DDos Protection from ISP

Forums › New Zealand Broadband › DDos Protection from ISP

1 | 2 | 3 | 4

4110 posts

Uber Geek
+1 received by user: 1322

Trusted

#1165412 31-Oct-2014 00:29

I suppose if we had to stop advertising a /24 we could NAT those behind it to a spare ip address on another subnet at the border routers. Would only take a minute to manually switch on. Bigger ISPs with more complex networks would find it a bit harder I guess.
But its only a temporary measure and not really a solution if a problem customer keeps causing it.

Ray Taylor

There is no place like localhost

Spreadsheet for Comparing Electricity Plans Here

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 459
Inactive user

#1165532 31-Oct-2014 09:28

There are a number of DDoS mitigations at Spark. The hardest DDoS's to hit are when there is a UDP targeted attack against a large pool of IP addresses from a random source. As you can't really cut large groups of your customers off since they are being attacked.

But I have seen a recent graph showing a DDoS targeted to a single IP address in excess of 30 Gigabits per second and that lasted for over an hour or so.

Filtering inbound port 53 (DNS) traffic on customers unless they opt out of Port 25 filtering is a recent addition, it still gets carried across the network which if I had anything to do with it the traffic would get dropped further towards the source. But that leads to a whole myriad of other issues. The filter also means that customers don't get billed for the usage if there is a random DDoS.

zaptor

759 posts

Ultimate Geek
+1 received by user: 47

#1165582 31-Oct-2014 10:01

My limited understanding is that DDoS services vary significantly in terms of attack duration and node count.

DDoS services are basically commoditized - and legal.

Last time I checked minimum block sizes could be rented in 5 minute chunks, with minimum attack durations specified within that. I think the lower capacity DDoS offerings are targeted towards the mass/consumer market. I don't think they're necessarily intended to disrupt ISP subnets, but, just enough to give someone (like a console gamer) an "edge" during online play.

An acquaintance of my son uses a similar service.

The problem is when everyone starts fighting fire with fire.

freitasm

BDFL - Memuneh
81343 posts

Uber Geek
+1 received by user: 42684

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1165590 31-Oct-2014 10:11

"Legal"?

Where? Certainly not in New Zealand.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

LEGAL video, movies and TV download and streaming options in New Zealand

zaptor

759 posts

Ultimate Geek
+1 received by user: 47

#1165595 31-Oct-2014 10:23

freitasm: "Legal"?

Where? Certainly not in New Zealand.

You mean I'm not allowed to DDoS my own site to check server integrity?

(disclaimer: I have no idealogical view on the matter either way, I was just saying)

freitasm

BDFL - Memuneh
81343 posts

Uber Geek
+1 received by user: 42684

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1165598 31-Oct-2014 10:26

By doing a DDoS on your own site you will be disrupting services to other users in the same hosting/colocation facility.

It's no excuse. If you want to load test your site/server then you should do in a private network.

DDoS on anyone else is not legal anyway.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

LEGAL video, movies and TV download and streaming options in New Zealand

Geekzone support

Support Geekzone with one-off or recurring donations Donate via PressPatron.

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 459
Inactive user

#1165649 31-Oct-2014 10:55

freitasm: By doing a DDoS on your own site you will be disrupting services to other users in the same hosting/colocation facility.

It's no excuse. If you want to load test your site/server then you should do in a private network.

DDoS on anyone else is not legal anyway.

Not that I have gone hunting, but I would find it hard to believe that any DDoS "services" would remotely recognise anything near legal, especially in this country. And if it were legal in another dubious country then it certainly is immoral.

zaptor

759 posts

Ultimate Geek
+1 received by user: 47

#1165652 31-Oct-2014 10:58

Curious.

Wouldn't it depend on the magnitude and type of DDoS?

If I DDoS a specific IP address (that I own/rent), and no one notices (effectively) - meaning no disruption to my local subnet, then is it that (grudgingly) permissable?

It seems there are low capacity DDoS attempts occurring constantly (which are annoyingly effective), especially on networks with a high quotient of online gamers. But it's only the high capacity ones that get noticed.

freitasm

BDFL - Memuneh
81343 posts

Uber Geek
+1 received by user: 42684

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1165655 31-Oct-2014 10:59

If you are using a "DDoS service" to "test" your own address it will still have to traverse other networks to get to you. If you want to do a load test (a very different thing) then you will be running in-house, inside your own network, not going through the public Internet or shared networks.

There's no excuse.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

LEGAL video, movies and TV download and streaming options in New Zealand

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 459
Inactive user

#1165656 31-Oct-2014 11:01

zaptor: Curious.

Wouldn't it depend on the magnitude and type of DDoS?

If I DDoS a specific IP address (that I own/rent), and no one notices (effectively) - meaning no disruption to my local subnet, then is it that (grudgingly) permissable?

It seems there are low capacity DDoS attempts occurring constantly (which are annoyingly effective), especially on networks with a high quotient of online gamers. But it's only the high capacity ones that get noticed.

Nope. DDoS of any type isn't legal. There is something in the second D of DDoS that has problems.

zaptor

759 posts

Ultimate Geek
+1 received by user: 47

#1165682 31-Oct-2014 11:29

freitasm: If you are using a "DDoS service" to "test" your own address it will still have to traverse other networks to get to you. If you want to do a load test (a very different thing) then you will be running in-house, inside your own network, not going through the public Internet or shared networks.

Fair enough.

I don't think it really answers the questions I raised earlier. Even if it does traverse other networks, so long as no one notices (or cares), then it appears there is a precedent for such a service to exist. In a hypothetical situation where a DDoS is harming no one except the intended/authorized recipient, then what's the argument against that?

plambrechtsen: Nope. DDoS of any type isn't legal. There is something in the second D of DDoS that has problems.

Not sure, it means what you think it means:
250.1 refers to endangerment of life
250.2 refers to a computer system "he or she" is not authorised on

If a computer tutor wants to demonstrate to his students (I don't know - say "security 101") how a DDoS works by attacking one of the classroom PCs using other classroom PCs all on the same classroom LAN, I'm fairly certain that tutor isn't breaking the law.

Mighty Ape

Shop now at Mighty Ape (affiliate link).

freitasm

BDFL - Memuneh
81343 posts

Uber Geek
+1 received by user: 42684

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1165685 31-Oct-2014 11:31

You're completely missing the point or trying to create something that doesn't exist.

DDoS are not testing tools. It will affect networks as it goes through.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

LEGAL video, movies and TV download and streaming options in New Zealand

plambrechtsen

1948 posts

Uber Geek
+1 received by user: 459
Inactive user

#1165686 31-Oct-2014 11:32

zaptor:
freitasm: If you are using a "DDoS service" to "test" your own address it will still have to traverse other networks to get to you. If you want to do a load test (a very different thing) then you will be running in-house, inside your own network, not going through the public Internet or shared networks.

Fair enough.

I don't think it really answers the questions I raised earlier. Even if it does traverse other networks, so long as no one notices (or cares), then it appears there is a precedent for such a service to exist. In a hypothetical situation where a DDoS is harming no one except the intended/authorized recipient, then what's the argument against that?

plambrechtsen: Nope. DDoS of any type isn't legal. There is something in the second D of DDoS that has problems.

Not sure, it means what you think it means:
250.1 refers to endangerment of life
250.2 refers to a computer system "he or she" is not authorised on

If a computer tutor wants to demonstrate to his students (I don't know - say "security 101") how a DDoS works by attacking one of the classroom PCs using other classroom PCs all on the same classroom LAN, I'm fairly certain that tutor isn't breaking the law.

How can you be sure of this?? Normally a DDoS floods the international inbound capacity. There would have been packets either dropped or delayed.

If you are doing it as per your example on a local LAN then that's fine, but as soon as you traverse a network you don't own (such as the ISP) then you are breaking the law IMHO.

From the above link:

250Damaging or interfering with computer system

(2)Every one is liable to imprisonment for a term not exceeding 7 years who intentionally or recklessly, and without authorisation, knowing that he or she is not authorised, or being reckless as to whether or not he or she is authorised,—
- (c)causes any computer system to—
- - (ii)deny service to any authorised users.

Seems pretty clear cut in my view. DDoSing someone prevents other from using the network.

zaptor

759 posts

Ultimate Geek
+1 received by user: 47

#1165728 31-Oct-2014 11:54

freitasm: You're completely missing the point or trying to create something that doesn't exist.

DDoS are not testing tools. It will affect networks as it goes through.

AFAIK these DDoS services exist under the (false?) guise that they provide a legitimate service. Well, that seems to be the rationale anyhow.

Personally, I dislike the fact these services exist in the first place. I certainly do not use them.

But, I could see how their existence might be deceptively justified.

zaptor

759 posts

Ultimate Geek
+1 received by user: 47

#1165733 31-Oct-2014 11:57

plambrechtsen: If you are doing it as per your example on a local LAN then that's fine...

Agreed.

I believe that's what I was trying to clarify for you, since you said "DDoS of any type isn't legal".

1 | 2 | 3 | 4