5 ms·
I guess this is basically the same as OVH's "VAC" system? I sometimes get these emails: >We have just detected an attack on IP address x.x.x.x. In order to pro
by regecks 7y ago
I guess this is basically the same as OVH's "VAC" system? I sometimes get these emails:
>We have just detected an attack on IP address x.x.x.x. In order to protect your infrastructure, we vacuumed up your traffic onto our mitigation infrastructure. The entire attack will thus be filtered by our infrastructure, and only legitimate traffic will reach your servers.
and then:
>We are no longer able to detect any attack on IP address x.x.x.x. Your infrastructure has now been withdrawn from our mitigation system.
I never need to do anything, but I don't think these attacks are real anyway.
- judge2020 7y agoHacker: ping -t 1.2.3.4 OVH: go into lockdown!
- codexon 7y agoThey are very likely real and OVH has a very good system. You can thank them for making free DDoS protection mainstream, dragging all other hosts kicking and screaming into providing DDoS protection. In the past providers like Linode were happy to just null route your IP for several hours/days or charge you thousands to block a small flood.
- ignoramous 7y ago> You can thank them for making free DDoS protection mainstream AWS does charge for WAF and Shield, I believe. I also remember comparing AWS Lambda at Edge vs Cloudflare Workers (though Lambda allows for longer execution times and generally provides more flexibility like RAM, CPU, Runtimes since it runs on a Linux VM vs V8 Isolates for Workers), costs were something like 10x apart. Can't wait for WebSockets support for Workers.
- lentil 7y ago> I also remember comparing AWS Lambda at Edge vs Cloudflare Workers ... costs were something like 10x apart. According to the AWS pricing example[1] 10 million requests per month on Lambda@Edge costs $9.13. The same thing on Cloudflare Workers[2] costs $5.00. So I would expect it to be closer to 2x. Although as you say there's a bit more flexibility with Lambda@Edge so it'll depend on your particular case. I'm curious if your situation was different somehow that made for such a big cost difference between the two? [1]https://aws.amazon.com/lambda/pricing/#Lambda.40Edge_Pricing https://aws.amazon.com/lambda/pricing/#Lambda.40Edge_Pricing [2]https://workers.cloudflare.com/#plans https://workers.cloudflare.com/#plans
- ignoramous 7y ago$5 includes a generous free tier for Workers KV that can hold upto 10MiB of data against a single key. Cloudflare does not charge for bandwidth consumed, I believe. Also, use of Cloudflare's zonal http-cache is free. I guess, when I compared, I took Lambda@Edge's per second billing into consideration and not per 50ms (which brings down the RAM usage cost from $62.52 to $3.13 and total usage from $68.52 to $9.13). What really sealed the deal for me was the very low cold-start times with Workers. I'm not aware of recent improvements with Lambda@Edge, but the last time I tried them, it wasn't uncommon to hit 100ms+ start times.
- lentil 7y agoThat's interesting, thanks. I haven't really used Cloudflare Workers for much myself so it's interesting to hear folks' comparisons.
- ignoramous 7y agoOne more thing, I am not sure if Lambda@Edge charges based on wall-time or cpu-time. Workers' 50ms is cpu-time only and not wall-time. You could, in theory, spend 30s waiting for a fetch to return as awaiting on the network doesn't count against a Workers' 50ms cpu-time limit. Ref: https://developers.cloudflare.com/workers/about/limits/ https://developers.cloudflare.com/workers/about/limits/
- latch 7y agoIt wasn't just Linode (a provider that's generally much cheaper than OVH), but high end providers like Softlayer too (and, as far as I know, still are)
- ryanlol 7y agoHow is Linode “much cheaper than OVH”? Their margins are probably way higher.
- latch 7y agoLinode's origin is as a VPS provider. OVH's is as a dedicated server provider. OVH's top server is twice the cost of Linode's and their cheapest is 5x the price (10 vs ~50).
- luckylion 7y agoComparing prices for bare metal with prices for shared infrastructure is pretty much useless though.
- ryanlol 7y agoWhy is that?
- urbanjunkie 7y agoI mean, I'm not trying to be rude, but you're pretty fucking stupid. OVH's cheapest VPS is just over $3 per month.
- ryanlol 7y agoCheapest OVH dedi I see is the KS-1 for 3.99eur, which is less than the cheapest Linode VPS. OVH also doesn’t try to nickel-and-dime you by charging for data transfer. I wouldn’t recommend the cheapest Kimsufi offerings though, something like the SYS-WS-1 goes for $33 and is easily comparable with Linode offerings priced at multiple times that. OVH has a VPS product that’s far cheaper than what Linode offers, but I can’t speak to the quality of that offering.
- Matt3o12_ 7y agoI’m curious, does anyone know what that means specifically? How can they differentiate normal traffic from malicious traffic? What exactly triggers it? Is a ping flood with a slow (50mbits) internet connect enough? I am aware that the details are mostly likely private to protect them from abuse and are also a trade secret but I have a very hard time to find a general approach that might be similar to their solution?
- cortesoft 7y agoI don't know their solution exactly, but what usually happens is they look for common packet signatures. Most DDOSes aren't very sophisticated, and can be blocked with fairly simple rules.
- Thaxll 7y agoIt's much more advanced than you think : custom asics etc...
- telesilla 7y agoLinode support is fantastic and we host some critical infrastructure with them for this reason and have been happy for years. DO has the managed DB however so we've been migrating some services to them. If Linode offers a managed DB I'll move everything back.
- buro9 7y ago> I never need to do anything, but I don't think these attacks are real anyway What would it take to convince you an attack is real when it has been 100% mitigated and you never saw it in your backend infrastructure? I ask as the engineering manager for DDoS protection at Cloudflare, and we stop a lot of attacks. But I feel this tension in the communication and product offering... if we do our job well enough that a customer's system does not see the attack, how does a customer see and feel the value? An example is that as a reverse HTTP proxy we are implicitly also a full TCP proxy for HTTP traffic and so we receive significantly large SYN or ACK floods. We stop these 100% by virtue of being the terminating TCP proxy, but also by using connection tracking, anycast, XDP + eBPF, and so forth... you won't see a single one of these SYN or ACK packets hitting your infrastructure... so what would we have to communicate to convince you that the attack existed?
- rmdashrfstar 7y agoDo you publish metrics on “attacks prevented” (or access to logging and monitoring) for customers?
- buro9 7y agoYes. For HTTP customers there are full SIEM logs under Firewall > Overview on our dashboard, and for paid tiers there are drill-down analytics in addition to the full SIEM logs. There is also log push to receive near real-time full HTTP logs into Google or AWS for your own analysis and these show if a firewall feature touched the request or if it was served from cache. In addition for HTTP customers we show graphs of SYN floods, etc for the IPs your web properties are advertised on. For L4 customers via Magic Transit we also have Network Analytics showing what we received at our edge network and a log of attacks detected and mitigated. There is still lots of room for improvement... that's really what I'm asking, what does the ideal system look like for someone where they see and understand the data and trust it. For example, is it valuable to see the attack landscape and what is happening across our systems even when you are not the target? Would that help give perspective to attacks that do target you, and also increase faith that this system exists and is stopping attacks when attacks do not target you?
- wielebny 7y agoI've been using OVH services to host game servers for several years now, and their "VAC" is a godsend. Other providers would prefer to terminate my account or offer some kind of protection for thousand of dollars.