3 ms·
“Imagine a distributed denial-of-service attack where the incoming IP addresses are all from Google and Amazon. That becomes a challenge. You can’t blacklist th
by AznHisoka 12y ago
“Imagine a distributed denial-of-service attack where the incoming IP addresses are all from Google and Amazon. That becomes a challenge. You can’t blacklist that whole IP range.”
Why exactly not? Amazon and probably Google cloud's IPs are probably available publicly, and you can probably discern Googlebot's IP from the cloud ones (using user agent, or even ip ranges). You can sensibly block IP ranges from any dedicated hosts/cloud providers. Only <1% of them would be valid traffic (ie someone working in AWS going to your site directly)
- Aldo_MX 12y ago> Only <1% of them would be valid traffic Like archive.org, for example...
- eegilbert 12y agoI sometimes use a personal OpenVPN install I have on AWS. I know from experience that Stack Overflow and Yelp block me; presumably, they block the whole range.
- dredmorbius 12y agoA few thoughts: • For search engines with hosted services, its unlikely their spiders and hosted traffic come from the same IP blocks. • In general, if you're running a public-facing website, you're not particularly interested in datacenter-originating traffic. Throwing up a large blocklist is actually going to cost you very little legit traffic. • There's a highly underappreciated service at http://asn.routviews.org/ http://asn.routviews.org/ which gives reverse IP lookups of CIDR block and ASN for a given IP. Query the text record for the reversed dotted quad at the domain asn.routeviews.org. E.g., for news.ycombinator.com, the IP is 198.41.191.47. Reverse that to query: $ host -t txt 47.191.41.198.asn.routeviews.org 47.191.41.198.asn.routeviews.org descriptive text "13335" "198.41.184.0" "21" That is, the CIDR range 198.41.184.0/21 and AS 13335 (Cloudflare, FWIW). • You may need to punch holes for specific hosts. That's fairly tractable.