July 10, 2006
Fighting Internet Terrorists
NZ Bear is attempting to set up a system of fighting DDoS attacks. As you may already know, The Jawa Report is constantly being attacked by pimple-faced wannabe jihadis who are too lazy or cowardly to strap on a suicide vest and attack our beloved mu server located deep in the heart of the Isle of Niue. Could this be the answer? I dunno, but it's certainly generating some interesting discussion.
Comments are disabled.
Post is locked.
Posted by: Rusty at
12:33 PM
| Comments (12)
| Add Comment
Post contains 74 words, total size 1 kb.
1
There are already dozens of solutions to preventing DDoS attacks. But you have to pay for it. One good way to avoid it is to keep your blog hosted with an "Akamaized Host" such as Yahoo or Google.
Posted by: BelchSpeak at July 10, 2006 12:50 PM (UyFYg)
2
"carp" load balanced servers are excellent for availability, problem is of course that you would only be distributing the attack across the server pool.
It would depend on the nature of the DDOS, is it a syn flood from spoofed IP's you could use a firewall that drops non-routable IP's, blocks that are reserved by IANA, other operating systems allow dropping packets to closed ports [tcp/udp blackhole=2] even then you're looking only to stop around 8-10% of packets with invalid source IP's.
Unfortunately stopping DDOS with hardware, and architecture costs a lot of money, there are hardware ingress filtering devices, designed to withstand DDOS, however they are thousands of dollars, just to protect a 100mbit circuit.
It would depend on the nature of the DDOS, is it a syn flood from spoofed IP's you could use a firewall that drops non-routable IP's, blocks that are reserved by IANA, other operating systems allow dropping packets to closed ports [tcp/udp blackhole=2] even then you're looking only to stop around 8-10% of packets with invalid source IP's.
Unfortunately stopping DDOS with hardware, and architecture costs a lot of money, there are hardware ingress filtering devices, designed to withstand DDOS, however they are thousands of dollars, just to protect a 100mbit circuit.
Posted by: davec at July 10, 2006 12:54 PM (voZp6)
3
I have some ideas along these lines, but I think I'm a bit farther out than NZ Bear's system. Why simply say "Go to some other blog" when you don't have to? I think the best idea is to make the blog survive and operate as normally as possible in the midst of a DDoS attack.
This is easily doable; we have the technology. Making it cheap is going to be the hardest part.
This is easily doable; we have the technology. Making it cheap is going to be the hardest part.
Posted by: Michael Hampton at July 10, 2006 01:06 PM (FVbj6)
4
An "Akamaized Host" is going to give you a huge bandwidth bill, those hosts use a "blended" carrier solution with around 5+ ISP's, and use proprietary devices [like FlowControl™] that do route table optimization of traffic -- that sort of bandwidth is going to cost you around $50-100 per mbit -- as some DDOS are cable of dropping a 100mbit circuit easily, as most people do not own a circuit, and pay a price above the true carrier cost, a substained DDOS attack can create excess bandwidth bills of two-three thousand dollars, easily, in a very short time.
Posted by: davec at July 10, 2006 01:10 PM (voZp6)
5
call me stupid but why was the web not designed with DSoS attacks in mind ?
Posted by: rob at July 10, 2006 02:28 PM (QpkBe)
6
rob:
because the way the specifications that determine how the web works, predated any of the abuse.
Just like when SMTP [mail protocol] was built, there were no spammers, just about all spam control is third-party addons, and even the latest mail servers do only very basic tests to check for spam, some of the specifications need a major rewrite to fix the problems that are being abused.
because the way the specifications that determine how the web works, predated any of the abuse.
Just like when SMTP [mail protocol] was built, there were no spammers, just about all spam control is third-party addons, and even the latest mail servers do only very basic tests to check for spam, some of the specifications need a major rewrite to fix the problems that are being abused.
Posted by: davec at July 10, 2006 02:36 PM (voZp6)
7
A DDOS attack uses the Web's strengths to flood a target website, thus shutting it down. So in a sense the Web was designed with DDOS in mind, but the DDOS attacker is exploiting the underlying protocol as well as the distributed nature of the Web to attack a host.
Posted by: Agent Meatball at July 10, 2006 02:53 PM (30FRH)
Posted by: rob at July 10, 2006 05:01 PM (QpkBe)
9
Think the slashdot effect, but with one idiot instead of millions. 
The trick is to find the one idiot...
The trick is to find the one idiot...Posted by: Michael Hampton at July 10, 2006 08:05 PM (FVbj6)
10
It's bad enough just keeping the spammers down, never mind the DDoS bastiches.
Posted by: Pixy Misa at July 11, 2006 02:38 AM (FRalS)
11
Speaking of spam, let's see if this speeds the comments up a bit...
Posted by: Pixy Misa at July 11, 2006 02:42 AM (FRalS)
12
Oops. No.
Posted by: Pixy Misa at July 11, 2006 02:47 AM (FRalS)
33kb generated in CPU 0.0138, elapsed 0.1104 seconds.
34 queries taking 0.1019 seconds, 167 records returned.
Powered by Minx 1.1.6c-pink.
34 queries taking 0.1019 seconds, 167 records returned.
Powered by Minx 1.1.6c-pink.
