Hacker News Reader

Comment by StreamBright | Hacker News Reader

This is not real DDoS protection since it does not deal with jamming the pipes. It is more of a resource exhaustion protection.

View on HN

Would this be useful for small lightly trafficked sites that may get hit by small time attackers?

Would this hit a sweet spot between a grandma's blog with straight HTML and massively trafficked sites like Wikipedia?

Resource exhaustion seems like a useful feature of _some_ kind of system. What does that system look like?

It is not useful for small time attackers - small time attackers/children/etc just use booters which at least usually output double digit gbps, often spoofed, costs a cent or pay in runescape gold or other bullshit like that. Your upstream will need to mitigate this. No small scale attacker will be launching their own attacks (from their own machines), unless they were seriously incompetent but also think they're some form of power user, which doesn't really happen...

It is not useful for straight HTML - volumetric DDoS will take it out (not l7), it's not even going to make it to your machine. It does not mitigate well against any real major l7 flood either, just by virtue of "your pipe is smaller". A formal l7 attack would at least do basic recon to find a high resource consumption page (like search.php?q=%20 or something)

I guess this would come in maybe slightly useful with someone running ab or jmeter from a single machine toward you? But I don't know a single instance of that happening in the last decade..

It’s great against mistaken API clients. Murphy is the most frequent adversary I encounter.

I feel like there's a bunch of other things in play, like for example if you're running a public API, one api key should not be able to take you down - you should be rate limiting them against repeated hits, for instance.

I'm not saying iptables is bad per se, but this article in particular is just some overpriced hosting provider's blog that tells you to set things like kernel.panic in sysctl. The article also claims all of this to be a defense against DDoS, which really will probably just eat through your pipe completely most of the time, not single-person DoS.

"Small time attackers" are doing __distributed__ denial of service? I guess if they do not have enough bandwidth but has enough req/s, you can protect yourself something like the article suggests. In my dictionary DDOS is when they are jamming the pipes.

It clearly states that it's for TCP based attacks. TCP attacks eg. SYN floods is a real problem and this does help against most such attacks.

Just as real as anything else...

only for DoS, not DDoS. i.e. if you omit the distributed from Denial of Service, then iptables will work. Not so when the attack exhausts either your bandwidth or your stack's filtering capabilities. it's easy to rent GBits of distributed attack bandwidth.

Most modern Unixes have syn cookies. You do not necessarily need anything else.

You still have to do some tuning and at least assign RX queues properly.

You want to drop unwanted traffic before you start spending more cycles on it.

Reply on news.ycombinator.com