3 ms·
I would be curious to see how they differentiate between a DDoS and a sudden influx of traffic from new sources, possibly including sources hiding behind tor/vp
by dec0dedab0de 6y ago
I would be curious to see how they differentiate between a DDoS and a sudden influx of traffic from new sources, possibly including sources hiding behind tor/vpns/whatever.
To be clear, I'm sure Cloudflare is pretty good at determining what is an attack and what is not, I'm just interested in the technical details.
- christophilus 6y agoSame. I'm sure they're seeing a lot of traffic just out of support, curiosity, etc. Definitely would be interesting to know how they distinguish that from an attack.
- chooseaname 6y agoDDoS attacks need infected computers (and I'm not sure those would be hiding anywhere), so I would imagine that the logs from one DDoS attack would have a lot of the same IP entries as other DDoS attacks.
- nicmccool 6y agoI'm sure they could differentiate the hug of death due to sudden popularity vs the continued onslaught of scripted bots just by frequency of requests, right? As in, single IP frequency of pings measured out across a batch of addresses. Those malicious would be more regimented with short recycle times, while those unmalicious would be browsing making their repeated calls erratic. (Honest question, I'm genuinely curious.)