2

We're trying to protect some sites that are primarily located in Asia using distributed caching. These sites commonly come under DDOS attacks. We are using fail2ban, but still have two problems:

  1. Many users are coming from behind common firewall/NAT configurations so they appear to have the same address. Many legitimate requests might be blocked based on request per second rules.

  2. We see moderate DDOS attacks from many different addresses, for example, 6000 addresess make a few requests over a day, all on the same page. It's not clear how to block these, since there are so many making few requests. Right now they aren't really a problem, but if the number of clients were increased, or aggressive cache busting applied we'd be in trouble. How do we detect and protect against this kind of attack?

2
  • Have you tried a service like www.cloudflare.com ?
    – DKNUCKLES
    May 8, 2012 at 18:06
  • 6000 address making only a 'few' requests over a day, all on the same page? Maybe you have a bunch of readers for a daily webcomic that posts at an unknown time? It doesn't really sound like a deliberate attack per-se. Jun 14, 2012 at 23:06

2 Answers 2

4

I would suggest that the simplest defense is probably to buy access to a CDN that provides protection against DoS. Take a look at Cloudflare and Cloudfront. You could also look at MaxCDN, Akamai, EdgeCast, level3, Rackspace, VPS, Cotendo, Limelight, Cachefly, Highwinds, and many others.

Why use a CDN? Three reasons.

First, it will benefit both performance and security. It will make your site faster. And, if you get a flash cloud or an unexpected spike of visitors, it'll help keep your site fast, responsible, and available. And, of course, if you come under DOS attack, the CDN has the capacity to absorb the traffic and ensure your site stays available. So, this is a win-win for both security and site performance. (How often do you see that?)

Second, it is affordable. A CDN is relatively inexpensive, and is almost certainly cheaper than the staff time it would take for you to futz around with defending yourself against DOS attacks and to keep up with the latest DOS techniques.

Third, the CDN can probably do a better job than you can. Because of its scale, the CDN probably sees thousands of DOS attacks a year (on hundreds or thousands of web sites), so it has a chance to accumulate statistics on the common patterns, learn how to detect DOS attacks, and work out what defenses work best. Also, because of its scale, the CDN may be able to afford for its employees to stay up-to-date on the latest attack techniques being used in the wild. And, the CDN may be able to afford to develop custom automated defenses, since they'll be applicable to all its customers.

So, take a look at CDNs as a possible defense. That may be simpler to deploy and more effective than the approach you are taking.

0

If you want to differentiate between clients using the same IP, then you need to look at the data which is being exchanged to profile the TCP stack or identify based on user-agents / cookies / referer. This means you are still exposed to sloloris type DOS - unless you've got an event based server (which would also allow you to tar-pit the DOS requests). If this is too much of a change from where you are just now, then you're just going to have to live with banning the IPs or provisioning enough capacity to soak up the punishment.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .