5 ms·
>so it's the end of blocking not really, ISP gets dropped, goes into panic mode and FINALLY fixes its own shit, finds the endpoint originating illegitimate tra
by rasz_pl 10y ago
>so it's the end of blocking
not really, ISP gets dropped, goes into panic mode and FINALLY fixes its own shit, finds the endpoint originating illegitimate traffic and blocks it, reports back upstream about the fix, gets reinstated, finally starts monitoring for ip spoofing.
- pmontra 10y agoAnother problem: video service A runs on server farm X which blocks IPs of ISPs known for being the origin of DOSes. Video service B runs on server farm Y which doesn't. Who makes more money between the two video services and between the two server farms? As long as Y is not hit, I bet on B and Y. Furthermore, but I'm a noob at this, isn't the upstream Internet provider that should block traffic instead of the server farm? Otherwise it would get all the load anyway. Am I wrong? (probably yes)
- petre 10y agoJust filter the BGP AS of the offending ISP. That's how it should be done. Block the whole ISP at AS level. Maybe automated time based threshold filters w/ distributed banlist. Just like fail2ban but for BGP and with a distributed banlist (AS + timestamp of exceeded threshold).