Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by tbrownaw | Hacker News Reader

Full thread

tbrownaw·

The thing about a DDoS attack, is that it's a significantly higher traffic volume that the target normally sees.

So, a "sufficiently large" site might well not even notice if you tried to DDoS them.

I would assume Google and Facebook (and Twitter) to be examples of such "sufficiently large" sites.

View on HN

I was told a story by a friend who works for a CDN (big one that handles lots of online video):

"Hey - look at this, I think someone's trying to DDOS us."

> "A hundred thousand requests a second? Neat - is it affecting our latency?"

"Um... no, not really."

> "Give me a shout if they hit a million a second."

so it really is just handling traffic volume?

Technically yes. I am no expert but I understand the best approach is to divert attack traffic to a sinkhole, i.e. handle attack traffic, not block it.

Except there's no provable way to distinguish between "attack traffic" and normal traffic. You're also diverting your normal users anyhow, so the DDOS is still working as intended.

>Except there's no provable way to distinguish between "attack traffic" and normal traffic.

Depends on the DDOS method used. Stuff like the NTP abuse of a few years ago could be sinkholed without effecting any real users. HTTP DDOS has pretty low impact per node so most attackers use some form of amplification attack with other protocols.

Oh there are totally heuristics you can use. For example, limiting traffic from geolocations in which it shouldn't be showing high traffic usage (8 million hits per minute from China at 3am Beijing time?).

The key word is "provable."

Reply on news.ycombinator.com