Linked by Thom Holwerda on Thu 28th Mar 2013 00:36 UTC, submitted by MOS6510
Internet & Networking "The New York Times this morning published a story about the Spamhaus DDoS attack and how CloudFlare helped mitigate it and keep the site online. The Times calls the attack the largest known DDoS attack ever on the Internet. We wrote about the attack last week. At the time, it was a large attack, sending 85Gbps of traffic. Since then, the attack got much worse. Here are some of the technical details of what we've seen."
Permalink for comment 556943
To read all comments associated with this story, please click here.
Alfman
Member since:
2011-01-28

Laurence,

"We're talking about the same check. What I was describing was the process behind 'plain old source-interface checking'."

It doesn't seem like source interface filtering is a great solution to me because on the internet there's technically no requirement that packets come in from the same interface they'll return out of. In multi-homed setups this can even be explicit. Load balancers might do the same thing. But even in other less exotic cases internet routers can switch paths dynamically as they rerun the shortest path algorithms, I don't know just how frequently this happens, but it's the reason UDP packets can arrive out of order.

So do you agree that source interface filtering could negatively affect legitimate users?

It's a DNS problem, so I feel that a DNS fix should be used instead of modifying our routers. It's much easier to update dns software than a router. My understanding is that many commercial routers achieve their performance in hardware and become underpowered if too many packets get tossed around into the software stack.

Edited 2013-03-28 14:43 UTC

Reply Parent Score: 3