Hacker News Reader

so it really is just handling traffic volume?

Technically yes. I am no expert but I understand the best approach is to divert attack traffic to a sinkhole, i.e. handle attack traffic, not block it.

Except there's no provable way to distinguish between "attack traffic" and normal traffic. You're also diverting your normal users anyhow, so the DDOS is still working as intended.

>Except there's no provable way to distinguish between "attack traffic" and normal traffic.

Depends on the DDOS method used. Stuff like the NTP abuse of a few years ago could be sinkholed without effecting any real users. HTTP DDOS has pretty low impact per node so most attackers use some form of amplification attack with other protocols.

Oh there are totally heuristics you can use. For example, limiting traffic from geolocations in which it shouldn't be showing high traffic usage (8 million hits per minute from China at 3am Beijing time?).

The key word is "provable."

Reply on news.ycombinator.com