4 ms·
I don't know, but all traffic to GCE is routed through Google's frontend, which provides in-built DDoS protections.
by thrownaway2424 11y ago
I don't know, but all traffic to GCE is routed through Google's frontend, which provides in-built DDoS protections.
- deleted 11y ago[deleted]
- scurvy 11y agoI'd imagine they use VRF's to quickly segment the traffic after ingress. Google.com might have DDoS protection, but I'm wary that it extends to GCE. I've read about Google Andromeda, but there's no real meat in any article about DDoS mitigation.
- skj 11y agoIt does extend to GCE, to an extent. The reason for this is that if someone is DDOSing your GCE VMs, they're going to be affecting the network performance of unrelated projects. So, Google has to provide some protection so that, at a minimum, other customers are not affected.
- thrownaway2424 11y agoThis document specifically claims that "All traffic is routed through custom GFE (Google Front End) servers to detect and stop malicious requests and Distributed Denial of Service (DDoS) attacks." https://cloud.google.com/security/whitepaper https://cloud.google.com/security/whitepaper
- scurvy 11y agoHow though? There's remarkably little information in there for being a whitepaper. If all they do is drop Christmas-tree packets and bogus UDP/ICMP traffic, that's not much in the way of protection. I'd like to see exactly what/how they're doing. How do they know what traffic is malicious? Do you get a control panel to block certain L7 traffic? What L7 inspectors do they support? Sorry, but I'm not buying it.
- workitout 11y agoSo...Google can stop all DDOS's? Everyone should dump AWS, Linode, Cloudflare, etc. and go to Google for their VMs then.