How to stop a DDoS attack
blog.fastmail.com
How to stop a DDoS attack
1–10 of 29 posts
Re: How to stop a DDoS attack
#2tl:dr Used cloudflare for DNS and Level3/Blacklotus for network filtering.
In DDoS attacks you have three models: On-Prem: Buy hardware and big fat internet pipes to filter traffic (expensive / time \ resrouce intensive) Hybrid: On-Prem devices that can mitigate X/Mbps and then starts announcing your routes after X to their cloud scrubbing centers which can filter it at a much higher capacity (best option) Cloud: Full on filtering by a provider where all your traffic goes through their scrubbing centers full time (usually adds latency, extremely expensive)
The hybrid model is the best and what most companies are going to as it allows you to filter smaller attacks out with little cost as well as scaling up to large 100 Gb/s+ attacks without having to buy massive amounts of hardware/transit.
Re: How to stop a DDoS attack
#3A article I wrote on attempting to do this yourself (without cloudflare/other services) is here: http://harknesslabs.com/post/38104429912/fighting-spoofed-sy...
Its much easier to use cloudflare, but sometimes it just not possible to use them (it wasnt for us, due to needing hardcoded IPs in our DC)
Re: How to stop a DDoS attack
#4[deleted]
Re: How to stop a DDoS attack
#5tl:dr Used cloudflare for DNS and Level3/Blacklotus for network filtering. In DDoS attacks you have three models: On-Prem: Buy hardware and big fat internet pipes to filter traffic (expensive / time \ resrouce intensive) Hybrid: On-Prem devices that can mitigate X/Mbps and then starts announcing your routes after X to their cloud scrubbing centers which can filter it at a much higher capacity (best option) Cloud: Ful…
How do you define "extremely expensive"? CloudFlare's Business Plan ($200/mo) includes advanced DDoS mitigation: https://www.cloudflare.com/ddos/.
Also, due to caching of assets in PoPs close to end-users (and TLS termination at the edge), the site is often much faster than without DDoS protection.
Re: How to stop a DDoS attack
#6tl:dr Used cloudflare for DNS and Level3/Blacklotus for network filtering. In DDoS attacks you have three models: On-Prem: Buy hardware and big fat internet pipes to filter traffic (expensive / time \ resrouce intensive) Hybrid: On-Prem devices that can mitigate X/Mbps and then starts announcing your routes after X to their cloud scrubbing centers which can filter it at a much higher capacity (best option) Cloud: Ful…
How do you define "extremely expensive"? CloudFlare's Business Plan ($200/mo) includes advanced DDoS mitigation: https://www.cloudflare.com/ddos/ . Also, due to caching of assets in PoPs close to end-users (and TLS termination at the edge), the site is often much faster than without DDoS protection.
Cloudflare is a WAF/Proxy that can handle DDoS, it isn't a DDoS specific product. If your actual network space is getting hit (e.g. 8.8.8.8) cloudflare will not help you.
Re: How to stop a DDoS attack
#7tl:dr Used cloudflare for DNS and Level3/Blacklotus for network filtering. In DDoS attacks you have three models: On-Prem: Buy hardware and big fat internet pipes to filter traffic (expensive / time \ resrouce intensive) Hybrid: On-Prem devices that can mitigate X/Mbps and then starts announcing your routes after X to their cloud scrubbing centers which can filter it at a much higher capacity (best option) Cloud: Ful…
How do you define "extremely expensive"? CloudFlare's Business Plan ($200/mo) includes advanced DDoS mitigation: https://www.cloudflare.com/ddos/ . Also, due to caching of assets in PoPs close to end-users (and TLS termination at the edge), the site is often much faster than without DDoS protection.
Well CloudFlare works if you're mainly worried about responding to HTTP(S) traffic. In this the company was responsible SMTP, POP, etc which CloudFlare doesn't really handle.
Additionally as is mentioned in the article - If the attacker knows your public IP address they can easily bypass CloudFlare by simply directing the traffic to you and not CF.
Re: How to stop a DDoS attack
#8A article I wrote on attempting to do this yourself (without cloudflare/other services) is here: http://harknesslabs.com/post/38104429912/fighting-spoofed-sy... Its much easier to use cloudflare, but sometimes it just not possible to use them (it wasnt for us, due to needing hardcoded IPs in our DC)
Cloudflare lets you announce your own IP space through their serivce on non-personal plans don't they?
Re: How to stop a DDoS attack
#9A article I wrote on attempting to do this yourself (without cloudflare/other services) is here: http://harknesslabs.com/post/38104429912/fighting-spoofed-sy... Its much easier to use cloudflare, but sometimes it just not possible to use them (it wasnt for us, due to needing hardcoded IPs in our DC)
Cloudflare lets you announce your own IP space through their serivce on non-personal plans don't they?
Not that I'm aware of. You're thinking of GRE tunnel DDoS mitigation providers like staminus and blacklotus.
Re: How to stop a DDoS attack
#10tl:dr Used cloudflare for DNS and Level3/Blacklotus for network filtering. In DDoS attacks you have three models: On-Prem: Buy hardware and big fat internet pipes to filter traffic (expensive / time \ resrouce intensive) Hybrid: On-Prem devices that can mitigate X/Mbps and then starts announcing your routes after X to their cloud scrubbing centers which can filter it at a much higher capacity (best option) Cloud: Ful…
How do you define "extremely expensive"? CloudFlare's Business Plan ($200/mo) includes advanced DDoS mitigation: https://www.cloudflare.com/ddos/ . Also, due to caching of assets in PoPs close to end-users (and TLS termination at the edge), the site is often much faster than without DDoS protection.
How do you define "extremely expensive"?
Always-on scrubbing will typically run you $10k provisioning and $6-9k monthly for 100mbps of clean bandwidth from most of the providers.