3 ms·
The thing about a DDoS attack, is that it's a significantly higher traffic volume that the target normally sees. So, a "sufficiently large" site might well not
by tbrownaw 12y ago
The thing about a DDoS attack, is that it's a significantly higher traffic volume that the target normally sees.
So, a "sufficiently large" site might well not even notice if you tried to DDoS them.
I would assume Google and Facebook (and Twitter) to be examples of such "sufficiently large" sites.
- shockzzz 12y agoso it really is just handling traffic volume?
- bikamonki 12y agoTechnically yes. I am no expert but I understand the best approach is to divert attack traffic to a sinkhole, i.e. handle attack traffic, not block it.
- ethanbond 12y agoExcept there's no provable way to distinguish between "attack traffic" and normal traffic. You're also diverting your normal users anyhow, so the DDOS is still working as intended.
- Perdition 12y ago>Except there's no provable way to distinguish between "attack traffic" and normal traffic. Depends on the DDOS method used. Stuff like the NTP abuse of a few years ago could be sinkholed without effecting any real users. HTTP DDOS has pretty low impact per node so most attackers use some form of amplification attack with other protocols.
- ethanbond 12y agoOh there are totally heuristics you can use. For example, limiting traffic from geolocations in which it shouldn't be showing high traffic usage (8 million hits per minute from China at 3am Beijing time?). The key word is "provable."
- signalsmith 12y agoI was told a story by a friend who works for a CDN (big one that handles lots of online video): "Hey - look at this, I think someone's trying to DDOS us." > "A hundred thousand requests a second? Neat - is it affecting our latency?" "Um... no, not really." > "Give me a shout if they hit a million a second."