All of this +1000000 We've found that the more distributed the attack, the easier it is to defend. If it's truly distributed in nature, you can help spread the

All of this +1000000 We've found that the more distributed the attack, the easier it is to defend. If it's truly distributed in nature, you can help spread the attack surface through things like anycasting if you have you multiple datacenters. Also, the more distributed it is, the more likely it is to be spread out among your different transit links. The less distributed, the more likely it will hit a single transit link and take that out. You might have 10 different transit providers with 10gig links. 100 gbps of transit is nothing to scoff at for small companies. You can have an 11 gbps DDoS that makes you unreachable for large numbers of people if that 11 gbps lands on a single link (due to AS path length, MED, preference, etc). People at your company are asking you "WTF network dude I thought we had 100gigs?" You can then try to mess with padding route advertisements, but that just messes more with legit traffic than attack traffic. Same thing with aggregated ethernet links (LACP/802.3ad). You might be 10x10gigs with a single provider, giving you a "100gbps pipe" but if it comes from a few sources all going after multiple destinations, a single link in that bundle could easily be overwhelmed. Then you start playing with the hashing algorithm, but it never really solves the problem. The only solution right now is to get a bigger boat and get 100gbps links. It's very expensive, not every transit provider offers that to every customer, lol if you run Cisco, and even then it's honestly not big enough. Overrunning 100gbps interfaces with DoS traffic isn't very hard to do if it comes from a few sources. One must realize that not every country has the network diversity that the US does. In a lot of places, there are only a handful of AS networks that actually provide transit out of the country. This means that an entire country's network traffic can flow over a few (or often times one) providers. This turns into a giant laser that blows out single provider or single LACP member links. China is a great example of this. There are really only 2 AS that provide egress from China. The third is reserved for high ranking party officials and ultra, megarich people who pay the bribes. Korea (and all the broadband that HN people drool over) has a few more transit networks, but not many. Korea is a potent DDoS cannon. As far as content goes it's by far mostly political and religious (> 70%). The remaining is the usual junk e-commerce, gambling, whistleblower sites, etc. The lack of communication between transit providers and even between their customers is astoundingly bad. IMHO, there are good transit providers that will help you (NTT, Telia, XO) but most will tell you to go pound sand or not do anything until it starts disrupting their own network (Level3, Cogent, GTT, VZ, AT&T).