0

I'm looking at how to try and prevent DDOS attacks before I launch a website as I will expect lots of online 'booters' to attack the server.

I've read through lots of threads on here and stackoverflow and realised that at my own server its not worth setting anything up as the damage is already being done.

This means I can either have a reverse proxy or try and work with my hosting provider.

What i'm trying to understand is how null routing traffic is effective.

Lets say that I have been able to identify the pattern of an attack and know which packets are from the attack, If I tell my hosting provider this and they decide to black hole these packets, isn't this still impacting their infrastructure?

Because the bandwidth is still be used in order for the attacker to send the packet in the first place, they can keep sending them regardless of receiving no response so all the hosting provider is doing is keeping my service up but still taking the damage?

Is this meant to make the attacker give up on the attack since the intended targets service is still up?

And finally, is the only actual solution to ddosing by having more bandwidth than the attacker?

1

If I tell my hosting provider this and they decide to black hole these packets, isn't this still impacting their infrastructure?

Yes, but that's their problem. If it gets bad enough, they'll ask their upstream provider to null-route too, and so on and so forth. At some point, someone has a big enough pipe to absorb it.

| improve this answer | |
  • Thanks for the quick answer, does this mean the only real solution is just having more bandwidth than the attacker? Apart from attacks that target server side processing. – Simon Nov 4 '15 at 16:04
  • @Simon Fundamentally, yes. Providers like Cloudflare may be of use here. – ceejayoz Nov 4 '15 at 16:07
  • perfect answers, exactly what I was looking for, thanks very much. – Simon Nov 4 '15 at 16:07
1

I've read through lots of threads on here and stackoverflow and realised that at my own server its not worth setting anything up as the damage is already being done.

That depends heavilly on the particular attack, if it's a simple UDP flood to an unused port there probablly isn't much point in doing anything. If it's something more clever and the total attack bandwidth is within what your server's network port can cope with then there may be mitigations you can consider.

Because the bandwidth is still be used in order for the attacker to send the packet in the first place, they can keep sending them regardless of receiving no response so all the hosting provider is doing is keeping my service up but still taking the damage?

Your providers first priority is generally to keep their other clients services up (or bring them back up if they are down). Keeping your services up (or bringing them back up) when you are under attack is likely to be a much lower priority. Especially if you have a low end account.

Keeping other client's services up means blocking the attack traffic before it reaches a link with insufficient capacity to carry it. Depending on how much capacity your provider has they may be able to implement these blocks themselves or they may have to talk to their upstreams and peers.

The simplest way to block is based on destination IP address but of course that means that they block your legitimate traffic at the same time as the attack traffic.

Keeping your service up is harder, it means finding a way to distinguish the attack traffic from the legitimate traffic and implementing that descision at a point in the network where there is sufficient capacity. Depending on the size of the attack your ISP may be able to help you with it, or you may find that it's beyond their abilities to deal with any you have to deal with specialist DDOS mitigation providers.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.