3 ms·
While we're talking about rewriting the Internet, please fix ddos attacks. The current internet is especially prone to ddos attacks to the point where it costs
by codexon 13y ago
While we're talking about rewriting the Internet, please fix ddos attacks. The current internet is especially prone to ddos attacks to the point where it costs 100x more money to defend than to start an attack of the same size.
http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack http://blog.cloudflare.com/deep-inside-a-dns-amplification-d...
- zanny 13y agoChange your egress traffic queue discipline. fq_codel was mainlined in the last two years to solve buffer bloat and has the side effect of helping to alleviate ddos. It flags bad traffic flows (ie, ddos attacks) as bad queues and prioritizes other traffic around it. See : https://en.wikipedia.org/wiki/CoDel https://en.wikipedia.org/wiki/CoDel Note, this doesn't help at the endpoint under attack. It requires a qos shift on the infrastructure leading to that thin last mile pipe, so the last mile packets they get are the the good flows. Also, a warning: CoDel itself is pretty experimental still. It is only just being deployed as the default in proprietary routing hardware this year. Other queueing disciplines are an option, but the default (fifo) is a sack of garbage that causes a lot of these issues in its simplicity and inability to bias bad traffic from the good.
- codexon 13y agoI'm talking about 10GE overflowing 20+ gbps attacks for $5. http://www.hackforums.net/forumdisplay.php?fid=232 http://www.hackforums.net/forumdisplay.php?fid=232