5 ms·

Why do we always hear of DDoS attacks to mail services, but never to Gmail? are they more DDoS resistant? are the attacks not public?

by copperx 11y ago

livejamie 11y ago
I imagine it's a lot easier to DDoS a smaller company than it would to DDoS Google?
brongondwana 11y ago
It's mostly a matter of scale. Google are big enough and their internet connections are big enough that they can absorb a regular-sized DDoS without breaking a sweat.
- mathrawka 11y ago
  I bet the amount of traffic GMail handles would be considered a DoS if it was redirected to one of the smaller mail sites.
  - brongondwana 11y ago
    Back in the day (/shakes fist at cloud) it was the slashdot effect. Rapid spikes in popularity overloading systems. We certainly couldn't handle scaling up to gmail size all at once. Maybe over a couple of years. Of course our growth strategy is quality (people willing to pay for a good service quid-pro-quo) over quantity (free service and monetise later via ads/analytics), so we've had a slow steady growth for the entire 15 years we've been operating rather than the viral growth and sell-out/pivot that unicorns are known for.
    - jorangreef 11y ago
      Quality and quantity are not necessarily opposed. People like Ford and Edison used to believe that you could get more quality as volume increased. And in fact, if you wanted to increase quality, then you had to increase volume.
      - brongondwana 11y ago
        There's an "average size of humans has increased" joke in here somewhere - both height and girth. And I do agree to a point. We're very happy to have increasing numbers of users so we can afford to do things like contracting the excellent developer who's working on JMAP support for Calendars in Cyrus IMAP at the moment, as well as hiring people to add new features or improve existing ones. We do try to stay at a point where we can run comfortably on 50% of our hardware, so we can shut down half our machines at once for maintenance. Redundancy certainly helps - we've blogged a few times about how good it is to be able to shut down any one machine with only a few minutes' warning to move active users off it. I'm certainly looking forward to spending time again on what I wanted to be doing (Cyrus IMAPd improvements at the moment) rather than battling a DDoS!
  - thrownaway2424 11y ago
    Indeed, Gmail maintains extensive protections against peers being DoS'd by Gmail. The number of connections and the rate of mail is closely controlled, because a lot of sites can be taken down just by opening a few TCP connections at once (what are they using, inetd on SunOS?).
dgemm 11y ago
Because Google is large enough to - Build defenses against DDoS into its networks - Have large enough capacity that such attacks are less effective anyway
detaro 11y ago
One would assume DDoSing the biggest service around, run by a company that has experience running giant internet facing services, a lot of security experience and tons of cash would be a lot harder than a provider with in comparison small connectivity and a small number of locations, yes. Pure size helps, + if you are at the scale of Google your upstreams probably have more interest in helping you if it were necessary. It would be interesting to see how often people try though.
- giancarlostoro 11y ago
  Yeah, when you run websites that everyone accross the world hits at any given second all at once, I think a DDoS might tickle it a bit, but it would take a pretty massive botnet possibly, maybe a nice chunk of legitimate Google visitors to affect Google?
- PuffinBlue 11y ago
  It may even been simpler than that and they might not even need 'upstream' any more. They may not even have upstream for many things, given their scale now, they probably just peer to Tier 1, if they even need that any more! (they were actually just as big as Tier 1 folks back in 2010![0]. Google has been buying up 'dark fiber' for years and has thousands of miles of cable connecting their data centers. They can certainly handle petabit/s levels of traffic inside the datacenter[1], it's not that much of a stretch to think that they can handle double digit terabit/s through their collective external fiber links. Also, just think about their normal level of operation. Even just all the Android devices feeding data back and forth, let alone analytics, maps, gmail, search etc etc. They've got 36 data centers and co-locate in more than 60 public exchanges (and that was in 2010!), not to mention the Google Global Cache (GGC) servers inside consumer networks across the globe. Their scale is ridiculously large. I suspect that they actually can't be DDoS'd in the normal 'chuck traffic at them' sense. [0] http://www.theregister.co.uk/2010/03/17/the_size_of_the_googlenet/ http://www.theregister.co.uk/2010/03/17/the_size_of_the_goog... [1] http://googlecloudplatform.blogspot.co.uk/2015/06/A-Look-Inside-Googles-Data-Center-Networks.html http://googlecloudplatform.blogspot.co.uk/2015/06/A-Look-Ins...
pki 11y ago
The attack on Gmail would likely not even be a single percent of its traffic every minute.
toast0 11y ago
At Google's scale, all connections are symmetrical, and they send a lot of traffic than they receive. So they have a huge amount of incoming bandwidth available to absorb a volumetric attack. They also have a skilled traffic engineering team who can adjust routing or implement filtering at the edge of their network. And a skilled security team who can react to trickier attacks (bogus, but well formed requests).
- corobo 11y ago
  Speaking of routing, I don't know for sure but I'd imagine most if not all of Google's services are on anycast IPs - meaning each node taking part in the DDoS would have its attack routed to its nearest Google DC rather than any central target. On a global scale this would mean that the one big DDoS you'd expect to see effectively gets split into many tiny DDoSes, which Google can handle using methods mentioned in the other responses in this thread.
jakejake 11y ago
You could say that Google is constantly under a DDoS attack because the amount of normal traffic they get far exceeds the amount that would constitute an attack for an average business site.
ori_b 11y ago
Google has a lot more bandwidth to absorb DDOS. You might as well try to flood the ocean.

Why do we always hear of DDoS attacks to mail services, but never to Gmail? are they more DDoS resistant? are the attacks not public?

by copperx 11y ago

Why do we always hear of DDoS attacks to mail services, but never to Gmail? are they more DDoS resistant? are the attacks not public?

livejamie 11y ago

I imagine it's a lot easier to DDoS a smaller company than it would to DDoS Google?

brongondwana 11y ago

It's mostly a matter of scale. Google are big enough and their internet connections are big enough that they can absorb a regular-sized DDoS without breaking a sweat.

mathrawka 11y ago
I bet the amount of traffic GMail handles would be considered a DoS if it was redirected to one of the smaller mail sites.
- brongondwana 11y ago
  Back in the day (/shakes fist at cloud) it was the slashdot effect. Rapid spikes in popularity overloading systems. We certainly couldn't handle scaling up to gmail size all at once. Maybe over a couple of years. Of course our growth strategy is quality (people willing to pay for a good service quid-pro-quo) over quantity (free service and monetise later via ads/analytics), so we've had a slow steady growth for the entire 15 years we've been operating rather than the viral growth and sell-out/pivot that unicorns are known for.
  - jorangreef 11y ago
    Quality and quantity are not necessarily opposed. People like Ford and Edison used to believe that you could get more quality as volume increased. And in fact, if you wanted to increase quality, then you had to increase volume.
    - brongondwana 11y ago
      There's an "average size of humans has increased" joke in here somewhere - both height and girth. And I do agree to a point. We're very happy to have increasing numbers of users so we can afford to do things like contracting the excellent developer who's working on JMAP support for Calendars in Cyrus IMAP at the moment, as well as hiring people to add new features or improve existing ones. We do try to stay at a point where we can run comfortably on 50% of our hardware, so we can shut down half our machines at once for maintenance. Redundancy certainly helps - we've blogged a few times about how good it is to be able to shut down any one machine with only a few minutes' warning to move active users off it. I'm certainly looking forward to spending time again on what I wanted to be doing (Cyrus IMAPd improvements at the moment) rather than battling a DDoS!
- thrownaway2424 11y ago
  Indeed, Gmail maintains extensive protections against peers being DoS'd by Gmail. The number of connections and the rate of mail is closely controlled, because a lot of sites can be taken down just by opening a few TCP connections at once (what are they using, inetd on SunOS?).

dgemm 11y ago

Because Google is large enough to - Build defenses against DDoS into its networks - Have large enough capacity that such attacks are less effective anyway

detaro 11y ago

One would assume DDoSing the biggest service around, run by a company that has experience running giant internet facing services, a lot of security experience and tons of cash would be a lot harder than a provider with in comparison small connectivity and a small number of locations, yes. Pure size helps, + if you are at the scale of Google your upstreams probably have more interest in helping you if it were necessary. It would be interesting to see how often people try though.

giancarlostoro 11y ago
Yeah, when you run websites that everyone accross the world hits at any given second all at once, I think a DDoS might tickle it a bit, but it would take a pretty massive botnet possibly, maybe a nice chunk of legitimate Google visitors to affect Google?
PuffinBlue 11y ago
It may even been simpler than that and they might not even need 'upstream' any more. They may not even have upstream for many things, given their scale now, they probably just peer to Tier 1, if they even need that any more! (they were actually just as big as Tier 1 folks back in 2010![0]. Google has been buying up 'dark fiber' for years and has thousands of miles of cable connecting their data centers. They can certainly handle petabit/s levels of traffic inside the datacenter[1], it's not that much of a stretch to think that they can handle double digit terabit/s through their collective external fiber links. Also, just think about their normal level of operation. Even just all the Android devices feeding data back and forth, let alone analytics, maps, gmail, search etc etc. They've got 36 data centers and co-locate in more than 60 public exchanges (and that was in 2010!), not to mention the Google Global Cache (GGC) servers inside consumer networks across the globe. Their scale is ridiculously large. I suspect that they actually can't be DDoS'd in the normal 'chuck traffic at them' sense. [0] http://www.theregister.co.uk/2010/03/17/the_size_of_the_googlenet/ http://www.theregister.co.uk/2010/03/17/the_size_of_the_goog... [1] http://googlecloudplatform.blogspot.co.uk/2015/06/A-Look-Inside-Googles-Data-Center-Networks.html http://googlecloudplatform.blogspot.co.uk/2015/06/A-Look-Ins...

pki 11y ago

The attack on Gmail would likely not even be a single percent of its traffic every minute.

toast0 11y ago

At Google's scale, all connections are symmetrical, and they send a lot of traffic than they receive. So they have a huge amount of incoming bandwidth available to absorb a volumetric attack. They also have a skilled traffic engineering team who can adjust routing or implement filtering at the edge of their network. And a skilled security team who can react to trickier attacks (bogus, but well formed requests).

corobo 11y ago
Speaking of routing, I don't know for sure but I'd imagine most if not all of Google's services are on anycast IPs - meaning each node taking part in the DDoS would have its attack routed to its nearest Google DC rather than any central target. On a global scale this would mean that the one big DDoS you'd expect to see effectively gets split into many tiny DDoSes, which Google can handle using methods mentioned in the other responses in this thread.

jakejake 11y ago

You could say that Google is constantly under a DDoS attack because the amount of normal traffic they get far exceeds the amount that would constitute an attack for an average business site.

ori_b 11y ago

Google has a lot more bandwidth to absorb DDOS. You might as well try to flood the ocean.