3 ms·

This would be perfect for crawling with a large number of distinct IP addresses, or for fighting DDOS attacks. However: "All network traffic is proxied throug

by panarky 14y ago

This would be perfect for crawling with a large number of distinct IP addresses, or for fighting DDOS attacks. However: "All network traffic is proxied through a central data center we maintain." https://gridspot.com/compute/api_help https://gridspot.com/compute/api_help

adamsmith 14y ago
Yeah, to be honest we're trying to avoid the business of selling wholesale access to a lot of IP addresses, hence the proxying of traffic. If there are specific, legitimate uses for a large number of IPs, for example fighting DDOS, then that might be something we should build!
- josscrowcroft 14y ago
  I don't know about 'legitimate', but I can think of plenty of specific ones. I say build it (just might want to incorporate it separately... possibly in Sweden..)
slig 14y ago
How is possible to fight a DDOS attack with lots of IP addresses?
- milesokeefe 14y ago
  I think panarky meant flee/hide from.
- panarky 14y ago
  Fighting fire with fire: http://phys.org/news/2011-03-horizon-victims-ddos.html http://phys.org/news/2011-03-horizon-victims-ddos.html
- donavanm 14y ago
  Increase the attack surface area. With anycast the nearest nodes to the attackers "sink" all of the traffic. The rest of the nodes continue to serve other customers with no I'll effect. With this product you will have a very wide base of unicast addresses. Treat each node/address as disposable. Use fast failing health checks and an out of band control plane. As each node falls to attack remove it from your service discovery layer (DNS/http 302/etc). See "fast flux dns" for implementation ideas. The attacker will spend a disproportionate amount of resources (packets/s) attacking each of your disposable nodes. The majority of your "good" customers will continue to be served. In a traditional tiered architecture the L3->L7 routing layer (LB/Proxy) is very expensive to scale vertically. Your data store & compute end are clustered behind these choke points. Remove/minimize shared state and you can have independent units of compute. Remove those L3->L7 choke points and you can get a wider & flatter L1->L3 network fabric. Besides increased durability you get more aggregate bandwidth per $.

by panarky 14y ago

adamsmith 14y ago

Yeah, to be honest we're trying to avoid the business of selling wholesale access to a lot of IP addresses, hence the proxying of traffic. If there are specific, legitimate uses for a large number of IPs, for example fighting DDOS, then that might be something we should build!

josscrowcroft 14y ago
I don't know about 'legitimate', but I can think of plenty of specific ones. I say build it (just might want to incorporate it separately... possibly in Sweden..)

slig 14y ago

How is possible to fight a DDOS attack with lots of IP addresses?

milesokeefe 14y ago
I think panarky meant flee/hide from.
panarky 14y ago
Fighting fire with fire: http://phys.org/news/2011-03-horizon-victims-ddos.html http://phys.org/news/2011-03-horizon-victims-ddos.html
donavanm 14y ago
Increase the attack surface area. With anycast the nearest nodes to the attackers "sink" all of the traffic. The rest of the nodes continue to serve other customers with no I'll effect. With this product you will have a very wide base of unicast addresses. Treat each node/address as disposable. Use fast failing health checks and an out of band control plane. As each node falls to attack remove it from your service discovery layer (DNS/http 302/etc). See "fast flux dns" for implementation ideas. The attacker will spend a disproportionate amount of resources (packets/s) attacking each of your disposable nodes. The majority of your "good" customers will continue to be served. In a traditional tiered architecture the L3->L7 routing layer (LB/Proxy) is very expensive to scale vertically. Your data store & compute end are clustered behind these choke points. Remove/minimize shared state and you can have independent units of compute. Remove those L3->L7 choke points and you can get a wider & flatter L1->L3 network fabric. Besides increased durability you get more aggregate bandwidth per $.