Hacker News Reader

Comment by jeffbee | Hacker News Reader

And Cloudflare's cited packet rate from the Moobot attack is a bit higher than Google is citing in this article. Attacks approaching 1 Gpps are pretty serious and both of these companies are fighting the problem by spending tons of money. As Google says here, "sufficient capacity to absorb the largest attacks". No magic bullet.

View on HN

I read that and thought: we crossed that barrier years ago. Then I noticed the Gpps unit on your comment and realized my error. Ouch.

What does gpps stand for? Google is surprisingly unhelpful

pps = packets per second. G = Giga- prefix

pps is packets per second. So 1Gpps would be 1 billion packets per second.

nowhere near as helpful as RTFA, no

Capacity is a necessary but not sufficient condition to mitigate something at this scale though.

Why are people switching to the gpps unit now instead of using tbps?

Each packet has a different length (due to different payloads), hence now we are switching to an inconsistent unit of measurement?

The capacity of networking gear isn't unidimentional - most network equipment has both a maximum number of packets per second and a maximum total throughput. I'm not in the business, but I suspect that sophisticated network filtering equipment even at the high end can have its packets-per-second capacity eaten up before it hits line speed, just like low end routing equipment can.

As a result, there are some people whose ability to withstand a DDoS has more to do with packets per second than bits per second, so it becomes a useful metric.

Yes, a 1-byte UDP packet is just about as costly as a 1000-byte UDP packet. Considering that an ordinary PC can drive a 100gbps line interface with large frames, 1tbps is really nothing at all. But 1 Gpps is orders of magnitude more than one machine can normally send or receive.

> As a result, there are some people whose ability to withstand a DDoS has more to do with packets per second than bits per second, so it becomes a useful metric.

Right, definitely. A large sports streaming event might (easily!) do 10Tbps across a country, even more, but each GB served may only represent ~5k requests - 10e3/8 * 5e3 = 6.25M RPS, with each request being a single packet (small GET requests). That's big, but workable across enough machines for a big provider.

500M Pps is 80x that figure - you're basically DoS'ing header processing filters in your networking hardware.

People are not switching. Serious practitioners always distinguished between pps, bps and rps(or qps), as they measure different dimensions as explained in the article.

Reply on news.ycombinator.com