2 ms·

I often have to wonder if the DDoS gods roll a dice and pick someone to screw each day. We have had many DDoS attacks and never once had any indication as to wh

I often have to wonder if the DDoS gods roll a dice and pick someone to screw each day. We have had many DDoS attacks and never once had any indication as to why. A few days ago we had a 30 Gbit DDoS. Our server host just blackholed any IP that was touched by it. They kept moving it around to target different bits of our infrastructure (unlike previous attacks that just targeted our website). We lost 6 servers, but thankfully not enough to take us fully offline though some customers would have experienced problems during that time. If they had just been a bit more persistent we might have been in serious trouble. At that level of DDoS your server host doesn't care about keeping you online. They want the traffic off their network.

martinced 14y ago
If your nickname here can somehow be linked to the company you're working for (e.g. by checking previous messages you posted to HN or on another board) I think it's not very smart to write what you just wrote. Now the bad guys knows that they should just have tried a bit longer. Now maybe that because you were DROP'ing / blacklisting IPs maybe they just ran out of zombies but still... If I was the attacker and read your message and wanted to be bad, I'd just hammer you a bit more to put you in trouble. Besides that there are some ISPs who do care about both keeping you online and fighting the low-life scums: the ISP XS4ALL from the Netherlands is (was at least) notoriously famous for that.
- switch007 14y ago
  They know that anyway. The longer and more severe an attack is, the more damage it's likely to do. A host may be able to sustain 30Gbps for a minute or two, but not for 5 minutes. If 5 out of 10 servers are being attacked, you can probably handle traffic at 50% capacity for a while, but not forever.
tomjen3 14y ago
Get a smaller host, that way they can't afford to cut you of.
- buttscicles 14y ago
  I'd imagine they'd rather cut off somebody than potential performance degradation for other paying customers.

martinced 14y ago

If your nickname here can somehow be linked to the company you're working for (e.g. by checking previous messages you posted to HN or on another board) I think it's not very smart to write what you just wrote. Now the bad guys knows that they should just have tried a bit longer. Now maybe that because you were DROP'ing / blacklisting IPs maybe they just ran out of zombies but still... If I was the attacker and read your message and wanted to be bad, I'd just hammer you a bit more to put you in trouble. Besides that there are some ISPs who do care about both keeping you online and fighting the low-life scums: the ISP XS4ALL from the Netherlands is (was at least) notoriously famous for that.

switch007 14y ago
They know that anyway. The longer and more severe an attack is, the more damage it's likely to do. A host may be able to sustain 30Gbps for a minute or two, but not for 5 minutes. If 5 out of 10 servers are being attacked, you can probably handle traffic at 50% capacity for a while, but not forever.

tomjen3 14y ago

Get a smaller host, that way they can't afford to cut you of.

buttscicles 14y ago
I'd imagine they'd rather cut off somebody than potential performance degradation for other paying customers.