The boy who created our website has already set up DDoS protection.
We have DDoS protection in place, so why did the site go down?
How much is Qrator asking for?
To adequately respond to such questions from clients or superiors, it's helpful to understand what goes into the concept of 'DDoS protection.' The choice of protection services resembles a doctor's selection of medication rather than choosing furniture at IKEA.
I have been supporting websites for 11 years, experiencing hundreds of attacks on the services I manage, and now I will share a bit about the inner workings of protection.
Regular attacks. 350k requests total, 52k requests legitimate.
The first attacks emerged almost simultaneously with the Internet. DDoS as a phenomenon became widespread in the late 2000s (check out ).
Since around 2015-2016, nearly all hosting providers have implemented DDoS protection, as have most significant websites in competitive fields (do a whois lookup for the IPs of sites like eldorado.ru, leroymerlin.ru, tilda.ws, and you will see the protection networks).
If 10-20 years ago, most attacks could be mitigated at the server itself (consider the recommendations of Lenta.ru's system administrator Maxim Moshkov from the 90s: ), now protection has become more complex.
Types of DDoS attacks from the perspective of selecting a protection operator.
Attacks at L3 / L4 (according to the OSI model).
— UDP flood from a botnet (many requests are sent directly from infected devices to the targeted service, overwhelming the server's bandwidth);
— DNS/NTP/etc amplification (many requests are sent from infected devices to vulnerable DNS/NTP/etc, masking the sender's address, resulting in a massive flood of response packets that overwhelm the victim's bandwidth; this is how the largest attacks in today's internet are performed);
— SYN / ACK flood (many requests to establish a connection are sent to targeted servers, leading to a queue overflow);
— attacks involving packet fragmentation, ping of death, ping flood (please Google it);
— etc.
These attacks aim to 'overwhelm' the server's channel or 'kill' its ability to accept new traffic.
Although SYN/ACK flood and amplification are significantly different, many companies defend against them equally well. Problems arise with attacks from the next group.
L7 attacks (application level).
— http flood (if a website or some HTTP API is being attacked);
— attacks on vulnerable parts of the website (those without caching, placing a heavy load on the site, etc.).
The goal is to make the server 'work hard', processing many 'seemingly real requests' and be left without resources for genuine requests.
Although there are other attacks, these are the most common.
Serious attacks at the L7 level are uniquely crafted for each targeted project.
Why 2 groups?
Because there are many who are good at mitigating attacks at the L3/L4 level, but either do not tackle application level (L7) protection at all, or currently handle them less effectively than alternatives.
Who's who in the DDoS protection market
(my personal view)
Protection at the L3/L4 level
To mitigate amplification attacks ('flooding' the server's channel), wide bandwidth is sufficient (many protection services are connected to most large backbone providers in Russia and have channels with theoretical capacities exceeding 1 Tbps). Remember, very rare amplification attacks last longer than an hour. If you are Spamhaus and everyone dislikes you — yes, they might attempt to take down channels for several days, even risking the survival of the employed global botnet. If you have just an online store, even if it’s mvideo.ru — you won't see 1 Tbps for several days (hopefully).
To counter SYN/ACK flood attacks, packet fragmentation, etc., hardware or software systems for detecting and blocking such attacks are necessary.
Such equipment is produced by many (Arbor, there are solutions from Cisco, Huawei, software implementations from Wanguard, etc.), many backbone operators have already installed it and offer DDoS protection services (I know about installations from Rostelecom, MegaFon, TTK, MTS, in fact, all major providers, hosts are doing this with their own protection a-la OVH.com, Hetzner.de; I have personally encountered protection at ihor.ru). Some companies are developing their own software solutions (technologies like DPDK allow processing traffic in tens of gigabits on a single physical x86 machine).
Among the well-known players, everyone can handle L3/L4 DDoS attacks more or less effectively. I can't say who has the maximum channel capacity (that's insider information), but usually, this is not that important, and the difference lies mainly in how quickly the protection kicks in (instantly or after several minutes of project downtime, as in Hetzner).
The question is how well this is done: an amplification attack can be mitigated by blocking traffic from countries that generate the most malicious traffic, or you can simply discard only truly unnecessary traffic.
However, based on my experience, all serious players in the market handle this without issues: Qrator, DDoS-Guard, Kaspersky, G-Core Labs (formerly SkyParkCDN), ServicePipe, Stormwall, Voxility, etc.
I haven't encountered protection from operators like Rostelecom, MegaFon, TTK, and Beeline; according to my colleagues, they provide these services fairly well, but there still seems to be a lack of experience: sometimes you need to tweak something through the support of the protection operator.
Some operators have a separate service called 'protection from L3/L4 level attacks', or 'channel protection', which is much cheaper than multi-level protection.
How does a non-transport operator fend off hundreds of Gbps of attacks when they don’t have their own channels?The protection operator can connect to any of the major providers and fend off attacks 'on their dime'. You will have to pay for the channel, but all those hundreds of Gbps will not always be utilized, so there are options for significantly reducing the costs of channels in this case, making the scheme viable.
I regularly received such reports from higher-level L3/L4 protection while supporting a hosting provider's systems.
Protection at L7 level (application level)
L7 level (application level) attacks are effectively and consistently mitigated by a handful of companies.
I have considerable real-world experience with
— Qrator.net;
— DDoS-Guard;
— G-Core Labs;
— Kaspersky.
They charge for every megabit of clean traffic, with the cost being several thousand rubles per megabit. If you have at least 100 Mbps of clean traffic—oh. The protection will be very expensive. I can explain in future articles how to design applications to save significantly on the capacity of protective channels.
The real 'king of the hill' is Qrator.net; others are lagging behind. So far, Qrator is the only one in my experience that has a near-zero false positive rate, but they are several times more expensive than other players in the market.
Other operators also provide quality and stable protection. Many services we support (including some very well-known in the country!) are protected by DDoS-Guard, G-Core Labs, and are quite satisfied with the results they receive.
Attacks repelled by Qrator
I also have experience with smaller protection operators like cloud-shield.ru, ddosa.net, and thousands of others. I definitely won't recommend them, as my experience is not extensive; however, I will share the principles of their operation. Their protection costs are often 1-2 orders of magnitude lower than those of larger players. Generally, they buy partial protection services (L3/L4) from larger players, plus they create their own protection against higher-level attacks. This can be quite effective, and you might receive good service for less money, but do keep in mind that these are small companies with a small staff.
What is the difficulty of repelling attacks at the L7 level?
All applications are unique, requiring the ability to permit beneficial traffic while blocking harmful traffic. It is not always possible to filter out bots successfully, which is why many, indeed REALLY MANY, layers of traffic cleansing are required.
Once, the nginx-testcookie module was sufficient (), and it still suffices to fend off a large number of attacks. When I worked in the hosting industry, I built L7 protection primarily based on nginx-testcookie.
Unfortunately, attacks have become more complex. Testcookie uses JavaScript-based bot checks, whereas many modern bots are capable of passing those checks successfully.
Attack botnets are also unique, and it is essential to consider the characteristics of each major botnet.
Amplification, direct flooding from botnets, traffic filtering from different countries (with different filtering for different countries), SYN/ACK floods, packet fragmentation, ICMP, HTTP floods—all of these can lead to an unlimited number of different attacks at the application/HTTP level.
In total, at the defense level involving channels, specialized equipment for traffic cleansing, special software, and additional filtering setups for each client, there can be dozens or even hundreds of filtering levels.
To effectively manage this and correctly tune filtering settings for different users, extensive experience and qualified personnel are required. Even a large operator, deciding to offer protection services, cannot simply throw money at the problem: experience must be gained through real sites and false alarms on legitimate traffic.
For a protection operator, there is no 'DDoS counter' button; there are numerous tools that must be mastered.
And here’s another bonus example.
An unprotected server was blocked by the host during an attack with a capacity of 600 Mb.
(The 'disappearance' of traffic was not noticeable, as only one site was attacked, it was temporarily removed from the server, and the block was lifted within an hour.)
This same server is under protection. The attackers 'surrendered' after a day of repelled attacks. The attack itself turned out to be not very strong.
Layer 3/4 attacks and protection are more trivial; they mainly depend on channel thickness, detection algorithms, and attack filtering.
Layer 7 attacks are more complex and original; they depend on the targeted application, the capabilities, and creativity of the attackers. Protection against them requires significant knowledge and experience, and results may not be immediate or guaranteed. Until Google invents another neural network for protection.
Source: habr.com
