3 ms·

To compound on everything said here: traditionally, you would either have a set of load balancers, or set of web servers, taking requests directly from clients.

by tobz 12y ago

To compound on everything said here: traditionally, you would either have a set of load balancers, or set of web servers, taking requests directly from clients. If someone wanted to DDoS you, they hit the public IPs of these machines. It can be nearly impossible to mitigate a large enough attack to the point of restoring normal service. You'd most likely be forced to switch to entirely new IPs for a long enough attack event. CloudFlare, in general, accomplishes their DDoS protection by having a super large, geographically redundant network that absorbs the attack before passing legitimate traffic on to your servers. This problem isn't strictly related to HTTP requests - it's really anything running on your servers. If the request is able to get past firewalls, switches, routers, to your machine, it has a chance to eat up resources, and ultimately take down that server / service. WebSockets are being used more and more for event-based communications, as you mentioned, providing real-time updates instead of relying on polling, or long polling hacks. Thus, they're just as viable of an attack vector as directing an attack at port 80. This is where the intermediate layer, provided by CloudFlare, comes into play. The caching aspect of CloudFlare is an important, but separate aspect of their service.

jgrahamc 12y ago
CloudFlare, in general, accomplishes their DDoS protection by having a super large, geographically redundant network that absorbs the attack before passing legitimate traffic on to your servers. That's part of the answer. But also we do very high packet rate filtering using stuff like this: http://blog.cloudflare.com/bpf-the-forgotten-bytecode http://blog.cloudflare.com/bpf-the-forgotten-bytecode
- tobz 12y ago
  I simply opted to call out your network because that is the mechanism that hides the origins, despite the other layers of protection provided by software running at the edge. :)

by tobz 12y ago

jgrahamc 12y ago

CloudFlare, in general, accomplishes their DDoS protection by having a super large, geographically redundant network that absorbs the attack before passing legitimate traffic on to your servers. That's part of the answer. But also we do very high packet rate filtering using stuff like this: http://blog.cloudflare.com/bpf-the-forgotten-bytecode http://blog.cloudflare.com/bpf-the-forgotten-bytecode

tobz 12y ago
I simply opted to call out your network because that is the mechanism that hides the origins, despite the other layers of protection provided by software running at the edge. :)