4 ms·
Cloudflare is the simplest solution, but for the sake of treating this like a system design exercise, can you reasonably assume that there is not an infinite su
by claudiulodro 3y ago
Cloudflare is the simplest solution, but for the sake of treating this like a system design exercise, can you reasonably assume that there is not an infinite supply of devices with which to conduct the attack, fingerprint the devices, and block them?
- pjc50 3y agoDepending on the weight of DDoS, you may simply find it saturates your upstream router so very little valid traffic even reaches you. Or your ISP kicks in their own protection and drops all your traffic. Edit: https://www.cloudflare.com/learning/ddos/famous-ddos-attacks/ https://www.cloudflare.com/learning/ddos/famous-ddos-attacks... largest ever seems to have been about 180k devices. Getting your upstream to accept that many firewall entries is a big problem.
- bityard 3y agoThe first "D" in "DDos" means "distributed," which means there _effectively is_ an infinite supply of devices with which to conduct the attack. It's a hard problem, which is why DDoS attacks are so prevalent and difficult to defend against without sophisticated mitigation devices and services. You have to block the "bad" traffic by some characteristic and many DDoS attackers have gotten _very_ good at making their attack traffic look almost identical to legitimate traffic.