3 ms·

Usually it is and according to linode it is so in this case too. Edit: Not sure what alternate reality the downvoter lives in, but vast majority of the attacks

by ryanlol 10y ago

Usually it is and according to linode it is so in this case too. Edit: Not sure what alternate reality the downvoter lives in, but vast majority of the attacks these days are just "dumb" packet floods or even easier to filter reflection attacks. (Linode clarified this to be a mix of dns and ntp traffic on IRC) But hey, go on and find me a layer 7 attack that'll take down entire datacenters :)

markonen 10y ago
One difference between Linode and providers like AWS is that the typical deployment architecture on Linode still exposes customer VPSes to direct L3 internet traffic whereas on a best-practices AWS deployment that is almost never the case. I'd imagine it's easier to filter out bogus L3 traffic when the vast majority of your target IP space comes with explicit configuration as to what sort of L7 application traffic is acceptable.
- acul 10y ago
  You can't really compare aws to linode. Aws have hundreds of Gb of transit bandwidth so they can easily absorbe big attacks. They also have a backbone network which allows them to increase the surface area of attacks which increases the available bandwidth. It's actually not that easy to Filter "bogus" traffic. In the hosting world, especially cloud, you have thousands of customers doing whatever they want. Who knows what is bogus or not. And even if you can filter it at your edge routers your transit links are still going to be getting slammed. The filtering needs to be done upstream in the ISP network. This is usually a manual process as no one supports BGP FlowSpec at the moment. RTBH is the best way to defend if you don't have the bandwidth to absorbe.
  - user5994461 10y ago
    Block DNS/NTP in the security group => Problem solved (unless it only filters traffic at the instance input) Put an ELB in front of the services, the ELB only listening to port 80/443, roll out the ELB publicly, roll out new instances only accessible privately, kill old instances being DDoSed => Problem solved => Repeat for all other services, they shouldn't be publicly accessible in the first place. Ain't saying it's easy but there are some options to help mitigate the attack.
- acul 10y ago
  You can't really compare aws to linode. Aws have hundreds of Gb of transit bandwidth so they can easily absorbe big attacks. They also have a backbone network which allows the to increase the surface area of attacks which increases the available bandwidth It's actually not that easy to Filter "bogus" traffic. In the hosting world, especially cloud, you have thousands of customers doing whatever they want. Who knows that is bogus or not. And even if you can filter it at your edge routers your transit links are still going to be getting slammed. The filtering needs to be done upstream in the ISP network. This is usually a manual process as no one supports BGP FlowSpec at the moment. RTBH is the best way to defend if you don't have the bandwidth to absorbe.
packetized 10y ago
Stolen credit cards are cheap, and they buy a lot of GCE/AWS resources. source: been on the receiving end of a several hundred gigabit L7/HTTP DDoS from the aforementioned providers.

by ryanlol 10y ago

markonen 10y ago

One difference between Linode and providers like AWS is that the typical deployment architecture on Linode still exposes customer VPSes to direct L3 internet traffic whereas on a best-practices AWS deployment that is almost never the case. I'd imagine it's easier to filter out bogus L3 traffic when the vast majority of your target IP space comes with explicit configuration as to what sort of L7 application traffic is acceptable.

acul 10y ago
You can't really compare aws to linode. Aws have hundreds of Gb of transit bandwidth so they can easily absorbe big attacks. They also have a backbone network which allows them to increase the surface area of attacks which increases the available bandwidth. It's actually not that easy to Filter "bogus" traffic. In the hosting world, especially cloud, you have thousands of customers doing whatever they want. Who knows what is bogus or not. And even if you can filter it at your edge routers your transit links are still going to be getting slammed. The filtering needs to be done upstream in the ISP network. This is usually a manual process as no one supports BGP FlowSpec at the moment. RTBH is the best way to defend if you don't have the bandwidth to absorbe.
- user5994461 10y ago
  Block DNS/NTP in the security group => Problem solved (unless it only filters traffic at the instance input) Put an ELB in front of the services, the ELB only listening to port 80/443, roll out the ELB publicly, roll out new instances only accessible privately, kill old instances being DDoSed => Problem solved => Repeat for all other services, they shouldn't be publicly accessible in the first place. Ain't saying it's easy but there are some options to help mitigate the attack.
acul 10y ago
You can't really compare aws to linode. Aws have hundreds of Gb of transit bandwidth so they can easily absorbe big attacks. They also have a backbone network which allows the to increase the surface area of attacks which increases the available bandwidth It's actually not that easy to Filter "bogus" traffic. In the hosting world, especially cloud, you have thousands of customers doing whatever they want. Who knows that is bogus or not. And even if you can filter it at your edge routers your transit links are still going to be getting slammed. The filtering needs to be done upstream in the ISP network. This is usually a manual process as no one supports BGP FlowSpec at the moment. RTBH is the best way to defend if you don't have the bandwidth to absorbe.

packetized 10y ago

Stolen credit cards are cheap, and they buy a lot of GCE/AWS resources. source: been on the receiving end of a several hundred gigabit L7/HTTP DDoS from the aforementioned providers.