4 ms·

It really does help. Most SYN floods can easily be handled with proper tuning and iptables. Most DDoS attacks are small.

dylz 7y ago
I am kind of curious what field you see attacks in, or how "most attacks are small" - even two slapfighting kids having a minecraft argument routinely exceeds 50-70Gbps+ from what I've seen..
- cpach 7y ago
  How are they able to employ such volumes? Do they buy DDoS as a service?
  - dylz 7y ago
    Yes. It costs less than $1-3 for a month or week of 'service' with a maximum of typically 3-5 minutes per attack, you can pay with PayPal, you can pay with Runescape gold or Roblox/Fortnite/game of the month currency, sign in to a (typically really badly made novice PHP-based) panel, often behind Cloudflare free plan themselves, and enter an IP/hostname and click the button. These typically use PHP scripts/perl scripts/whatever and fork off in the background to do some mix of sshing into some machines legitimately purchased or with stolen cards at crappy "offshore" providers that allow spoofing or otherwise to launch reflected DNS/NTP attacks, hitting upstream APIs that do the same (as a reseller of attacks), hitting uploaded webshells to do `fsockopen('udp://'...` on a ton of cheap shared hosting machines or hacked sites, usually old PHP CMS type stuff. Comes complete with fake "terms of service" like how it's only meant to be used for legal testing of your own servers, but in practice that's effectively there as a joke. There's a huge market of these, "step by step" guides on youtube with affiliate links to these services, like https://www.youtube.com/watch?v=tHKBZr00IOA https://www.youtube.com/watch?v=tHKBZr00IOA for example.
    - cpach 7y ago
      Wow. Didn’t know it was that easy. The humanity...
- NightlyDev 7y ago
  Developing and running a multiplayer game for 11 years, and games definetly is one of the industries that has most DoS attacks. It's rare that attacks are 50-70 Gbps, and that large SYN attacks are definetly not common. Reflection attacks of 50-70 Gbps are easily blocked by the firewall as the port is likely blocked.

dylz 7y ago

I am kind of curious what field you see attacks in, or how "most attacks are small" - even two slapfighting kids having a minecraft argument routinely exceeds 50-70Gbps+ from what I've seen..

cpach 7y ago
How are they able to employ such volumes? Do they buy DDoS as a service?
- dylz 7y ago
  Yes. It costs less than $1-3 for a month or week of 'service' with a maximum of typically 3-5 minutes per attack, you can pay with PayPal, you can pay with Runescape gold or Roblox/Fortnite/game of the month currency, sign in to a (typically really badly made novice PHP-based) panel, often behind Cloudflare free plan themselves, and enter an IP/hostname and click the button. These typically use PHP scripts/perl scripts/whatever and fork off in the background to do some mix of sshing into some machines legitimately purchased or with stolen cards at crappy "offshore" providers that allow spoofing or otherwise to launch reflected DNS/NTP attacks, hitting upstream APIs that do the same (as a reseller of attacks), hitting uploaded webshells to do `fsockopen('udp://'...` on a ton of cheap shared hosting machines or hacked sites, usually old PHP CMS type stuff. Comes complete with fake "terms of service" like how it's only meant to be used for legal testing of your own servers, but in practice that's effectively there as a joke. There's a huge market of these, "step by step" guides on youtube with affiliate links to these services, like https://www.youtube.com/watch?v=tHKBZr00IOA https://www.youtube.com/watch?v=tHKBZr00IOA for example.
  - cpach 7y ago
    Wow. Didn’t know it was that easy. The humanity...
NightlyDev 7y ago
Developing and running a multiplayer game for 11 years, and games definetly is one of the industries that has most DoS attacks. It's rare that attacks are 50-70 Gbps, and that large SYN attacks are definetly not common. Reflection attacks of 50-70 Gbps are easily blocked by the firewall as the port is likely blocked.