0

I asked this question on stackoverflow but couldn't get any answers and I even got a down vote as a present so that I'll try my luck out here. I did some research about this problem and couldn't find anything useful. Think of a corporate which has hundreds of users and these users try to reach our web application. These users will have the same external ip address that goes to internet. How does the DDos preventing products (CloudFlare etc.) handle this?

It seems to me that they can't just look into the IP and say "ok we got so many requests from this IP, lets ban it". They for example should look into session_id or something similar which travels with cookie in http request. How do they work with corporate networks?

Improve this question
11
  • 2
    please do not cross-post on StackExchange!!!
    – schroeder ♦
    May 23, 2017 at 15:02
  • 2
    this is a question for CloudFlare, isn't it?
    – schroeder ♦
    May 23, 2017 at 15:02
  • @schroeder what part did you not understand about "CloudFlare etc"?
    – yakya
    May 24, 2017 at 6:39
  • @schroeder And I really didn't understand your put on hold reason. How can this question be off topic? Since when web attacks are not considered as a security problem? I deleted the question from network.stackexchange..
    – yakya
    May 24, 2017 at 6:51
  • 1
    @mgjk Yes. I mean the vendor is not important here. I just want to know how can a DDos prevention system differentiate a legit request from bad requests specifically for corporate networks (because for non-corporate users, the steps are simple since there is only 1 user and 1 IP whereas for corporate network N users and 1 IP..)
    – yakya
    May 24, 2017 at 13:35

1 Answer 1

Reset to default
1

"ok we got so many requests from this IP, lets ban it"

Yes, you are right. More than the ip addresses, Cloudflare scan to see what resource they are requesting, what payload they are posting, how frequently they're making requests, etc.

So, to answer your question Cloudflare doesn't just blacklist an ip address of possible DOS, instead they apply a complex algorithm to determine if the sourcing address is a bot or legitimate user. But it is safe to agree that even thousands of requests from multiple internal systems to a (cloudflare) protected web application is easily handled without bottleneck due to their caching policy, updates the cache for your web app every hour.

Also understand that after implementing cloudflare or similar services to your Web-Application, the request for resources reaches your Web-Application only if the Cloudflare doesn't have it cached. By the time the 10th request is made , It is already cached in their data centers around the world and the next subsequent requests are distributed to close hop Cloudflare data centers from there onwards.

I urge you to read through this post in Cloudflare ( click HERE ) to understand the technical details.

I hope this gives u a gist of Cloudflare like service implementation. And these days a few hundred-thousand requests from a single ip-address is not treated as a threat but are only analyzed more for possibilities (as they are aware that it might be an intranet of systems requesting services from the same Web Application)

Improve this answer
3
  • But it still seems to me like it can be possible for a bad person to imitate the requests in a way that these DDos prevention products interpret these requests as normal. It might return the response from cache but still; my server will take 50% of the requests. I mean these complex algorithms are not magic, how can they be 100% positive about a request being a part of a DDos attack?
    – yakya
    May 24, 2017 at 7:20
  • 1
    DDOS presently involve multiple computers , usually a group of botnets. And current Network hardware appliances are capable of dealing with Gigabits of requests...Now that being said, Most Security organizations track and blacklist these botnets as and when they arise. The complex algorithm also includes this process I believe. Even the highest recorded DDOS impact to French data hosting provider OVH (1.5Tbps)(DDOS by IoT) was controlled in 2-3 hours. What I'm trying to imply by this is , You may not even receive 50% of the DDOS traffic behind a cloudflare.
    – Adib N
    May 24, 2017 at 10:05
  • Thanks, that clarified things more. I hadn't thought about the botnets and the processing power of network hardware appliances (I undermined them I guess). And I guess the number of requests that these bots send are so much higher than the users in a big corporation can send so that even if the botnet is not blacklisted, it may not be that hard for a DDos Prevention System to differentiate legit and bad requests after all..
    – yakya
    May 24, 2017 at 13:45

Not the answer you're looking for? Browse other questions tagged .