5 ms·

> This is definitely on the large end of the scale as far as DoS attacks go, but I wouldn't call it "record smashing" or "game changing" in any special way. It'

by lsc 14y ago

> This is definitely on the large end of the scale as far as DoS attacks go, but I wouldn't call it "record smashing" or "game changing" in any special way. It's just another large attack, maybe 10-15% larger than other similar ones we've seen inthe past Heh. Nice. Yeah, I expressed skepticism that 300G/sec qualified as "largest ever" - I mean, I personally have been hit by 10G+ attacks, and Cogent mostly shrugged. (I mean, my cogent side was down until the target was blackholed at the cogent border.) I know 10 gigabits is a lot less than 300 gigabits, but I am a nobody compared to the people involved in this little kerfuffle.)

duaneb 14y ago
I thought that it was the largest ever, but it wasn't larger enough to really be notable, just sort of the natural progression of internet traffic.
- knighthacker 14y ago
  Exactly. The author already said "10-15% larger than other similar ones we've seen inthe past". Doesn't that make a record-changing by definition? :)
  - mbell 14y ago
    Record changing from a scientific definition? Yep. But, when the relatively non-technical populous hears 'record changing' a completely different set of emotions are triggered in their brains. Its just like any other overly grandios marketing headline, designed to excite those whom aren't familiar with the topic.
  - lsc 14y ago
    well, what I got from the article was that the person was saying "We aren't the whole internet, this is larger than what we normally see, but not by a huge margin." - which is to say, it's possible that other providers have seen larger DDoS attacks.
  - icambron 14y ago
    It does. But consider all the other times this record must have been broken -- wasn't a big news story. Incremental increases in the bytes/second record just aren't, by themselves, that interesting.
  - hhw 14y ago
    That's from GTT/NLayer's perspective, which is just one of many Tier 2 network providers. Tier 1 networks are more likely to see the largest attacks.
druiid 14y ago
Yeah, I highly doubt 300G/sec is the largest attack ever as well. I've seen (well, we only saw a gigabit of it.. our host saw the rest) a 41G/sec attack. I imagine large attacks like this happen all the time but don't make the news because they just get fixed and the companies move on because it happens so much.
vidarh 14y ago
Note that CloudFlare itself doesn't claim it is the largest ever, but references NY Times' claim that it was, and then later goes on to say "that would make this attack one of the largest ever reported." Other than the headline and the reference to the NY Times article, CloudFlares claims and the linked article are pretty much in line.
cft 14y ago
Can you describe Cogent's reaction to your request to blackhole the route? We had a very small incident with XO recently (perhaps 500Mbps reflected DNS flood), and it took them 24 hrs to get back to me to blackhole the target! We just packet filtered in our edge switch. Was Cogent any faster?
- dsl 14y ago
  If you run a network of any size you should be speaking BGP with your upstream, even if its using a private AS. You can then announce a prefix to them specially tagged with a "blackhole community" that drops traffic at the edge of their network. The exact details vary by network, but here is how Hurricane does it http://www.he.net/adm/blackhole.html http://www.he.net/adm/blackhole.html
  - lsc 14y ago
    Yup. The details are slightly different for Cogent (I think we had it setup as a separate BGP session rather than as a community tag like he.net does it, but that was because my customer requested it that way.) But yeah, you give them /32s to null, and they drop those /32s at the network edge. It stops the attack, well, almost immediately, but the problem is that it kills the target site completely. (well, often people have web frontends to this, which, well, work poorly when your pipe is completely full, and for that matter, just getting the bgp data to your peer can take a few tries. but yeah, it's still pretty quick and effective, compared to calling someone to whine.) What we really need is to get everyone to implement bcp38 anti-spoofing rules. If everyone did that, we'd be able to block the sources of the problem, rather than the destination. But, well, that's unlikely to happen, so for now, you just, ah, finish the job.
    - eps 14y ago
      This is what I don't understand about DoS mitigation. So i'd null route the target, but then I have to move the service to another IP. I will also announce this IP to the customers, but that would simply redirect the DoS to the new address and take it down too... I mean, there seems to be no way to deal with DoS without throwing a baby (customers) with the water (attackers) or am I missing something?

by lsc 14y ago

duaneb 14y ago

I thought that it was the largest ever, but it wasn't larger enough to really be notable, just sort of the natural progression of internet traffic.

knighthacker 14y ago
Exactly. The author already said "10-15% larger than other similar ones we've seen inthe past". Doesn't that make a record-changing by definition? :)
- mbell 14y ago
  Record changing from a scientific definition? Yep. But, when the relatively non-technical populous hears 'record changing' a completely different set of emotions are triggered in their brains. Its just like any other overly grandios marketing headline, designed to excite those whom aren't familiar with the topic.
- lsc 14y ago
  well, what I got from the article was that the person was saying "We aren't the whole internet, this is larger than what we normally see, but not by a huge margin." - which is to say, it's possible that other providers have seen larger DDoS attacks.
- icambron 14y ago
  It does. But consider all the other times this record must have been broken -- wasn't a big news story. Incremental increases in the bytes/second record just aren't, by themselves, that interesting.
- hhw 14y ago
  That's from GTT/NLayer's perspective, which is just one of many Tier 2 network providers. Tier 1 networks are more likely to see the largest attacks.

druiid 14y ago

Yeah, I highly doubt 300G/sec is the largest attack ever as well. I've seen (well, we only saw a gigabit of it.. our host saw the rest) a 41G/sec attack. I imagine large attacks like this happen all the time but don't make the news because they just get fixed and the companies move on because it happens so much.

vidarh 14y ago

Note that CloudFlare itself doesn't claim it is the largest ever, but references NY Times' claim that it was, and then later goes on to say "that would make this attack one of the largest ever reported." Other than the headline and the reference to the NY Times article, CloudFlares claims and the linked article are pretty much in line.

cft 14y ago

Can you describe Cogent's reaction to your request to blackhole the route? We had a very small incident with XO recently (perhaps 500Mbps reflected DNS flood), and it took them 24 hrs to get back to me to blackhole the target! We just packet filtered in our edge switch. Was Cogent any faster?

dsl 14y ago
If you run a network of any size you should be speaking BGP with your upstream, even if its using a private AS. You can then announce a prefix to them specially tagged with a "blackhole community" that drops traffic at the edge of their network. The exact details vary by network, but here is how Hurricane does it http://www.he.net/adm/blackhole.html http://www.he.net/adm/blackhole.html
- lsc 14y ago
  Yup. The details are slightly different for Cogent (I think we had it setup as a separate BGP session rather than as a community tag like he.net does it, but that was because my customer requested it that way.) But yeah, you give them /32s to null, and they drop those /32s at the network edge. It stops the attack, well, almost immediately, but the problem is that it kills the target site completely. (well, often people have web frontends to this, which, well, work poorly when your pipe is completely full, and for that matter, just getting the bgp data to your peer can take a few tries. but yeah, it's still pretty quick and effective, compared to calling someone to whine.) What we really need is to get everyone to implement bcp38 anti-spoofing rules. If everyone did that, we'd be able to block the sources of the problem, rather than the destination. But, well, that's unlikely to happen, so for now, you just, ah, finish the job.
  - eps 14y ago
    This is what I don't understand about DoS mitigation. So i'd null route the target, but then I have to move the service to another IP. I will also announce this IP to the customers, but that would simply redirect the DoS to the new address and take it down too... I mean, there seems to be no way to deal with DoS without throwing a baby (customers) with the water (attackers) or am I missing something?