miss him.

Cats and dogs have been known to feel/sense earthquakes before we can! In the recent NYC ones there are videos of dogs howling before any of the tremors are noticeable by people. This is a common phenomena I believe.

Yes, it is common. See my sibling comment explaining it.

Re: My cat alerted me to a DDoS attack

#68

Post by toast0 »

kijin wrote: post #65
toast0 wrote: post #50

Earlier quoted context omitted.

There's application level DDoS, which you generally stop by not doing expensive work for clients that haven't done expensive work for you. Sometimes, easier said than done. And then there's volumetric DDoS. You can stop this by having more bandwidth than everyone else... but that's pretty hard and it makes you a potential attacker. Innovation here is in the form of using BGP to disseminate traffic filters. Null routi…

> Null routing is the MVP here: this IP is being attacked, so drop traffic to it as soon as possible. Oh, this poor guy is being DDoS'd, so we're going to make sure that their service remains denied. Null-routing the target IP helps everybody except the customer who is being attacked: namely, the network operator and their other customers. From the victim's point of view, it's just as frustrating as the attack itself…

> Null-routing the target IP helps everybody except the customer who is being attacked: namely, the network operator and their other customers. From the victim's point of view, it's just as frustrating as the attack itself, and gets in the way of troubleshooting.

If you're running on a single IP, yes. If you're running on multiple IPs, it's not that bad for the one that's being attacked to get its traffic dropped and everything else works. It's not great, but what are you going to do. If you've got enough traffic to overwhelm the inbound on the top of rack switch your box is on, you're not going to be able to really serve any of the good traffic anyway.

> With modern tooling and a bit of ML, it shouldn't be too hard for multiple ISPs to collectively determine which IPs are currently part of a large botnet. Drop packets from them, not to the victim. DoS the ones who are causing the DDoS.

There's usually way too many source addresses to do that, and anyway, routing infrastructure is geared towards looking at destination addresses, not source addresses. Also, each individual source doesn't look that bad --- if I've got 10,000 sources each sending me 1 Mbps of garbage, nobody is going to accept a block for only 1 mbps of sending, and yet, there's 10 Gbps of garbage arriving at my box; if I've got 10 Gbps or better connectivity, no big deal. But, if I'm only on 1 Gbps, I'm getting less than 1 in 10 of my inbound packets. I'd argue, if everything else has a big enough connection, it's probably still no big deal, it should be able to drop packets headed to me, as long as its upstream connection isn't filling up. But once abuse is causing contention that impacts others on my rack, it's probably time to null route.

If it's one of the big botnets with 100,000+ compromised systems, the individual bandwidth is even less. And if the botnet has significant ability to deliver spoofed traffic, source based filtering is meaningless. If it's reflected DDoS, I dunno --- there's value in hunting down the chargen services and removing them from the internet, but that's usually a lot more work.

OTOH, look on the bright side, if your outbound bandwidth is high and you get a lot of inbound DDoS, you may have roughly balanced your usage, and you may qualify for settlement free peering! (IMHO, this has got to be a major part of Cloudflare's business plan)

Re: My cat alerted me to a DDoS attack

#69

Post by earth2mars »

btilly wrote: post #66
exabrial wrote: post #51

We don’t have very many earthquakes in Kansas… but I remember the first/only one I felt. I was sound asleep when my Siamese woke me up by pawing my face… he then went and sat on the edge of the bed and growled aggressively (very out of character)… Not 30s later, things started shaking. No idea how he knew, but it was pretty wild. He passed away in 2020, still miss him.

I know how he knew. There are two types of sound in rock. P and S waves. P waves are pressure waves and go faster. S waves go side to side and are a bit slower. So you cat was woken by a hiss from the P waves, which arrive a bit before the earthquake that you can feel. See https://manoa.hawaii.edu/exploringourfluidearth/physical/oce... to verify that there are two types of waves, and the P waves arrive first.

This seems like a good sensor to build for early detection. Is that what the sensors do?

Re: My cat alerted me to a DDoS attack

#70

Post by hiddencost »

derefr wrote: post #45
macintux wrote: post #32

Earlier quoted context omitted.

One of my all-time favorite novels, Anansi Boys by Neil Gaiman, includes an anecdote: a crow's call wakes up someone who's sleeping outdoors, just as a large cat (a tiger, perhaps) is sneaking up on him. One character suggests the crow was trying to warn the man. Another posits the bird was bringing the sleeper to the tiger's attention so it could enjoy the scraps after the meal.

Odd that the most obvious hypothesis wasn't given: the crow was probably using its alarm call to warn other crows. Crows are social animals, who care about the fates of their "friends and acquaintances" — so they would do that. But also, on a tangent, there is a bird that does this kind of non-conspecific alarm calling the time as part of its food-gathering strategy: the African fork-tailed drongo. The drongo gives t…

It's called an allegory
Post reply on HN