4 ms·

This is a small test[1] that shows the absence of miracles. My interpretation is: • Location, location, location. – Sometimes cloudflare will have better posit

by jws 14y ago

This is a small test[1] that shows the absence of miracles. My interpretation is: • Location, location, location. – Sometimes cloudflare will have better positioning than your server. In this test the Amsterdam clients benefit significantly compared to his Atlanta Georgia US based server. • It is not magic. – For the content he is using (base installs of popular packages and highly web optimized site) cloudflare's compression and optimizations are not helping much (at all?). My next path for further study would be to see if these base installs are highly optimized already. It seems reasonable that they would be, but it would need to be looked at. Then consider if you are planning to have unoptimized content (3rd party generated), or could benefit from skipping the optimization task and live with what cloudflare does. • Do you only have one customer? – One of the attractive features for me is I can share my "worst case"[2] customer load with someone who won't even notice the blip. Tests during a deluge would be interesting. • Does no one hate you? – Haters aren't necessarily sane[3]. Performance tests during a DDOS would be interesting. I'm evaluating cloudflare for a site. I don't expect it to out optimize me. I do expect it to help European and Asian load times, and I have high hopes that it will kick in during bad times and make them less bad. To that end, does anyone know of a friendly DDOS service? I'd like to be able to schedule an X gbps DDOS for Y seconds with traffic of form Z for testing purposes. ␄ [1] 26 numbers, each made from three samples, five minutes apart, averaged together. No standard deviations. [2] Which is the best case in the big picture. Just hard for the computers. [3] I ended up retiring an IP address out of our C block because someone hated it. It was the "friends and family" email and hosting machine back before Facebook and free web mail services. Maybe someone got offended by something, and it got a persistent DDOS attack that would saturated our incoming IP links. Six months later when I tried to reuse the IP the attack came back immediately. I just marked it "unusable" in our DNS files.

nwh 14y ago
Could it be that your denial of service attack is a misconfiguration somewhere? I had a similar issue at one point, a typo in someone's DNS meant that my private server got absolutely wiped out by junk requests. I've heard of people using simple load testers like http://loadimpact.com/ http://loadimpact.com/ to test dynamic pages, though I've not had a serious use for one yet. That's probably as far as you can get without hiring a botnet yourself.
- jws 14y ago
  The DDOS had a variety of strategies. Lots of UDP flooding with presumably forged source addresses. Lots of tcp port hunting too. That was a company ago and I no longer have access to my report on that.
mctx 14y ago
For load testing, you could use apache bench with a fast bandwidth connection, beeswithmachineguns (EC2), locust.io (simulate users), blitz.io (cloud service)
secure 14y ago
off-topic: Since you obviously are interested in Unicode (you used • and even ␄), you could continue the trend by using ¹, ² and ³ instead of [1], [2] and [3]. For the corresponding explanation at the bottom, use ①, ② and ③. Also, instead of "worst case", write “worst case” (typographically correct quotation marks) and instead of ', write ’ (typographically correct apostrophe). In case anyone wonders how to enter them efficiently, I use neo-layout.org which provides ¹ on Mod3+1, ① with Multi_key + ( + 1 + ), “ with Shift+9, ” with Shift+0 and ’ with Mod3+0.

by jws 14y ago

nwh 14y ago

Could it be that your denial of service attack is a misconfiguration somewhere? I had a similar issue at one point, a typo in someone's DNS meant that my private server got absolutely wiped out by junk requests. I've heard of people using simple load testers like http://loadimpact.com/ http://loadimpact.com/ to test dynamic pages, though I've not had a serious use for one yet. That's probably as far as you can get without hiring a botnet yourself.

jws 14y ago
The DDOS had a variety of strategies. Lots of UDP flooding with presumably forged source addresses. Lots of tcp port hunting too. That was a company ago and I no longer have access to my report on that.

mctx 14y ago

For load testing, you could use apache bench with a fast bandwidth connection, beeswithmachineguns (EC2), locust.io (simulate users), blitz.io (cloud service)

secure 14y ago

off-topic: Since you obviously are interested in Unicode (you used • and even ␄), you could continue the trend by using ¹, ² and ³ instead of [1], [2] and [3]. For the corresponding explanation at the bottom, use ①, ② and ③. Also, instead of "worst case", write “worst case” (typographically correct quotation marks) and instead of ', write ’ (typographically correct apostrophe). In case anyone wonders how to enter them efficiently, I use neo-layout.org which provides ¹ on Mod3+1, ① with Multi_key + ( + 1 + ), “ with Shift+9, ” with Shift+0 and ’ with Mod3+0.