4 ms·
How big were the volumetric attacks that you saw that involved real IPs? The amplification factor is 1x for the real IPs. With NTP reflection and DNS reflection
by cft 11y ago
How big were the volumetric attacks that you saw that involved real IPs? The amplification factor is 1x for the real IPs. With NTP reflection and DNS reflection, you get 50x amplification, so 1Gbps botnet (trivial bandwidth) will cause a 50Gbps DDos (non-trivial bandwidth). This is why filtering is desirable.
- ryanlol 11y agoI saw a 500Mpps SYN flood just last week, followed by about 500Gbps of UDP packets. All from real IPs. Botnets have far surpassed amplification attacks at this point. >This is why filtering is desirable. Come up with a way to implement it that actually works and doesn't break legitimate use cases. spamsolutions.txt is starting to seem relevant here.
- cft 11y agoWe work with Verisign that specializes in DDoS mitigations, they have state of the art scrubbing centers on four continents and they are leading mitigation provider to the banks and schools. They told me they almost never see anything above 300gig. You must be special.
- ryanlol 11y agoYes, I would imagine I have far more experience dealing with large attacks than verisign. >they are leading mitigation provider to the banks and schools :)