5 ms·

If you have a fat enough pipe, get a Peakflow-like device. They can usually support a few terabit of traffic (depending on if you're doing simple white/blacklis

by chomp 8y ago

If you have a fat enough pipe, get a Peakflow-like device. They can usually support a few terabit of traffic (depending on if you're doing simple white/blacklists, or layer 7 mitigation). Might not work against the IoT bots or a sufficiently sophisticated attack as we all saw with the Dyn DDoS, but if you have a good peering agreement they should allow you to announce /32 (IPv4) nullroutes over BGP, which will take care of anything that saturates your uplink, and you can scrub the rest. If you don't have your own datacenter space, your options are limited. You can use Cloudflare, or serve your content over CDN.

leowoo91 8y ago
Kudos for anything could be purchased but beyond layer7 looks harder, I understand.
- chomp 8y ago
  We use these (not affiliated other than just being a customer): https://www.netscout.com/product/arbor-threat-mitigation-system https://www.netscout.com/product/arbor-threat-mitigation-sys... But any DDoS mitigation appliance should be similar. Layer 7 is difficult because it's expensive to do on a scrubbing device, but also because a sufficiently sophisticated DDoS can look like normal traffic. Cloudflare can stop HTTP layer 7 stuff, but things like DNS protocol? You can't easily tell what's malicious and what's not (However, I've seen some dumb DDoS's where it's things like querying for XYZXYZXYZ...(lots of characters).org, or DNS reflection attacks, those are easy to filter). In those cases, it's really just a matter of overprovisioning your service, or suffer until the attackers run out of money or get bored.
  - leowoo91 8y ago
    "run out of money or get bored" - made my day, this should also apply to the site owner. I bet there are even companies who are not aware that they are under attack since years (as loss is trivial yet)
kkirsche 8y ago
I’d recommend Radware instead of Arbor personally. But both have pros and cons

by chomp 8y ago

leowoo91 8y ago

Kudos for anything could be purchased but beyond layer7 looks harder, I understand.

chomp 8y ago
We use these (not affiliated other than just being a customer): https://www.netscout.com/product/arbor-threat-mitigation-system https://www.netscout.com/product/arbor-threat-mitigation-sys... But any DDoS mitigation appliance should be similar. Layer 7 is difficult because it's expensive to do on a scrubbing device, but also because a sufficiently sophisticated DDoS can look like normal traffic. Cloudflare can stop HTTP layer 7 stuff, but things like DNS protocol? You can't easily tell what's malicious and what's not (However, I've seen some dumb DDoS's where it's things like querying for XYZXYZXYZ...(lots of characters).org, or DNS reflection attacks, those are easy to filter). In those cases, it's really just a matter of overprovisioning your service, or suffer until the attackers run out of money or get bored.
- leowoo91 8y ago
  "run out of money or get bored" - made my day, this should also apply to the site owner. I bet there are even companies who are not aware that they are under attack since years (as loss is trivial yet)

kkirsche 8y ago

I’d recommend Radware instead of Arbor personally. But both have pros and cons