Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A client of mine has a website on a shared hosting account, and one of the other accounts on that server was targeted by a DDOS attack, which of course brought all of the websites on that server down. We're talking about moving to a dedicated server or VPS to help mitigate this in the future. I am fully aware that this won't prevent DDOS attacks from ever happening, but being on their own server will at least reduce the risk because they won't be caught in someone else's collateral damage (as much?).

But I'm wondering if being on a VPS will have any effect at all in this regard -- yes the system is isolated from other systems at the software level, but my understanding is that there are still several virtual machines sharing one physical machine (and hence one physical network connection). My question is: does the quasi-isolation that a VPS offers provide any kind of benefit in terms of reducing the chances of being caught up in someone else's DDOS attack, or do you only get that kind of benefit from being on a separate physical server?

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

The risks will be slightly reduced, but not eliminated obviously.

In general, there will be fewer customers on a VPS host than reside on a shared webserver, making fewer potential targets. Of course this is all completely theoretical, and there's literally nothing that can stop a determined DDoS attack short of having a massive infrastructure scaled like say Google or Facebook.

share|improve this answer
    
So it sounds like you're saying there is absolutely no technical benefit to be had in this context of a VPS over a shared host (just the happy side effect that fewer customers are on each server with VPS hosting). Thanks -- good to know. –  Jordan Lev Jul 6 '11 at 22:04
    
Yes, that's what I'm saying (at least with regards to DDoS). –  EEAA Jul 6 '11 at 22:05
    
And just to evidence this, even huge VPS providers like mediatemple still lose parts of their grid when one of their customers is under a large DDoS attack. –  MrTuttle Jul 6 '11 at 22:29
    
Pile of crap, just because you are on VPS that does not guarantee you more resources nor does it guarantee that resources will not be saturated. In both cases you are highly suspectable to denial of service attacks, distributed or not unless more is done on the network level to proxy/filter/mitigate the attacks. –  Aleksey Korzun Jul 6 '11 at 23:41
    
Aleksey, what's a pile of crap? The answer, or VPS's in general? I understand that you're always susceptible to DOS's and there's no guarantees, but from a pure logic point of view isn't it true that if fewer potential targets are sharing a network connection than you have less of a chance of being on that connection that is targeted (assuming you're not the one being targeted yourself)? –  Jordan Lev Jul 7 '11 at 0:22
show 1 more comment

The risk of being attacked is the same but

any decent provider that does some kind of mass hosting should have appropriate infrastructure to deal with attacks. That means your upstream should be more reliable (but the same is true for any provider that cares about it's own infrastructure)

There's no way anyone can survive a DDoS attack (given the attack is sufficiently large). Basically it boils down to infinite resources vs. finite resources.

Simple example:

Your provider has:

  • a full 10GBit/s line to every server
  • Servers powerfull enough to saturate the link

Attacker has:

  • total bandwith of 5GBit/s

You can (in theory) survive the attack, in contrast to

Attacker has:

  • total bandwith of 12GBit/s

there's nothing you can possibly do. If the attacker just sends a simple SYN-flood attack to you webserver you can't react to the attack because there's no way for you to log in over the line, it's already saturated (assuming it's the only way you reach that server).

SYN flood protection won't help because the 12GBit incoming will simply saturate the 10GBit pipe by sheer amount of data (hell 12GBit of SYN packets with no payload that has been sent yet is a lot). Especially when there are thousands of boxes and not 2 or 3 boxes....

iptables won't help you because by the time iptables can take care of the situation the pipeline of your network card is already full.

The only thing that will help is someone upstream that can cope with the incoming traffic to block each of boxes sending requests, but I doubt that with a cheap VPS (even if it's a few hundred bucks/month) anyone will care to take measures because of your VPS. They will only care because it hurts their own infrastructure, probably they'll just take your VPS offline so that the attacker thinks he or she has reached the goal and stop attacking early.

Keep in mind that with a VPS you are still affected by attacks to another (possibly completely unrelated) VPS on the same physical server. By using a physical server you'll at least be only subject to attacks that are targeted at your customers not some random customer of your provider that happens to be on the same physical host but in another VPS.

(I'm tired and english is not my native language, I apologize if none of this makes sense)

share|improve this answer
    
+1 good answer. This is the answer I would have written if I had the patience to do so this afternoon. :) –  EEAA Jul 6 '11 at 22:41
    
The DDoS is more then the size of the packets. It's the PPS that kills you, big but slow attacks are easily blocked. –  Aleksey Korzun Jul 6 '11 at 23:45
    
I do very much appreciate the effort and detail of this answer, but ErikA: your answer above more directly answers my actual question, whereas this is mostly background information that while useful to know does not directly address my issue. –  Jordan Lev Jul 7 '11 at 0:18
    
I'm not referring to package size anywhere except for the one reference about SYN packages. Feel free to edit to make it clearer –  Server Horror Jul 7 '11 at 20:13
add comment

No

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.