TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: How is DDoS protection implemented?

260 点作者 elephant0xffff大约 7 年前
The big services (Google, Cloudflare, etc.) provide DDoS attack mitigation (and seem to succeed), but details on their tactics are rare (at least I did not find in-depth information on that).<p>I guess to make this work well you have to do classification (regular request vs. malicious) on several protocol layers and then reroute or drop packets accordingly. But how does that prevent severe service degradation - you still have to do some kind of work (in computation and energy) on the listening side or can fat edge-servers just eat that up?

17 条评论

tptacek大约 7 年前
I was lead developer on Arbor Network&#x27;s DDoS product in the early 2000s (I left in 2005 to start Matasano Security). My information on this is surely dated, but people seem to still be using the same terminology now as then.<p>You can break down DDoS into roughly three categories:<p>1. Volumetric (brute force)<p>2. Application (targeting specific app endpoints)<p>3. Protocol (exploiting protocol vulnerabilities)<p>DDoS mitigation providers concentrate on 1 &amp; 3.<p>The basic idea is: attempt to characterize the malicious traffic if you can, and or divert all traffic for the target. Send the diverted traffic to a regional &quot;scrubbing center&quot;; dirty traffic in, clean traffic out.<p>The scrubbing centers buy or build mitigation boxes that take large volumes of traffic in and then do heuristic checks (liveness of sender, protocol anomalies, special queueing) before passing it to the target. There&#x27;s some in-line layer 7 filtering happening, and there&#x27;s continuous source characterization happening to basic network layer filters back towards ingress.<p>You can do pretty simple statistical anomaly models and get pretty far with attacker source classification, and to track targets and be selective about what things need to be diverted.<p>A lot of major volumetric attacks are, at the network layer, pretty unsophisticated; they&#x27;re things like memcached or NTP floods. When you&#x27;re special-casing traffic to a particular target through a scrubbing center, it&#x27;s pretty easy to strip that kind of stuff off.
评论 #17061699 未加载
评论 #17061792 未加载
评论 #17061845 未加载
评论 #17061637 未加载
jedberg大约 7 年前
I worked on the eBay DDOS prevention system in the early 2000&#x27;s. My coworkers filed a patent on part of the system.<p><a href="https:&#x2F;&#x2F;patents.google.com&#x2F;patent&#x2F;US7992192" rel="nofollow">https:&#x2F;&#x2F;patents.google.com&#x2F;patent&#x2F;US7992192</a><p>Once the traffic was detected, the signature was sent to a second system that was a series of hardware optimized for layer 7 packet inspection. The devices were updated with signatures of current attacks, and then checked every incoming packet for that signature. Any packet that matched was parsed for where it was coming from, and then the router was updated to drop traffic from that source for a period of time.<p>As far as I know, today&#x27;s techniques are fairly similar, along with just having a whole lot of computers that can absorb the traffic.
评论 #17061957 未加载
评论 #17061812 未加载
AgentK20大约 7 年前
By far the biggest part of attack mitigation in my experience is out-scaling the attack. A well written and configured application stack can handle a decent amount of traffic itself before becoming bogged down processing malicious traffic, but at some point you&#x27;ll cap out either the application, the NIC, the upstream switch, the router, or the ISP line, if your application is running in just one place. To get around that, huge providers like the ones you listed are heavily multi-homed. This means they announce their traffic routes to the internet from multiple locations, so traffic naturally flows to the closest (hops wise, not necessarily geographically speaking) endpoint.<p>From there, you can add layers of protection ranging from simple things like blocking traffic that is obviously malicious (TCP flags, port numbers, etc) to more complex things like pattern recognition in both the overall trends of the data and on a per-packet basis. After you&#x27;ve decided with a decent certainty that it&#x27;s not malicious traffic, you pass it off to the actual backend service.<p>For systems that are designed to scale horizontally, that may be a neighboring machine (or even the same machine) in that data center. For single-homed backend systems that can&#x27;t scale horizontally to multiple locations, that &quot;clean&quot; traffic is then sent via some mechanism (possibly a GRE tunnel, possibly just raw internet traffic to a secret IP) to the backend service. Depending on the methodology used, the filtering may be a true bidirectional proxy, in which case the reply goes back to the scrubber and then out to the original sender, or it may be a unidirectional proxy, in which case the reply goes directly back to the original sender.<p>All attack mitigation works in some way like this, whether it be by designing your application from the beginning to be multi-homed and able to run in multiple datacenters, or by installing a separate mitigation layer that scrubs attack traffic.
bArray大约 7 年前
From my personal low-end server perspective (which has stood up to simple attacks from Russian IPs), I have the following:<p>1. Static page caching (in RAM ideally) - dynamically generated content will kill you quicker than anything else, especially calls to a database. WordPress is very easy to kill in it&#x27;s default state.<p>2. Kill high frequency requests from the same location as quickly as possible (make sure your response is less than the data they send you - ultimately you want their systems to be busier than yours). You want to free the port up as quickly as possible.<p>3. Move anybody you can identify as a legitimate user (credentials, low frequency requests) out to another server if possible.<p>Firewall wise, my system sits on the cloud, so usually high frequency traffic is the only issue I have to deal with. Interested to hear any advice of other people here.
评论 #17062436 未加载
oneplane大约 7 年前
It&#x27;s essentially still the same thing: having the bigger pipe.<p>A distributed DoS attack has many sources, and when including botnets on infected consumer systems you have legitimate source addresses&#x2F;devices as well. This defeats most &quot;blackhole the source&quot; options as the source is the same thing as legitimate visitors&#x2F;customers.<p>So for a DDoS that simply tries to saturate your link(s) and where you can&#x27;t blackhole the source, the only &#x27;protection&#x27; is having more bandwidth than the attacker(s) has (or have).<p>After that a few other things come in to play, attack-traffic from legit sources may have a pattern, so while you can&#x27;t blackhole upstream, you can prevent traffic with a pattern to get to the actual application&#x2F;site. This is relevant in cases where you might suffer from application overload before link overload. If your link can handle the DDoS traffic but your application can&#x27;t, you&#x27;re still screwed. (and with application I include load balancers, databases, storage etc.)
gbrayut大约 7 年前
Fastly had a good presentation about ddos trends and how they mitigate them at one of their recent Altitude conferences. Video at <a href="https:&#x2F;&#x2F;vimeo.com&#x2F;212305516" rel="nofollow">https:&#x2F;&#x2F;vimeo.com&#x2F;212305516</a> and the mitigation stuff starts around 14:45
NightlyDev大约 7 年前
The easy answer: Load balancing<p>Anycast is the most important piece of the puzzle, allowing you to route traffic to a bunch of different locations.<p>Let&#x27;s say you can handle 10 Gbps at a single location. If the traffic is evenly split between 100 destinations then you can have a single IP that can handle 1 Tbps of traffic.<p>Of course, the setup behind these IPs might vary a lot, and one might even use DNS load balancing in front of the IPs.
评论 #17061596 未加载
rdl大约 7 年前
One &quot;trick&quot; to know is that transit links are generally billed as the higher of inbound or outbound traffic. If you have a service which is unbalanced and pushing out a lot of data (like most hosting services), your inbound is thus essentially &quot;free&quot; up to a very high volume.
togusa2017大约 7 年前
This might give you a nice idea of how HAProxy provides the feature. <a href="https:&#x2F;&#x2F;www.haproxy.com&#x2F;blog&#x2F;use-a-load-balancer-as-a-first-row-of-defense-against-ddos&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.haproxy.com&#x2F;blog&#x2F;use-a-load-balancer-as-a-first-...</a>
majke大约 7 年前
I&#x27;m working on DDoS protection at Cloudflare. AMA<p>We try to publish most of what we do, the more obvious links:<p><a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;how-cloudflares-architecture-allows-us-to-scale-to-stop-the-largest-attacks&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;how-cloudflares-architecture-all...</a><p><a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;meet-gatebot-a-bot-that-allows-us-to-sleep&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;meet-gatebot-a-bot-that-allows-u...</a><p><a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;the-root-cause-of-large-ddos-ip-spoofing&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;the-root-cause-of-large-ddos-ip-...</a><p><a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;memcrashed-major-amplification-attacks-from-port-11211&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;memcrashed-major-amplification-a...</a><p><a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;syn-packet-handling-in-the-wild&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;syn-packet-handling-in-the-wild&#x2F;</a><p><a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;reflections-on-reflections&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;reflections-on-reflections&#x2F;</a><p><a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;say-cheese-a-snapshot-of-the-massive-ddos-attacks-coming-from-iot-cameras&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;say-cheese-a-snapshot-of-the-mas...</a><p><a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;the-new-ddos-landscape&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;the-new-ddos-landscape&#x2F;</a><p><a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;unmetered-mitigation&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;unmetered-mitigation&#x2F;</a><p><a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;introducing-the-p0f-bpf-compiler&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;introducing-the-p0f-bpf-compiler...</a><p>And maany more.<p>Also two talks:<p><a href="https:&#x2F;&#x2F;idea.popcount.org&#x2F;2016-02-01-enigma---building-a-dos-mitigation-pipeline&#x2F;" rel="nofollow">https:&#x2F;&#x2F;idea.popcount.org&#x2F;2016-02-01-enigma---building-a-dos...</a><p><a href="https:&#x2F;&#x2F;idea.popcount.org&#x2F;2015-11-16-black-hat-eu---defending-the-indefensible&#x2F;" rel="nofollow">https:&#x2F;&#x2F;idea.popcount.org&#x2F;2015-11-16-black-hat-eu---defendin...</a><p>&gt; But how does that prevent severe service degradation<p>It doesn&#x27;t. You DROP the most specific thing you can. To avoid collateral damage we are able to do &quot;Scattering&quot; (move client across IPs with the hope the attack won&#x27;t follow), and for example apply the controversial limits only in certain geographical areas (anycast network allows this).<p>&gt; you still have to do some kind of work (in computation and energy) on the listening side<p>Yes. BPF for L3 works like charm. Read on XDP.<p>&gt; or can fat edge-servers just eat that up?<p>Yes and no. You have to specifically optimize, whatever you do probably won&#x27;t make Apache or IIS work under DDoS. Most vendors use &quot;scrubbing centres&quot;, when they can have small number of beefy dedicated servers. We didn&#x27;t find this architecture sufficient though, so in our case edge servers do handle the load. But we do spend time on tuning the servers and our applications.
amorphid大约 7 年前
One way these companies mitigate DDoS attacks is by being huge. If you have a small house w&#x2F; one entrance, there&#x27;s no great way to manage 1000 people trying to get through the front door. If you have a huge house w&#x2F; dozens of entrances, dealing with 1000 people trying to get in the building is much more manageable :)<p>From <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;DDoS_mitigation" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;DDoS_mitigation</a>:<p><i>One technique is to pass network traffic addressed to a potential target network through high-capacity networks with &quot;traffic scrubbing&quot; filters.</i>
评论 #17062176 未加载
contingencies大约 7 年前
Not an expert but I would guess at least the following: traffic filtering, peer traffic filtering by (possibly dynamic and automated) agreement, traffic classification and anomaly detection (DNS&#x2F;TCP&#x2F;HTTP(S)&#x2F;etc.), routing different clients (based on origin AS and&#x2F;or geolocation) to different IPs through DNS, hosted web frontends, web-level active user challenges, potentially dynamically altering the advertisement of routes, and by charging so much money the moment you need to use them that buying extra bandwidth and netblocks isn&#x27;t an issue for them. Probably some of them also drop to high-overhead traffic reduction modes which can expand frontend IPs and DNS response segmentation, dropping DNS TTLs and spinning up new proxy systems in order to better filter out robotic attackers. Many also probably create&#x2F;profile&#x2F;buy various browser fingerprinting techniques and may have a library of non publicly disclosed approaches available for additional mitigation during high bandwidth attacks. Oh yeah, and replicating a static cache as a cheap means of degraded service provisioning.
评论 #17061494 未加载
jgrahamc大约 7 年前
We&#x27;ve open sourced and talked about a lot of how we do DDoS mitigation. Details are in the following blog posts:<p>No Scrubs: The Architecture That Made Unmetered Mitigation Possible - <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;no-scrubs-architecture-unmetered-mitigation&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;no-scrubs-architecture-unmetered...</a><p>Meet Gatebot - a bot that allows us to sleep - <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;meet-gatebot-a-bot-that-allows-us-to-sleep&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;meet-gatebot-a-bot-that-allows-u...</a><p>How Cloudflare&#x27;s Architecture Allows Us to Scale to Stop the Largest Attacks - <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;how-cloudflares-architecture-allows-us-to-scale-to-stop-the-largest-attacks&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;how-cloudflares-architecture-all...</a><p>Kernel bypass - <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;kernel-bypass&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;kernel-bypass&#x2F;</a><p>SYN packet handling in the wild - <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;syn-packet-handling-in-the-wild&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;syn-packet-handling-in-the-wild&#x2F;</a><p>How to achieve low latency with 10Gbps Ethernet - <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;how-to-achieve-low-latency&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;how-to-achieve-low-latency&#x2F;</a><p>How to receive a million packets per second - <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;how-to-receive-a-million-packets&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;how-to-receive-a-million-packets...</a><p>Introducing the BPF Tools - <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;introducing-the-bpf-tools&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;introducing-the-bpf-tools&#x2F;</a><p>BPF - The Forgotten Bytecode - <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;bpf-the-forgotten-bytecode&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;bpf-the-forgotten-bytecode&#x2F;</a><p>Introducing the p0f BPF compiler - <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;introducing-the-p0f-bpf-compiler&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;introducing-the-p0f-bpf-compiler...</a><p>Single RX queue kernel bypass in Netmap for high packet rate networking - <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;single-rx-queue-kernel-bypass-with-netmap&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;single-rx-queue-kernel-bypass-wi...</a>
WhiteSource1大约 7 年前
You can see a DDoS attack live for a demo of how it works: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=FIQUUFVE6tU" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=FIQUUFVE6tU</a><p>They are also doing a webinar (apologies for the link) so you can see exactly how it&#x27;s implemented: <a href="https:&#x2F;&#x2F;www.incapsula.com&#x2F;blog&#x2F;want-to-see-what-a-live-ddos-attack-looks-like.html" rel="nofollow">https:&#x2F;&#x2F;www.incapsula.com&#x2F;blog&#x2F;want-to-see-what-a-live-ddos-...</a>
vlan0大约 7 年前
BGP Flowspec is commonly used ISPs. Sadly, they won’t extend that to their customers.<p>They’d rather sell yet another service rather than supporting open protocols.
评论 #17063922 未加载
trelliscoded大约 7 年前
I use remote black hole routine announcements to the upstream ISPs to filter source or destination addresses from traversing the congested link.
评论 #17062682 未加载
yeukhon大约 7 年前
I wonder if anyone has ever tried counter attack. The downside is in turn DoS the origin, which often are victims like infected host in a botnet. Double-edged sword. But it would be very interesting to see how quickly one could defeat the attack.<p>I also wonder why attack often last only a few hours.
评论 #17062268 未加载
评论 #17062358 未加载