4 ms·
When the ddos attack is volumetric, the only way to mitigate it is to have a fat enough network to handle the traffic while you work with ISPs to start blocking
by SteveNuts 3y ago
When the ddos attack is volumetric, the only way to mitigate it is to have a fat enough network to handle the traffic while you work with ISPs to start blocking the traffic upstream.
Not all ddos attacks are based on volume though, some are exploiting native features of a protocol, like the slow loris attack
https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/ https://www.cloudflare.com/learning/ddos/ddos-attack-tools/s...
- dijit 3y agothat's not the only way. The way we used to do it is have "filter boxes" with a real anycast IP address's which reverse connect to your origin. This helps a lot because it keeps a lot of traffic localised instead of allowing it to collect in one place. Anycast should also mean you have a failover mechanism; but if it fails then you're only down in one section of the world where the most bots are anyway, which is usually not as bad as being down globally.