I understand that there are network and IP-level mitigations for DDoS attacks, but I'm not clear on how they work in practice.

My hope is that this question and answer will help to frame how the core transit routers handle these attacks, and also how a single client host (be it a proxy or end-device) can handle it, without basically removing it from the Internet.

P.S. I've edited this question to address the "too broad" flag. If this is still "too broad", I'll take it down if this doesn't fit SE's goals. Cheers.

  • Do you know how the Internet works? BGP, AS, communities, all that stuff. Because this is prerequisite to understand the correct answer :) – Nikita Kipriyanov Oct 15 '19 at 18:11
  • @NikitaKipriyanov Howdy. I have a basic understanding of BGP, Autonomous Systems, but not "communities". My hope is to read an answer that is geared for those with a basic understanding of how the Internet is organized, but not how the implementation details actually deal with DDoSes. Can I learn more, and have I forgotten some things? Yes, probably. :) But, this question hopefully will be useful for more than just myself. I did search for the question, and didn't see an answer. – Jesse Adelman Oct 15 '19 at 18:16
  • 3
  • 3
  • 1
    More bandwidth than the attacker, and filters to drop the badness. Larger attacks exceed what a single link/node/datacenter can handle, so a distributed solution is likely necessary. – John Mahowald Oct 16 '19 at 15:09

Short answer is CDN. Take a look at CloudFlare as an example.




In a nutshell: CDN both absorbs the load from multiple remote hosts and provides scalable way to handle filtering, these two prevent your single server CPU from need to process DDoS organizer’s TCP packets AND (more important!) from exhausting your server Internet uplink.

  • Sadly, this isn't really an answer, more a link to contact Cloudflare sales, with diagrams. :) It's about what they do, not how they do it. – Jesse Adelman Oct 15 '19 at 18:57
  • 2
    I’ve added more links and sort of TL;DR thing. Hope this helped :) – RiGiD5 Oct 16 '19 at 4:25
  • Isn't CDN really only for static assets, though? (Of course, that's good to have!) Is that really "it" to DDoS from a networking perspective? How do the CDNs themselves prevent DDoSes on their own networks? In asking this question, I was hoping to foster an answer that pulls back the curtain a bit on how things actually work, not what products are available to buy for those of us making applications and small networks. Thank you for contributing! We're getting there! :D – Jesse Adelman Nov 1 '19 at 18:50
  • Fancy firewall rules, lots of cheap bandwidth and compute, routing tricks, deep IP protocol knowledge. Similar to scaling up (or rather, scaling out) any other service, but with a stupid high packets per second volume. – John Mahowald Nov 2 '19 at 4:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.