DDOS protection: Which providers are good, which are not worth your time?
Hi I'm currently looking into a service called Athena Layer, has anyone ever used it? Should I just look into something like blazing fast? What DDOS protection provider are you using and if so why? What are their costs etc.
The company I am with use Voxility for small end attacks but then have in-house software to get the much higher attacks. My servers have been under mitigation for 1-2 days now and the servers are absolutely fine.
If you need it in the EU - Voxility is your best bet at the moment sadly, until we announce our next location from Crident. Also, I call bullshit Lubricant, or you get no players. Having Voxility on for two days will cause issues.....
Currently Crident are using in house filters behind Voxility, but it isn't as perfect as it could be. Voxility are generally a massive let down.
By[TNN] Lubricant Jamat 16th of June 2016 19:06:12
The company I am with use Voxility for small end attacks.
Hold on, what? Voxility take the larger attacks - thats the entire purpose of it anyway. The smaller attacks are the ones which get filtered on site.
I'm not here to argue, I am here to state what is working for me.
By[TNN] Lubricant Jamat 16th of June 2016 21:15:23
I'm not here to argue, I am here to state what is working for me.
Well get it right so you don't confuse people
Bydrizzy.vipat 16th of June 2016 21:17:04
Well get it right so you don't confuse people
What's funny is that it is right, and you do not believe it because your host is "bullet proof".
EDIT: From now on, you're talking to yourself buddy, GL with the hosting, wish you all the best.
By[TNN] Lubricant Jamat 16th of June 2016 21:18:42
What's funny is that it is right, and you do not believe it because your host is "bullet proof".
That is kinda silly. Voxility is designed purely for the large attacks. The idea is they step in to block attacks you otherwise don't have the capacity to handle yourself. You, or they can't control Voxilities filters, only how sensitive they are if they own the contract that is.
The theory is this; there are two types of attacks people need to focus on. Layer 4, and Layer 7. Layer 4; Generally the large ones which are quite easy to find , NTP, Chargen, shit like that. Layer 7; Generally a lot smaller (unless you're talking http), harder to launch and harder to mitigate.
The idea is as layer 4 is easiest to block, they provide the capacity upstream. They can do this because all they do is check against a set of rules, if it matches them drop the packet. Experts in the DDoS mitigation field have been saying this is the best way to do it for the last year or more.
Voxility are focused on layer 4. That is a generalized issue, everyone is vulnerable to the same layer 4 attacks. It just makes more sense. They do offer some extremely basic filtering for layer 7, but its poor and it actually causes more issues than it solves. I use them, I pay them money, I'm trying to tell people about the issues that come with them. However right now, they're one of your best options.
I mean, technically speaking - your host don't have a choice if Voxility block the larger attacks, their appliance does it automatically once traffic is higher than 50-60mbps typically.
Bydrizzy.vipat 16th of June 2016 21:29:12
That is kinda silly. Voxility is designed purely for the large attacks. The idea is they step in to block attacks you otherwise don't have thecapacityto handle yourself. You, or they can't control Voxilities filters, only how sensitive they areifthey own the contract that is.The theory is this; there are two types of attacks people need to focus on. Layer 4, and Layer 7.Layer 4; Generally the large ones which are quite easy to find , NTP, Chargen, shit like that.Layer 7; Generally a lot smaller (unless you're talking http), harder to launch and harder to mitigate.The idea is as layer 4 is easiest to block, they provide the capacity upstream. They can do this because all they do is check against a set of rules, if it matches them drop the packet. Experts in the DDoS mitigation field has been saying this for the last year or more.Voxility are focused on layer 4. That is a generalized issue, everyone is vulnerable to the same layer 4 attacks.It just makes more sense.They do offer some extremely basic filtering for layer 7, but its poor and it actually causes more issues than it solves. I use them, I pay them money, I'm trying to tell people about the issues that come with them. However right now, they're one of your best options.I mean, technically speaking - your host don't have a choice if Voxility block the larger attacks, their appliance does it automatically once traffic is higher than 50-60mbps typically.
While it's true Voxility block larger UDP/TCP based attacks, it's possible to (and we have done it) having mitigation by Voxility turned off but still being routed through. Amplified attacks such as NTP and DNS are still rate-limited by ACL's even without Mitigation Mode being turned on. This way, issues with source servers are non existent. (This can only be done with attacks under 20Gbps or so)
Voxility unfortunately don't really have much to customize, but their "made to fit all" stuff is improving.
I'm aware of the issues with Voxility regarding Source Servers, but they have improved quite a bit since I have been working with them. Right now, we have our own box dedicated to filtering Application based attacks. Unless the attack is significantly large (300+Mbps) only then will Voxility kick in. If this causes issues for the client, mitigation mode will be disabled and it will continue to cache results just fine.
ByMrkrabzat 16th of June 2016 21:40:29
Voxility unfortunately don't really have much to customize, but their "made to fit all" stuff is improving.Unless the attack is significantly large (300+Mbps) only then will Voxility kick in.
Well thats good to hear you guys are doing more than slapping Voxility on a dedi and calling it a day. But bearing in mind the average DDoS attack launched today is 5+Gbps (According to Verisign) I wouldn't call 300Mbps significantly large as there are wireless routers that can achieve that, and it sounds quite misleading.
Bydrizzy.vipat 16th of June 2016 21:52:28
Well thats good to hear you guys are doing more than slapping Voxility on a dedi and calling it a day.But bearing in mind the average DDoS attack launched today is 5+Gbps (According to Verisign) I wouldn't call 300Mbps significantly large as there are wireless routers that can achieve that, and it sounds quite misleading.
Sorry, by that I meant 300Mbps of Application Based attacks (Source queries etc)
Bydrizzy.vipat 16th of June 2016 22:07:40
Oh nice man, so to confirm, you cache A2S_INFO, A2S_PLAYER, A2S_RULES, A2S_SERVERQUERY_GETCHALLENGE ?
Depending which server of ours you are on, our older servers are on a shared vLAN which aren't routed through our own gateway.
Tonight we are moving our IP Ranges over to our private vLAN and every server will be covered.
All of those are cached, yes. They are just normal Source Queries, other queries are normally rate-limited or completely blocked depending on what it is.
ByMrkrabzat 16th of June 2016 22:12:49
Depending which server of ours you are on, our older servers are on a shared vLAN which aren't routed through our own gateway.Tonight we are moving our IP Ranges over to our private vLAN and every server will be covered.All of those are cached, yes. They are just normal Source Queries, other queries are normally rate-limited or completely depending on what it is.
lol, you can't cache A2S_SERVERQUERY_GETCHALLENGE, it is only generated once and used twice, and doing so could allow players to join spam your server
Crident they have some p dank servers
Bydrizzy.vipat 16th of June 2016 22:14:28
lol, you can't cache A2S_SERVERQUERY_GETCHALLENGE, it is only generated and used once, and doing so could allow players to join spam your server
Queries that require a token will work, I'm not going to go into detail on how it works however our application requests a token from the server and it stores it. When a client requests information such as A2S_RULES the are given the same challenge response. All other queries from clients will be given the same token to ask the same question, the answer is stored in memory and gets updated every second or so.
-- snip --
ByMrkrabzat 16th of June 2016 22:20:02
All other queries from clients will be given the same token to ask the same question, the answer is stored in memory and gets updated every second or so.
My point is you can not give every client the same reply for that certain query. You should know that. Each client **MUST **have a unique key you CAN NOT cache. So basically you're saying you're vulnerable to A2S get challenge attacks which Voxility don't block either. Maybe increase your prices and spend more on R&D :v
im feeling the ddos now mr. krabs
- I'm out.