Hacker News Reader

Comment by neilalexander | Hacker News Reader

Believe it or not, blocking ping at your router would have done absolutely nothing to prevent this, as those packets would likely have still been delivered to the router and possibly saturated the link anyway, regardless of whether the recipient was dropping them or not. That is why nearly all DoS flood-style attacks are UDP-based — unless you are behind a CGNAT or an upstream restrictive firewall, you can't really opt out of those packets being routed to you.

View on HN

Believe it or not, blocking pings at the router prevents said router from responding to pings, and this eliminates 50% of the problem on symmetric connections (and >50% on asymmetric connections).

Don't let perfect be the enemy of good.

> Don't let perfect be the enemy of good.

Better: Don't base your decisions on imaginary scenarios that haven't been relevant for decades.

There's no "good" in blocking ICMP packets and especially ping. You won't protect yourself from DDoS attacks but you might summon some obscure, hard to diagnose networking issues.

If you gave me your IP and your consent, I could rent a DDoS-for-hire service for lunch money and take you offline. They don't rely on their victims taking themselves offline with response packets.

Yep, having been a recent victim, the cheap 'booter' services are still doing NTP & DNS reflection attacks. They're easy to do and require very few resources on the part of the attacker. Flooding a 1G service to the point of total uselessness is trivial and cheap.

Sadly there's absolutely nothing you can do on your own firewall/router to block or mitigate them - your connection's downstream just gets flooded with UDP packets and becomes totally useless. The only mitigations/blocking can be done by your ISP and their connectivity partners.

> Believe it or not, blocking pings at the router prevents said router from responding to pings, and this eliminates 50% of the problem on symmetric connections (and >50% on asymmetric connections).

But if your downlink to clogged, it probably won't matter that much that your uplink is clear.

I've self-DoSed when 'downloading Linux ISOs' because the downlink was 100% saturated and I couldn't do much anything else because the ACKs for TCP packets couldn't get down easily (this was for something as basic as SSH sessions that suddenly got laggy when typing). I had to tell the software in question to only use ~90% of my downlink speed (DSL at the time).

> But if your downlink to clogged, it probably won't matter that much that your uplink is clear.

And if your [small] uplink is clogged, it probably won't matter that much that your [large] downlink is clear.

Reply on news.ycombinator.com