Hacker News Reader

The number of exclusively layer 7 attacks we've seen since beginning this project is basically zero.

I'm happy that for you that you don't see these attacks, because I can tell you that we see Layer 7 DDoS attacks frequently, but perhaps just go read HN story #1 about the Github DDoS.

View on HN

The Github attack was a volumetric flood, this most certainly has layer 3 properties.

The post clearly discusses layer7 floods which do not have layer3 properties (such as slowloris.pl, rudy.pl, etc.) which are uncommon.

It would be a safe bet to say that the Github attack had layer-3 properties.

After some investigation, we discovered that we were seeing several thousand HTTP requests per second distributed across thousands of IP addresses for a crafted URL.

That sounds like layer 7 to me.

This has layer3 properties, such as connection rate, and was most likely mitigated using layer 3 filtering.

Reply on news.ycombinator.com