EVE General Discussion

I calculated six hours and fifty-one minutes, and that was just one of the occurrences.

Lol i have individual optics on my desk right now worth more than 70k.

Most the things you talk about will not protect you from any serious attack. Hell, not even a moderate one.

I'm not sure what raw throughput is being generated by these attacks, or what specific forms they are using but I've seen small botnets takedown routers which cost far more than 70k and generate unreal Gbps in raw traffic.

Trying to weather the brunt of serious attacks and processing packet by packet your way through it could translate into millions of dollars. This is really the big problem w serious ddos. Its just so...much...crap the equipment or even circuits just get overwhelmed.

To say "geez ccp, just loadbalance" is so Lol it really makes the lack of knowledge on the topic self evident. (I know this and im not even an expert in security)

If you arent a big boy (larger corporations, which ccp is not) usually your best bet is to kill the traffic before it gets to you.

And unfortunately a lot of times that means either lopping off /20's or even lists of /16's to /12's on your provider side (killing traffic from entire nations and continents) or... just killing routing to the target of the attack itself.

"Posted: 2014.08.21 17:57"

Still working at 17:57... CCP must be paying some nice overtimes.
But thanks nonetheless to the CCP team for working long hours for our enjoyment.

yesh ^^

Oh, so cuuuuuute. Someone named Carribean Queen is telling me stuff he doesn't know the first thing about. Oh, look - he doesn't even have the first clue about what I've even written!

There, there. Run along now . . .

Or at least blow her off then play ^^

I'm not an IT person, I'm a networking person. If you work for a company where you do both, you aren't fixing this problem yourself as they already haven't dedicated the resources needed to take either job incredibly seriously (usually small-med sized businesses dont need to). So, it is possible we're talking past each other a bit, as it's one thing to overload an auth server and another to bring someones network to a stop or to saturate their peering points.

If you're talking routers (and not some dell box running router software), the tax on system resources increases logarithmically as you increase the various types of rules. IP table look ups are one thing. But you need to examine a lot of different aspects of a packet to tell the good from the bad. Thus the more discriminate you wish to be, the more rules you'll need. This will involve different types of lookups which translate into different processes run by a different daemons on the device. The more rules you have, the more stressful traffic analysis becomes. This is essential understanding for any "serious" ddos as you will not be receiving uniform source destinations, packet types and even completely valid headers. That's how you take down routers (as in the device itself).

If you can "load balance", "preprocess" this, or whatever away with a firewall, you're probably not dealing with a very complex attack. Either it's going to be designed to cruise right past your typical firewall or saturate the links to the firewall.

This is why major networks don't have magical firewalls at every peer point. Your router is in its policies a firewall. If it was that easy, everyone would do it and be untouchable by DDoS attacks.

Less refined attacks that are a simple mass of udp or whatever can be processed, but again, usually used to overload circuits. You don't just load balance this away on the fly if it happens to you. Unless your bottleneck is in your datacenter and you can have someone run in there and start running cables :P (it isn't so you wont be) , you need to stop that traffic before it ever reaches your circuits or network. This isn't "preprocessing", this is killing it on an completely separate upstream network from yours or poisoning the route entirely so many AS's away someone says "hey I don't have a route to that" or "hey, i'm not supposed to pass along anything from you to that other place"

I did not say a DDoS generates GB of trash. I said it can generate many Gbps of raw traffic. These statements are not equivalent in any way.

-Trash is more easily taken out than traffic that is designed to appear legitimate.
-A GB is a specific volume set. A value usually reserved for disk size. Gbps is a rate of volume over time usually reserved for communication rates (hey, network speed!).

That aside there is a huge difference between GBps and Gbps and GB and Gb.
And while you can easily convert between the two, absolutely no one that actually works with this stuff, uses big Bs for anything but disk space and no one uses anything but little b's for rates nor would they confuse the two. That's usually the point where they fail the interview.