Hacker News Reader

Comment by bcook | Hacker News Reader

QoS can help with DDoS if the DDoS is L7, but most DDoS attacks are bandwidth exhaustion attacks, which requires upstream mitigation.

I completely agree that "tc" is one of the most confusing CLI programs I have encountered. tc & iptables pushed me away from Linux (for router purposes) to *BSD and pf has been a refreshing experience.

View on HN

Come on, it's not so hard. You mark the packages in the mangle table and you distribute the defined bw with tc.

OK, I confess... all my life I've reused a tc script I inherited from a gentoo sysadmin.

It works, I edit the available bandwitch and magic happens. The iptables cmd is more easy to understand and I even did an output parser and input generators, but tc is hard.

share the magic script. We might learn something.

It's under NDA, but what if I tell you everything networking related are numbers?

It just uses a packet mark convention. There is no magic.

Sounds like a github Gist! I'm also interested in this.

I've really enjoyed pf on OpenBSD over the years. My only frustration has been the ever-changing backwards-incompatible rule syntax which perpetually makes large swaths of documentation useless, including the most recent printed book on pf and numerous online sources.

man pf.conf .. always works :)

Your are so right! However most of the DDoS attacks I have experienced were amateur, L7 (wordpress, POSTs, etc).

Reply on news.ycombinator.com