3 ms·

Do they inform the target? While it's nice that they can stop an attack without the intended victim noticing, it's still probably a good idea to let them know.

• hahla 14y ago
  From my short experience using cloudflare I believe they do. If a comprised computer tries to visit a site that has dns routing through cloudflare, they serve up a page that says their computer might be comprised and they have to enter a captcha to verify its human traffic to enter the site.
• eastdakota 14y ago
  With a Layer 4 attack, we don't always know for sure what site is the target of the attack. Traffic is being directed at an IP address and many customers may share that IP. We have techniques to scatter customers across IPs and watch attacks follow, but we generally only do that if the attack is causing a problem. In this case, we were able to mitigate it at our edge and upstream to the point that we didn't need to do any shuffling so from this alone we probably wouldn't have known exactly who the target was. From what happened next, when they attacker shifted to a Layer 7 attack, we were able to determine the target and did reach out to the customer to let them know what was going on and what we were going to do to protect them.
  • andrewcooke 14y ago
    more on layer 7 attacks and cloudflare - http://blog.cloudflare.com/saturday-night-fever-layer-7-attacks-against http://blog.cloudflare.com/saturday-night-fever-layer-7-atta... (i love these posts; i'm old + jaded and have no specialist knowledge of networks and protocols, but they're like the spaghetti westerns of the internet age :o)
• eps 14y ago
  Another question is how many repeated attacks does it take for an ISP to drop a customer over this. Surely, DDoS doesn't come cheap on the receiving end, even if it can be stopped in a timely manner.