English
Magyar
One of the most pressing problems facing the internet today is DDoS attacks. Whilst it is relatively cheap to launch an attack using botnets, the fact that the targeted provider is already receiving a large volume of malicious traffic means that filtering it out – whilst ensuring services remain available at all times – is not necessarily straightforward.
How can you recognise a denial-of-service (DDoS) attack?
To defend against an attack, you need to know what is coming your way. If you notice an attempt to disrupt the normal operation of a server (or VPS), service or network by flooding it with unwanted traffic, then you are dealing with a distributed denial-of-service (DDoS) attack.
A DDoS attack attempts to make a server inaccessible (or the service itself unavailable) by generating a large volume of malicious internet traffic that overwhelms the target’s available resources. To prevent such attacks and guarantee maximum uptime, we use traffic filtering solutions.
What does an attack look like?
Imagine 2000 Mbps of UDP traffic being directed towards a VPS with 1000 Mbps bandwidth. It is easy to see that the attack traffic alone exceeds the bandwidth available to the VPS, and this does not even take into account the bandwidth requirements of normal traffic.
DDoS attacks are often difficult to mitigate, as you are usually targeted by one or more botnet networks. A botnet consists of many infected systems – typically the computers of unsuspecting people – so trying to fight it on your own usually proves futile.
How do we deal with DDoS attacks?
Our infrastructure offers two DDoS mitigation solutions for handling incoming attacks: the less drastic traffic filtering, or zero-routing (RTBH) above a certain threshold.
Zero-routing offers the ability to quickly discard unwanted traffic before it reaches our network. Although this method effectively protects our infrastructure, it effectively cuts off the IP address under attack from the internet – and thus the services running on it – meaning that those services will become inaccessible. Ultimately, the attacker achieves their objective. We therefore only resort to this method as a last resort.
In some cases, it is possible to zero-route traffic arriving from specific directions only, thereby neutralising the attacker’s traffic.
Traffic filtering is a more sophisticated DDoS protection service we offer. It attempts to block only malicious traffic, rather than discarding all traffic. Malicious traffic is identified by analysing the packets passing through our infrastructure.
As a first step, based on a pre-configured set of rules, all traffic that is not necessary for our service is discarded. For example, in the case of a web server, UDP packets can be discarded without the website becoming inaccessible. If this alone is not sufficient, our automated system attempts to filter out traffic that is suspicious, appears to originate from a spoofed source IP, or whose pattern is too uniform to be the random variation typical of normal traffic.
Overall, our system attempts – as far as technically possible – to mitigate DDoS attacks in such a way that our customers’ services do not experience any downtime or significant slowdowns.