4 ms·

so it really is just handling traffic volume?

• bikamonki 12y ago
  Technically yes. I am no expert but I understand the best approach is to divert attack traffic to a sinkhole, i.e. handle attack traffic, not block it.
  • ethanbond 12y ago
    Except there's no provable way to distinguish between "attack traffic" and normal traffic. You're also diverting your normal users anyhow, so the DDOS is still working as intended.
    • Perdition 12y ago
      >Except there's no provable way to distinguish between "attack traffic" and normal traffic. Depends on the DDOS method used. Stuff like the NTP abuse of a few years ago could be sinkholed without effecting any real users. HTTP DDOS has pretty low impact per node so most attackers use some form of amplification attack with other protocols.
      • ethanbond 12y ago
        Oh there are totally heuristics you can use. For example, limiting traffic from geolocations in which it shouldn't be showing high traffic usage (8 million hits per minute from China at 3am Beijing time?). The key word is "provable."