3 ms·
> Many ISPs have good solutions that work well without you having to break open your SSL to use the service. What are they going to do if a botnet with tens of
by luckylion 4y ago
> Many ISPs have good solutions that work well without you having to break open your SSL to use the service.
What are they going to do if a botnet with tens of thousands of IPs are hitting your server? Nullroute it to take the load off their network? Somehow figure out what traffic is legitimate and what isn't and just drop a bunch of stuff?
- sschueller 4y agoLarger ISPs have systems like the ones Netscout[1] and others offer on their edge connections which can classify such traffic and deal with it. If your systems are co-located in a DC or you have your own DC you have access to these ISPs. [1] https://www.netscout.com/product/netscout-aed https://www.netscout.com/product/netscout-aed
- genewitch 4y agobefore cloudflare companies such as verisign would take over all your routing (i think just for the IP range(s) affected) to mitigate DDoS. Although if you're a company that has a /20 of ipv4 and whoever is DDoSing you is doing it for an actual reason (as opposed to bored teens or whatever), they'll figure out you own a huge number of IPs and start nuking them all. Verisign could also handle that. There were others, comodo maybe? Then cloudflare appeared, it was way cheaper for smaller traffic sites, then they had so much bandwidth in so many places they offered CDNs; and those were cheaper than Akamai and whoever the other player was. I think they got lucky, market placement when they entered was entrenched by large companies that did not care about small customers at all. and yet.