Hacker News Reader

Comment by kazen44 | Hacker News Reader

to be fair, you reach a certain point when the only options left for DDoS protection are Remote Triggered blackholing on your edge.

This results in an entire /24 network not being routed to your network and being dropped by your peer instead.

View on HN

That's not true. I work for a company that sells DDoS mitigation products to large network operators like Cogent for helping them deal with exactly these kinds of attacks in a much more sane manner than, "oy, just blackhole the destination and head out to lunch."

Either Cogent didn't buy our product (or a competitor's equivalent), or they have a network op who's a fresher and only knows how to blackhole things. Either way, it's a bad look for Cogent.

That is not a new look for cogent.

I remember at one point back in 2009 or so I wasn’t able to download from one of SourceForge’s mirrors. Turned out the reason for that was that Cogent had cut off my ISP (Telia) for some weird reason. IIRC Cogent and Telia hadn’t agreed on a peering policy, so Cogent just said whatever, we’ll cut you off (:

We were a Cogent customer for years. Blackhole was there one and only tool for DDoS. Eventually we just left.

Are there upstream providers in the US or EU that are known to deal with this kind of attacks in a more thoughtful way?

For a blackhole /32 (single IP) I believe is allowed in most ISP/INP.

Many ISP also have DDOS mitigation using bgp flowspec to block dirty traffic only and let valid traffic pass through.

Which is a totally reasonable way of going about the problem, of course. /s

Nobody has ever accused Cogent of being reasonable or competent.

Reply on news.ycombinator.com