Hacker News Reader

Comment by sillysaurus3 | Hacker News Reader

What are the steps to mitigate a large-scale DDoS?

Say you're running a website fronted by Cloudflare, for example.

GitHub fought the largest ever recorded ddos using Akamai Prolexic. At least according to Wired. https://www.wired.com/story/github-ddos-memcached

I think protonmail is experiencing the same type of attack (memcached amplified)

Akamai's Prolexic platform was able to mitigate the attack by filtering all traffic sourced from UDP port 11211, the default port used by memcached.

Interesting. The impressive part is that their platform correctly identified the attack and automatically applied the solution within 20 minutes. I wonder how?

Possibly a team of smart sysadmins on standby? It's easy to detect when you're being attacked, but hard to mitigate. So whenever you get attacked, set up your site to automatically forward over to this service, and their clever humans take it from there.

Some of the most impactful tech projects are just mechanical turks, so it wouldn't be surprising. But I wonder what the truth is.

you monitor netflow for anomalies - when they occurred you change the routing via BPG to prolexic (e.g. the attacked /24) - they have huge amount of available bandwidth and hardware to filter out unwanted traffic - if you get a known attack like in this case, it's completely automated in case you want it... - your traffic is forwarded to the original destination via GRE

After the Github attack, there was a larger, 1.7Tbps DDoS against an unnamed client of Arbor Networks using the same memcached tactic. I hope someone is working on getting all those open memcached servers secured..

That's going to be hard. More than likely the solution will come from ISPs blocking port 11211 on public networks.

Victor Gevers, co-founder and chairman of the GDI Foundation, says there are already substantially fewer vulnerable servers. https://mobile.twitter.com/0xDUDE/status/971515743589322752

Reply on news.ycombinator.com