New answers tagged

4

As @techraf and @josef commented, all DDoS providers have the same challenges: To effectively identify DDoS traffic, a mitigation provider needs to be connected inside your encryption termination point, or at least be a Man In the Middle. Your concern regarding CloudFlare is the same concern you should have with them all. If you want DDoS mitigation, ...


6

I work for CloudFlare so maybe I can shed some light on how we do things. Fundamentally, CloudFlare uses an Anycast network design; this means that network traffic has no control to where it is routed and it is automatically routed to the closest available host. Computers compromised by botnets are typically distributed throughout the world in different ...


1

You are right in saying the ability to stop ddos attacks are a function of finance. Cloudflare's use of anycast DNS returns DNS answers based on geography. You can quench attacks by nxdomaining clients that exhibit high bursty connection or DNS queries. There are a few ways to return DNS queries based on geographic fencing. One way is to incorporate geoip ...


2

Large scale DDoS attacks usually aggregate at a target's access router where their impact is strongest. Whether multiple DDoS attacks of 500Gbps or multiple DDoS attacks of 1Tbps should be handled by network providers' DDoS defenses ideally.Here's an interesting article on the professionalisation of attacks and service providers/managed service providers ...


1

Beside asking the how you should consider asking the why. Case 1: you want to check how your service will be impacted by a DDoS -- this is possibly a reasonable thing to do. I would say that these are load tests taken to the extreme. In that case you need to test a clone of your whole service, including the infrastructure. You do not know what will fail ...


2

Fundamentally, the way a Distributed Denial of Service works is by flooding a companies bandwidth with to much traffic. The actual attacks may differ in source and style, but they share the same goal. There is no point in testing a DDoS attack, because no matter how much bandwidth you have it is always possible for it to be overwhelmed. It depends entirely ...


8

If you are performing load testing at high packet rates, the most safe way is to isolate it completely from the rest of the network. For example, you can connect two servers by direct 10GBps link without switch, and use another LAN connection on benchmarking server to ssh to one server to run the test. Another way is to provision servers in Public Cloud ...


5

The single best plan is not to do this. It rarely serves any purpose, as DDoS will work against you. That's a given. It is so easy to create a high volume attack now it's not even worth trying to do more than the usual load tests. You are much better served by implementing DDoS mitigation. If, however, you must test, try the following: test a non-...



Top 50 recent answers are included