Ask HN: Are there any effective measures against DDoS attacks?

anonymouse123 · on March 4, 2013

You could try Cloudflare?

http://avgjoegeek.net/cloudflare-review/

http://www.forbes.com/sites/eliseackerman/2012/02/29/how-clo...

(I'm not affiliated in any way with these guys, and I'm aware they just had an outage while updating the server code to defend against a DDOS attack, but they seem good! )

philip1209 · on March 4, 2013

For an analogy, the best way to stop a big flood is with a dam, and services like Cloudflare provide an upstream (i.e. DNS) dam mitigating DDOS.

Without such an upstream service and short of building an extensive infrastructure yourself, you basically have to batten down the hatches and have a server (plus preceding switches etc.) that can handle a large amount of traffic.

I think there are other services, but Cloudflare is the most prominent and is used by sites like 4Chan to avert DDOS.

laumars · on March 4, 2013

This is what I used to believe as well. But I'm reading more and more about how ISPs are filtering out such attacks and how some dedicated networking gear (eg Pravail APS) can stop at least some types of DDoS attacks from saturating your web farm.

It's that side of things that I'm mostly unclear about. Are solutions like Pravail APS basically snake oil?

keefe · on March 5, 2013

I'd probably try an epoll based reverse proxy like nginx sitting in front of my application, which I'd then aggressively test. I'd download large ion cannon or whatever the kiddies are using these days.

There's probably something you can do at the DNS level.