4 ms·

The second part is the tricky part - I've gotten offers from DDoS mitigation providers that advertises that level of capacity, but how much it helps depends ent

by bobfunk 10y ago

The second part is the tricky part - I've gotten offers from DDoS mitigation providers that advertises that level of capacity, but how much it helps depends entirely on how much of that traffic they can scrub. If they only scrub half of that traffic, you're still getting a massive DDoS attack against your origin servers anyway. And the frustrating thing about buying DDoS mitigation is that you have absolutely no way of knowing how much traffic any DDoS mitigation service can actually scrub of a given attack before it hits you...

bogomipz 10y ago
Agreed. Even if they have the capacity if they can only identify a a portion of it as "interesting" and then pass the rest on to you they haven't solved the problem. And like you said you are still getting DDOS and paying dearly for scrubbing. I am curious if the traffic analysis at the scrubbing center is anything more than coarse grain I am assuming it is.
gbuk2013 10y ago
(Answer from one of my more knowledgeable colleagues since I work on supporting the infrastructure rather than DDoS mitigation itself): If the DDoS mitigation provider is doing their job, they will ingest all the traffic, scrub out the bad and return the good. While obvious, there are things a customer should know when entering into that arrangement: - Does the provider have the ingress capacity to absorb all the attack traffic? - Are their scrubbing centres peered with Tier 1 transit providers to reduce carrier congestion? - Do they have a policy on dropping traffic at certain volumes? - Do they charge you based on attack volume or clean traffic? - Do they have rate-limiting in place towards the customer to protect them from high-volume attacks while mitigations are optimized to catch all the attack traffic? Ensuring your provider has these technical and contractual terms in place will make sure they can actually offer value when under attack.

by bobfunk 10y ago

bogomipz 10y ago

Agreed. Even if they have the capacity if they can only identify a a portion of it as "interesting" and then pass the rest on to you they haven't solved the problem. And like you said you are still getting DDOS and paying dearly for scrubbing. I am curious if the traffic analysis at the scrubbing center is anything more than coarse grain I am assuming it is.

gbuk2013 10y ago

(Answer from one of my more knowledgeable colleagues since I work on supporting the infrastructure rather than DDoS mitigation itself): If the DDoS mitigation provider is doing their job, they will ingest all the traffic, scrub out the bad and return the good. While obvious, there are things a customer should know when entering into that arrangement: - Does the provider have the ingress capacity to absorb all the attack traffic? - Are their scrubbing centres peered with Tier 1 transit providers to reduce carrier congestion? - Do they have a policy on dropping traffic at certain volumes? - Do they charge you based on attack volume or clean traffic? - Do they have rate-limiting in place towards the customer to protect them from high-volume attacks while mitigations are optimized to catch all the attack traffic? Ensuring your provider has these technical and contractual terms in place will make sure they can actually offer value when under attack.