4 ms·

What DDoS protection does AWS provide? The only thing mentions on their webpage is autoscaling, more nodes, etc. In other words, AWS' DDoS protection strategy i

by scurvy 11y ago

What DDoS protection does AWS provide? The only thing mentions on their webpage is autoscaling, more nodes, etc. In other words, AWS' DDoS protection strategy is to open up your wallet. About 6 months ago they did hire Jeff from BlackLotus. Given that timeline, I'd expect them to announce some sort of DDoS protection offering in the next few quarters. Edit to be more specific: AWS gets hit with a lot of DDoS attacks. While all of AWS isn't unreachable during an attack, parts of it are. It's so large that you might not notice, but parts are unreachable. AWS/GCE size only makes it less noticeable, but they have no customer facing DDoS protection offerings. Their only offering is to buy more of their services. These providers don't have magical 1000000gbps links. They're regular 100gbps links (or 100gbps LACP channels) that can get overrun in large enough attacks.

gist 11y ago
"I'd expect them to announce some sort of DDoS protection offering in the next few quarters." It will be very interesting to see how cost effective that protection actually is and what they charge for it. Nice profit center off of FUD.
- scurvy 11y ago
  If they price it like cheap insurance, they will make a lot of money and offer a worthwhile service. Pay them a low monthly rate (X) to have the service active and then pay hourly at Y rate during an attack. You can play with X and Y to maximize your monthly revenue while still offering a cheap (but very valuable) service that retains your customers.
thrownaway2424 11y ago
I don't know, but all traffic to GCE is routed through Google's frontend, which provides in-built DDoS protections.
- deleted 11y ago
  [deleted]
- scurvy 11y ago
  I'd imagine they use VRF's to quickly segment the traffic after ingress. Google.com might have DDoS protection, but I'm wary that it extends to GCE. I've read about Google Andromeda, but there's no real meat in any article about DDoS mitigation.
  - skj 11y ago
    It does extend to GCE, to an extent. The reason for this is that if someone is DDOSing your GCE VMs, they're going to be affecting the network performance of unrelated projects. So, Google has to provide some protection so that, at a minimum, other customers are not affected.
  - thrownaway2424 11y ago
    This document specifically claims that "All traffic is routed through custom GFE (Google Front End) servers to detect and stop malicious requests and Distributed Denial of Service (DDoS) attacks." https://cloud.google.com/security/whitepaper https://cloud.google.com/security/whitepaper
    - scurvy 11y ago
      How though? There's remarkably little information in there for being a whitepaper. If all they do is drop Christmas-tree packets and bogus UDP/ICMP traffic, that's not much in the way of protection. I'd like to see exactly what/how they're doing. How do they know what traffic is malicious? Do you get a control panel to block certain L7 traffic? What L7 inspectors do they support? Sorry, but I'm not buying it.
- workitout 11y ago
  So...Google can stop all DDOS's? Everyone should dump AWS, Linode, Cloudflare, etc. and go to Google for their VMs then.
justinholmes 11y ago
Actually "Amazon CloudFront also has filtering capabilities to ensure that only valid TCP connections and HTTP requests are made while dropping invalid requests. This takes the burden of handling invalid traffic (commonly used in UDP floods, SYN floods, and slow reads) off your origin." and "By using multiple PoPs, Amazon CloudFront has the inherent ability to help mitigate against both infrastructure and some application layer DDoS attacks by dispersing the traffic across multiple locations." source: https://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June2015.pdf https://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June20...
- nacs 11y ago
  Amazon Cloudfront is a CDN. A significant portion of a CDNs job is to be highly redundant and to handle DDoS. If you're comparing Amazon's offering to Linode, you should really compare to the protection Amazon offers on EC2 and similar VPS-like products.
  - justinholmes 11y ago
    I was merely answering the question "What DDoS protection does AWS provide?". Normally you wouldn't expose a EC2 instance without putting cloudfront, elbs in front of it and locking down incoming traffic to cloudfront IPs.
ivan_ah 11y ago
> What DDoS protection does AWS provide? > I've got no internal knowledge of how AWS operates, but I once went too far when load testing a new AWS machine (in terms of reqs/sec), and the traffic started getting dropped somewhere before reaching the box. Not sure if it was an elastic ip or behind an ELB, but I found it interesting.

by scurvy 11y ago

gist 11y ago

"I'd expect them to announce some sort of DDoS protection offering in the next few quarters." It will be very interesting to see how cost effective that protection actually is and what they charge for it. Nice profit center off of FUD.

scurvy 11y ago
If they price it like cheap insurance, they will make a lot of money and offer a worthwhile service. Pay them a low monthly rate (X) to have the service active and then pay hourly at Y rate during an attack. You can play with X and Y to maximize your monthly revenue while still offering a cheap (but very valuable) service that retains your customers.

thrownaway2424 11y ago

I don't know, but all traffic to GCE is routed through Google's frontend, which provides in-built DDoS protections.

deleted 11y ago
[deleted]
scurvy 11y ago
I'd imagine they use VRF's to quickly segment the traffic after ingress. Google.com might have DDoS protection, but I'm wary that it extends to GCE. I've read about Google Andromeda, but there's no real meat in any article about DDoS mitigation.
- skj 11y ago
  It does extend to GCE, to an extent. The reason for this is that if someone is DDOSing your GCE VMs, they're going to be affecting the network performance of unrelated projects. So, Google has to provide some protection so that, at a minimum, other customers are not affected.
- thrownaway2424 11y ago
  This document specifically claims that "All traffic is routed through custom GFE (Google Front End) servers to detect and stop malicious requests and Distributed Denial of Service (DDoS) attacks." https://cloud.google.com/security/whitepaper https://cloud.google.com/security/whitepaper
  - scurvy 11y ago
    How though? There's remarkably little information in there for being a whitepaper. If all they do is drop Christmas-tree packets and bogus UDP/ICMP traffic, that's not much in the way of protection. I'd like to see exactly what/how they're doing. How do they know what traffic is malicious? Do you get a control panel to block certain L7 traffic? What L7 inspectors do they support? Sorry, but I'm not buying it.
workitout 11y ago
So...Google can stop all DDOS's? Everyone should dump AWS, Linode, Cloudflare, etc. and go to Google for their VMs then.

justinholmes 11y ago

Actually "Amazon CloudFront also has filtering capabilities to ensure that only valid TCP connections and HTTP requests are made while dropping invalid requests. This takes the burden of handling invalid traffic (commonly used in UDP floods, SYN floods, and slow reads) off your origin." and "By using multiple PoPs, Amazon CloudFront has the inherent ability to help mitigate against both infrastructure and some application layer DDoS attacks by dispersing the traffic across multiple locations." source: https://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June2015.pdf https://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June20...

nacs 11y ago
Amazon Cloudfront is a CDN. A significant portion of a CDNs job is to be highly redundant and to handle DDoS. If you're comparing Amazon's offering to Linode, you should really compare to the protection Amazon offers on EC2 and similar VPS-like products.
- justinholmes 11y ago
  I was merely answering the question "What DDoS protection does AWS provide?". Normally you wouldn't expose a EC2 instance without putting cloudfront, elbs in front of it and locking down incoming traffic to cloudfront IPs.

ivan_ah 11y ago

> What DDoS protection does AWS provide? > I've got no internal knowledge of how AWS operates, but I once went too far when load testing a new AWS machine (in terms of reqs/sec), and the traffic started getting dropped somewhere before reaching the box. Not sure if it was an elastic ip or behind an ELB, but I found it interesting.