5 ms·
It looks like it's hosted in the US (ec2-184-72-37-90.us-west-1.compute.amazonaws.com). Also, the front end proxy is doing some heavy filtering to weed out the
by jjoe 16y ago
It looks like it's hosted in the US (ec2-184-72-37-90.us-west-1.compute.amazonaws.com). Also, the front end proxy is doing some heavy filtering to weed out the cheap hit-and-run nodes participating in the DDoS but still accepts legitimate browser-based requests (persistent). Notice how a Reset (R) is sent right away on the first try:
08:57:41.211436 IP managed.unixy.net.49467 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: S 1398247905:1398247905(0) win 5840 <mss 1460,sackOK,timestamp 2031832550 0,nop,wscale 7>
08:57:41.264403 IP ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http > managed.unixy.net.49467: S 1288073904:1288073904(0) ack 1398247906 win 16384 <mss 1460>
08:57:41.264424 IP managed.unixy.net.49467 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: . ack 1 win 5840
08:57:41.318642 IP ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http > managed.unixy.net.49467: R 1288073905:1288073905(0) win 16384
The Reset packet sent from the EC2 node to the initiating node is a probe to identified non-existent nodes (spoofed). Notice in the above handshake that the initiating node didn't send a packet-response to the Reset. On the second consecutive attempt though all appears well (because the EC2 node added the initiating node to the ACL).
08:57:42.961708 IP managed.unixy.net.49468 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: S 1394481180:1394481180(0) win 5840 <mss 1460,sackOK,timestamp 2031832989 0,nop,wscale 7>
08:57:43.016547 IP ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http > managed.unixy.net.49468: S 1406181195:1406181195(0) ack 1394481181 win 5792 <mss 1460,sackOK,timestamp 26523835 2031832989,nop,wscale 3>
08:57:43.016564 IP managed.unixy.net.49468 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: . ack 1 win 46 <nop,nop,timestamp 2031833002 26523835>
08:57:51.100914 IP managed.unixy.net.49468 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: P 1:18(17) ack 1 win 46 <nop,nop,timestamp 2031835023 26523835>
08:57:51.180674 IP ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http > managed.unixy.net.49468: . ack 18 win 724 <nop,nop,timestamp 26525876 2031835023>
08:57:56.206546 IP managed.unixy.net.49468 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: P 18:39(21) ack 1 win 46 <nop,nop,timestamp 2031836300 26525876>
08:57:56.261630 IP ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http > managed.unixy.net.49468: . ack 39 win 724 <nop,nop,timestamp 26527146 2031836300>
08:57:56.678942 IP managed.unixy.net.49468 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: P 39:41(2) ack 1 win 46 <nop,nop,timestamp 2031836418 26527146>
But I wonder just how long they'll be able to evade the attack.
Regards
- JoachimSchipper 16y agoSurviving DoS attacks is not a new problem; I'm sure that Amazon has quite a bit of experience in that area. But thanks for the trace, quite interesting!
- tibbon 16y agoI wonder how well their Cloudfront CDN holds up for delivering static content in the face of a DDoS vs just using heavy static cachine with ngnix or apache on EC2.
- JoachimSchipper 16y agoProbably better, the CDN should be able to absorb much more traffic. (At 10Gbps, you need to worry about the attackers saturating your upstream pipe. Forget responding, just receiving that much traffic is nontrivial. EC2 nodes are probably networked using gigabit ethernet, so no matter how clever you get you can't solve this with everyone's favorite "single load balancer plus nginx web servers".)
- Aaronontheweb 16y agoIf everything is edge-cached a local hubs (typically how a CDN works) then it should be pretty sturdy against a DDoS attack - after the first few waves of attacks the DDoS will just be hitting static content served up by the closest end-point to each individual ping to the server - the aggregate of the attack won't impact any of the dynamic servers if done right. That being said, I wouldn't want to pay the bandwidth bill for the CDN :p
- jjoe 16y agoCheck out the anti-DDoS article we wrote up a few months ago. It uses a constellation of Nginx nodes to absorb the DDoS. The constellation acts the same way as a CDN without the geoIP awareness. The advantage of this approach is that instead of relying on one ISV's backbone, you can build the constellation across several ISVs to aggregate the bandwidth and packet processing power. Regards