6 ms·
Most clients participating in DDoS attacks are plain dumb. They will continually perform a GET request on a single page and not parse the response. This means
by robotkad 16y ago
Most clients participating in DDoS attacks are plain dumb.
They will continually perform a GET request on a single page and not parse the response. This means they wont respond to javascript, images, cookies or redirects correctly.
You can devise a test that identifies attacking clients and then blacklist the IP addresses for a while.
While I'm sure this strategy isn't perfect, it has been sufficient for the two attacks I have been subjected to.
Edit: vladd's reply articulates this idea better than I was able to :)
- xentronium 16y agoEffectively banning robots is the last thing you want to do.
- bdonlan 16y agoIt's better than having the site be completely inaccessible. You'd only deploy this when you come under load. Additionally, many of the more important robots can be identified reliably (eg, googlebot has a DNS handshake that can positively identify legitimate googlebots) - and even if you get a false positive, if you filter out all their packets, they're likely to assume a temporary failure and come back later.
- pbhjpbhj 16y agoCould you counter equally naively, does a single IP need to hit your site more than a couple of times in 10mins, say? Still even an simple test could be too slow to counter a big enough attack.
- Travis 16y agoThe only problem with this (note: I speak from no experience, just reading other comments) is that it's at the application level. For the serious DDoS stuff (Anon, extortion rings), you have to filter at the TCP level (from what I know). That gets more complicated when the attacks originate from a botnet (especially if that botnet has infected IP ranges similar to what your customers use -- can't very well go off and ban Time Warner, if you're in the US)