2

A client of mine has a website on a shared hosting account, and one of the other accounts on that server was targeted by a DDOS attack, which of course brought all of the websites on that server down. We're talking about moving to a dedicated server or VPS to help mitigate this in the future. I am fully aware that this won't prevent DDOS attacks from ever happening, but being on their own server will at least reduce the risk because they won't be caught in someone else's collateral damage (as much?).

But I'm wondering if being on a VPS will have any effect at all in this regard -- yes the system is isolated from other systems at the software level, but my understanding is that there are still several virtual machines sharing one physical machine (and hence one physical network connection). My question is: does the quasi-isolation that a VPS offers provide any kind of benefit in terms of reducing the chances of being caught up in someone else's DDOS attack, or do you only get that kind of benefit from being on a separate physical server?

Improve this question
6

The risks will be slightly reduced, but not eliminated obviously.

In general, there will be fewer customers on a VPS host than reside on a shared webserver, making fewer potential targets. Of course this is all completely theoretical, and there's literally nothing that can stop a determined DDoS attack short of having a massive infrastructure scaled like say Google or Facebook.

Improve this answer
6
  • So it sounds like you're saying there is absolutely no technical benefit to be had in this context of a VPS over a shared host (just the happy side effect that fewer customers are on each server with VPS hosting). Thanks -- good to know. – Jordan Lev Jul 6 '11 at 22:04
  • Yes, that's what I'm saying (at least with regards to DDoS). – EEAA Jul 6 '11 at 22:05
  • And just to evidence this, even huge VPS providers like mediatemple still lose parts of their grid when one of their customers is under a large DDoS attack. – MrTuttle Jul 6 '11 at 22:29
  • Pile of crap, just because you are on VPS that does not guarantee you more resources nor does it guarantee that resources will not be saturated. In both cases you are highly suspectable to denial of service attacks, distributed or not unless more is done on the network level to proxy/filter/mitigate the attacks. – Aleksey Korzun Jul 6 '11 at 23:41
  • Aleksey, what's a pile of crap? The answer, or VPS's in general? I understand that you're always susceptible to DOS's and there's no guarantees, but from a pure logic point of view isn't it true that if fewer potential targets are sharing a network connection than you have less of a chance of being on that connection that is targeted (assuming you're not the one being targeted yourself)? – Jordan Lev Jul 7 '11 at 0:22
9

The risk of being attacked is the same but

any decent provider that does some kind of mass hosting should have appropriate infrastructure to deal with attacks. That means your upstream should be more reliable (but the same is true for any provider that cares about it's own infrastructure)

There's no way anyone can survive a DDoS attack (given the attack is sufficiently large). Basically it boils down to infinite resources vs. finite resources.

Simple example:

Your provider has:

  • a full 10GBit/s line to every server
  • Servers powerfull enough to saturate the link

Attacker has:

  • total bandwith of 5GBit/s

You can (in theory) survive the attack, in contrast to

Attacker has:

  • total bandwith of 12GBit/s

there's nothing you can possibly do. If the attacker just sends a simple SYN-flood attack to you webserver you can't react to the attack because there's no way for you to log in over the line, it's already saturated (assuming it's the only way you reach that server).

SYN flood protection won't help because the 12GBit incoming will simply saturate the 10GBit pipe by sheer amount of data (hell 12GBit of SYN packets with no payload that has been sent yet is a lot). Especially when there are thousands of boxes and not 2 or 3 boxes....

iptables won't help you because by the time iptables can take care of the situation the pipeline of your network card is already full.

The only thing that will help is someone upstream that can cope with the incoming traffic to block each of boxes sending requests, but I doubt that with a cheap VPS (even if it's a few hundred bucks/month) anyone will care to take measures because of your VPS. They will only care because it hurts their own infrastructure, probably they'll just take your VPS offline so that the attacker thinks he or she has reached the goal and stop attacking early.

Keep in mind that with a VPS you are still affected by attacks to another (possibly completely unrelated) VPS on the same physical server. By using a physical server you'll at least be only subject to attacks that are targeted at your customers not some random customer of your provider that happens to be on the same physical host but in another VPS.

(I'm tired and english is not my native language, I apologize if none of this makes sense)

Improve this answer
4
  • +1 good answer. This is the answer I would have written if I had the patience to do so this afternoon. :) – EEAA Jul 6 '11 at 22:41
  • The DDoS is more then the size of the packets. It's the PPS that kills you, big but slow attacks are easily blocked. – Aleksey Korzun Jul 6 '11 at 23:45
  • I do very much appreciate the effort and detail of this answer, but ErikA: your answer above more directly answers my actual question, whereas this is mostly background information that while useful to know does not directly address my issue. – Jordan Lev Jul 7 '11 at 0:18
  • I'm not referring to package size anywhere except for the one reference about SYN packages. Feel free to edit to make it clearer – Martin M. Jul 7 '11 at 20:13
1

No

Improve this answer
0

Its not about the resources on the machines but your VPS has its own IP and with shared hosting you have no dedicated IP address.

So its easier to block a DDOS to a VPS because the traffic has an unique destination IP.

Improve this answer
0

A providers first response to a large DDoS attack is going to be damage limitation. Often that means blocking by destination IP address.

If you share an IP address with other people then you are likely to be caught-up in those blocks.

Shared web hosting services, especially non-https ones often use shared IP addresses. VMs and dedicated servers have their own network stacks and hence usually* have their own IP addresses.

A dedicated has the advantages over a VM that you aren't sharing CPU/Ram/storage resources and while you are at some point going to be sharing network resources the links between network devices in the provider network are likely to be bigger than the links to individual servers.

* Due to IPv4 shortages one provider i'm aware of only gives an IPv6 address by default and relies on a reverse proxy for IPv4. This setup may increase DDOS vulnerability as the reverse proxy may be hit with a DDOS.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.