3 ms·

As a small customer I’ve experienced them doing the complete opposite. I’ve had a 1u collocated at one center or another for the last ~15 years and occasionally

As a small customer I’ve experienced them doing the complete opposite. I’ve had a 1u collocated at one center or another for the last ~15 years and occasionally we would be the target of a DDoS. The data center would just blackhole us until things calmed down. It’s better than a surprise bandwidth bill but certainly not great.

toast0 4y ago
FWIW, that's what happens for large customers too, from my past experience. Someone aims the DDoS cannon at one of our webservers [1], and if the traffic is above the threshold, that server's IP gets blackholed for a while. As a large customer, you do get to have some input into the thresholds, and how long the blackholes are, and to definitely have traffic blackholed rather than put through some crazy filtering apparatus that adds so much latency it'd be better to drop everything. OTOH, we always had at least 4 webservers, so if just one got blackholed, no big deal, update DNS so most of the real users make it to the available servers, most of the abusers will keep hitting the blackholed server and not move on. If your abusers aren't run of the mill script kiddies using a rent-a-ddos service, it's more difficult. [1] it's almost always the webservers, not the servers that do real work
- lucb1e 4y ago
  How large is a large customer here? Paying the hosting company monthly bills on the order of 1k, 10k, 100k? I expected this to only affect small and medium businesses, so I'm genuinely curious what qualifies as large but is still affected. (My security consultancy work only tangentially touches upon DDoS, so I know a thing or two but am not actually in this business.)
  - toast0 4y ago
    My experience is a bit old at this point, and I don't remember quite where exactly we were when we got to have a meaningful conversation on getting the blackhole settings set to reasonable values [1], but our bills were at the high end of your range, and we were a top 5 customer at some point. For us though, getting one server blackholed every so often wasn't that big of a deal, so as long as everything was managed reasonably, and the ticketing was timely so we didn't spend a lot of time trying to figure out why server X wasn't working when it was just a blackhole from DDoS. A clever abuser could have caused a lot more trouble, but clever people tend to find more productive things to do. [1] don't blackhole unless the traffic rate exceeds line rate (which topped out at 2x 10G), retest after 1 hour instead of 24 hours for the first retest, etc.
lucb1e 4y ago
Ah yes, I know those stories as well. I found that surprising also, but it seems to stem from the botnet era where there were thousands upon thousands of originating networks instead of some big (DNS) servers. The practice is still in place though, especially at some cheap hosting providers.
codedokode 4y ago
So basically the data center took the side of the criminals.
- dizhn 4y ago
  It is sort of a common practice to get rid of "problem" customers too.
  - somehnguy 4y ago
    We ran a pretty large Counterstrike gaming community with public servers, and did some very small scale paid server hosting on the side. It's unfortunate that anyone would consider us "problem" customers because DDoS attacks are so easily performed by script kiddies. It can happen to anyone hosting public resources that aren't easily filtered through no fault of their own. I totally understand what you're saying though.
justsomehnguy 4y ago
Because that makes incoming traffic not to come to them at all. Traffic costs money and usually much more than a single 1U colo cost. BTW nice username
- somehnguy 4y ago
  No doubt, we weren't able to pony up the cost difference to cover the bandwidth in cases like this so I get why this was their move. You have a nice username as well!

toast0 4y ago

FWIW, that's what happens for large customers too, from my past experience. Someone aims the DDoS cannon at one of our webservers [1], and if the traffic is above the threshold, that server's IP gets blackholed for a while. As a large customer, you do get to have some input into the thresholds, and how long the blackholes are, and to definitely have traffic blackholed rather than put through some crazy filtering apparatus that adds so much latency it'd be better to drop everything. OTOH, we always had at least 4 webservers, so if just one got blackholed, no big deal, update DNS so most of the real users make it to the available servers, most of the abusers will keep hitting the blackholed server and not move on. If your abusers aren't run of the mill script kiddies using a rent-a-ddos service, it's more difficult. [1] it's almost always the webservers, not the servers that do real work

lucb1e 4y ago
How large is a large customer here? Paying the hosting company monthly bills on the order of 1k, 10k, 100k? I expected this to only affect small and medium businesses, so I'm genuinely curious what qualifies as large but is still affected. (My security consultancy work only tangentially touches upon DDoS, so I know a thing or two but am not actually in this business.)
- toast0 4y ago
  My experience is a bit old at this point, and I don't remember quite where exactly we were when we got to have a meaningful conversation on getting the blackhole settings set to reasonable values [1], but our bills were at the high end of your range, and we were a top 5 customer at some point. For us though, getting one server blackholed every so often wasn't that big of a deal, so as long as everything was managed reasonably, and the ticketing was timely so we didn't spend a lot of time trying to figure out why server X wasn't working when it was just a blackhole from DDoS. A clever abuser could have caused a lot more trouble, but clever people tend to find more productive things to do. [1] don't blackhole unless the traffic rate exceeds line rate (which topped out at 2x 10G), retest after 1 hour instead of 24 hours for the first retest, etc.

lucb1e 4y ago

Ah yes, I know those stories as well. I found that surprising also, but it seems to stem from the botnet era where there were thousands upon thousands of originating networks instead of some big (DNS) servers. The practice is still in place though, especially at some cheap hosting providers.

codedokode 4y ago

So basically the data center took the side of the criminals.

dizhn 4y ago
It is sort of a common practice to get rid of "problem" customers too.
- somehnguy 4y ago
  We ran a pretty large Counterstrike gaming community with public servers, and did some very small scale paid server hosting on the side. It's unfortunate that anyone would consider us "problem" customers because DDoS attacks are so easily performed by script kiddies. It can happen to anyone hosting public resources that aren't easily filtered through no fault of their own. I totally understand what you're saying though.

justsomehnguy 4y ago

Because that makes incoming traffic not to come to them at all. Traffic costs money and usually much more than a single 1U colo cost. BTW nice username

somehnguy 4y ago
No doubt, we weren't able to pony up the cost difference to cover the bandwidth in cases like this so I get why this was their move. You have a nice username as well!