4 ms·

Each time i hear about DDoS attacks i wonder why we don't have serious effective mitigation strategies even though there are brilliant computer scientists out t

by ramigb 12y ago

Each time i hear about DDoS attacks i wonder why we don't have serious effective mitigation strategies even though there are brilliant computer scientists out there who always come up with very smart solutions, this is a genuine question and not a rhetorical one.

fdanconia 12y ago
Well let's brain storm! How can one improve on what is currently out there? Faster recognition and diversion of traffic flow?
riscy 12y ago
I think the main difficulty is how to determine whether traffic is legitimate or not. Banning ranges of IP addresses is effectively denying service to non-attackers as well, so they win. The game is to soften their traffic's load on your system as much as possible while keeping things available.
MichaelGG 12y ago
Most of it comes down to shoving 10X traffic down a 1X pipe. You can write smart fast software, but if your wires are saturated... There is one common problem, and that is that the major transit carriers/ISPs allow you to spoof your source IP. That allows some attacks to be done easier than otherwise. But that's more of a special case and doesn't matter when there is hijacking going on like in this attack. Blocking attacks at the source is probably not a solution either, since you'd have to have a distributed way of getting filtering rules out to every ISP.
- fryguy 12y ago
  If it were possible to stop some of that 10X before it even got to the pipe, would be the only kind of mitigation for that kind of attack. For something like that though, would require some pretty sophisticated firewall technology that lives outside of your infrastructure.
  - pixl97 12y ago
    Before it got to who's pipe? ISP's have very little interest in filtering outbound traffic. Most clients have limited upstream, and they would have to pay for the expense of this filter. If you botNet 100,000 computers in different places each ISP they are on suffers very little, the target suffers a lot, and the carrier in between has very little interest in spending CPU time on fixing the issue.

by ramigb 12y ago

fdanconia 12y ago

Well let's brain storm! How can one improve on what is currently out there? Faster recognition and diversion of traffic flow?

riscy 12y ago

I think the main difficulty is how to determine whether traffic is legitimate or not. Banning ranges of IP addresses is effectively denying service to non-attackers as well, so they win. The game is to soften their traffic's load on your system as much as possible while keeping things available.

MichaelGG 12y ago

Most of it comes down to shoving 10X traffic down a 1X pipe. You can write smart fast software, but if your wires are saturated... There is one common problem, and that is that the major transit carriers/ISPs allow you to spoof your source IP. That allows some attacks to be done easier than otherwise. But that's more of a special case and doesn't matter when there is hijacking going on like in this attack. Blocking attacks at the source is probably not a solution either, since you'd have to have a distributed way of getting filtering rules out to every ISP.

fryguy 12y ago
If it were possible to stop some of that 10X before it even got to the pipe, would be the only kind of mitigation for that kind of attack. For something like that though, would require some pretty sophisticated firewall technology that lives outside of your infrastructure.
- pixl97 12y ago
  Before it got to who's pipe? ISP's have very little interest in filtering outbound traffic. Most clients have limited upstream, and they would have to pay for the expense of this filter. If you botNet 100,000 computers in different places each ISP they are on suffers very little, the target suffers a lot, and the carrier in between has very little interest in spending CPU time on fixing the issue.