I asked this question on stackoverflow but couldn't get any answers and I even got a down vote as a present so that I'll try my luck out here. I did some research about this problem and couldn't find anything useful. Think of a corporate which has hundreds of users and these users try to reach our web application. These users will have the same external ip address that goes to internet. How does the DDos preventing products (CloudFlare etc.) handle this?

It seems to me that they can't just look into the IP and say "ok we got so many requests from this IP, lets ban it". They for example should look into session_id or something similar which travels with cookie in http request. How do they work with corporate networks?

closed as off-topic by schroeder May 23 '17 at 15:03

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    please do not cross-post on StackExchange!!! – schroeder May 23 '17 at 15:02
  • 2
    this is a question for CloudFlare, isn't it? – schroeder May 23 '17 at 15:02
  • @schroeder what part did you not understand about "CloudFlare etc"? – sotn May 24 '17 at 6:39
  • @schroeder And I really didn't understand your put on hold reason. How can this question be off topic? Since when web attacks are not considered as a security problem? I deleted the question from network.stackexchange.. – sotn May 24 '17 at 6:51
  • 1
    @mgjk Yes. I mean the vendor is not important here. I just want to know how can a DDos prevention system differentiate a legit request from bad requests specifically for corporate networks (because for non-corporate users, the steps are simple since there is only 1 user and 1 IP whereas for corporate network N users and 1 IP..) – sotn May 24 '17 at 13:35

"ok we got so many requests from this IP, lets ban it"

Yes, you are right. More than the ip addresses, Cloudflare scan to see what resource they are requesting, what payload they are posting, how frequently they're making requests, etc.

So, to answer your question Cloudflare doesn't just blacklist an ip address of possible DOS, instead they apply a complex algorithm to determine if the sourcing address is a bot or legitimate user. But it is safe to agree that even thousands of requests from multiple internal systems to a (cloudflare) protected web application is easily handled without bottleneck due to their caching policy, updates the cache for your web app every hour.

Also understand that after implementing cloudflare or similar services to your Web-Application, the request for resources reaches your Web-Application only if the Cloudflare doesn't have it cached. By the time the 10th request is made , It is already cached in their data centers around the world and the next subsequent requests are distributed to close hop Cloudflare data centers from there onwards.

I urge you to read through this post in Cloudflare ( click HERE ) to understand the technical details.

I hope this gives u a gist of Cloudflare like service implementation. And these days a few hundred-thousand requests from a single ip-address is not treated as a threat but are only analyzed more for possibilities (as they are aware that it might be an intranet of systems requesting services from the same Web Application)

  • But it still seems to me like it can be possible for a bad person to imitate the requests in a way that these DDos prevention products interpret these requests as normal. It might return the response from cache but still; my server will take 50% of the requests. I mean these complex algorithms are not magic, how can they be 100% positive about a request being a part of a DDos attack? – sotn May 24 '17 at 7:20
  • 1
    DDOS presently involve multiple computers , usually a group of botnets. And current Network hardware appliances are capable of dealing with Gigabits of requests...Now that being said, Most Security organizations track and blacklist these botnets as and when they arise. The complex algorithm also includes this process I believe. Even the highest recorded DDOS impact to French data hosting provider OVH (1.5Tbps)(DDOS by IoT) was controlled in 2-3 hours. What I'm trying to imply by this is , You may not even receive 50% of the DDOS traffic behind a cloudflare. – Adib N May 24 '17 at 10:05
  • Thanks, that clarified things more. I hadn't thought about the botnets and the processing power of network hardware appliances (I undermined them I guess). And I guess the number of requests that these bots send are so much higher than the users in a big corporation can send so that even if the botnet is not blacklisted, it may not be that hard for a DDos Prevention System to differentiate legit and bad requests after all.. – sotn May 24 '17 at 13:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.