Cloudflare blocks 15M rps HTTPS DDoS attack

Cloudflare blocks 15M rps HTTPS DDoS attack
Cloudflare blocks 15M rps HTTPS DDoS attack

Earlier this month, Cloudflare’s systems automatically detected and mitigated a 15.3 million request-per-second (rps) DDoS attack — one of the largest HTTPS DDoS attacks on record.

While this isn’t the largest application-layer attack we’ve seen, it is the largest we’ve seen over HTTPS. HTTPS DDoS attacks are more expensive in terms of required computational resources because of the higher cost of establishing a secure TLS encrypted connection. Therefore it costs the attacker more to launch the attack, and for the victim to mitigate it. We’ve seen very large attacks in the past over (unencrypted) HTTP, but this attack stands out because of the resources it required at its scale.

The attack, lasting less than 15 seconds, targeted a Cloudflare customer on the Professional (Pro) plan operating a crypto launchpad. Crypto launchpads are used to surface Decentralized Finance projects to potential investors. The attack was launched by a botnet that we’ve been observing — we’ve already seen large attacks as high as 10M rps matching the same attack fingerprint.

Cloudflare customers are protected against this botnet and do not need to take any action.


Cloudflare blocks 15M rps HTTPS DDoS attack

The attack

What’s interesting is that the attack mostly came from data centers. We’re Continue reading

Practical Python For Networking: 6.2 – Package Examples – Video

This lesson walks through basic examples of packages. Course files are in a GitHub repository: https://github.com/ericchou1/pp_practical_lessons_1_route_alerts Eric Chou is a network engineer with 20 years of experience, including managing networks at Amazon AWS and Microsoft Azure. He’s the founder of Network Automation Nerds and has written the books Mastering Python Networking and Distributed Denial Of […]

The post Practical Python For Networking: 6.2 – Package Examples – Video appeared first on Packet Pushers.

Arm launches new IoT processors

Arm Holdings launched its latest micro controller design to provide high-performance computing at the edge as well as two new platforms to help reduce development time of internet of things (IoT) devices.Normally, the Cortex-M line of controllers is used in small low-power devices, like smart watches, but the Cortex-M85 performs better than the rest of the line. It is designed to improve artificial-intelligence operations such as voice recognition on edge devices including smart-home products and drones.To read this article in full, please click here

5G, automotive to drive semiconductor revenue through 2022

Worldwide semiconductor revenue is set to increase by 13.6% this year as demand continues to exceed supply, according to a Gartner Research report.That growth will likely level off in 2023, however, with just a 3.6% increase predicted for that year, noted the report, which was released Tuesday. It's a function of overall supply and demand coming into near-balance in the future, according to Gartner.The chip shortage that has created widespread supply constraints in the recent past is beginning to ease, although some sectors — most notably the automotive industry – will still see demand outstripping supply for the foreseeable future.Alan Priestley, the report's author and a research vice president at Gartner, said that automotive semiconductor demand will grow despite flaccid overall vehicle production.To read this article in full, please click here

Two voting days, a debate and a polling rule in France impacts the Internet

Two voting days, a debate and a polling rule in France impacts the Internet
Two voting days, a debate and a polling rule in France impacts the Internet

We blogged previously about some trends concerning the first round of the 2022 French presidential election, held on April 10. Here we take a look at the run-off election this Sunday, April 24, that ended up re-electing Emmanuel Macron as President of France.

First, the two main trends: French-language news sites outside France were clearly impacted by the local rule that states that exit polls can only be published after 20:00.

And Internet traffic was similar on both the election days (April 10 and 24) and that includes the increase in use of mobile devices and interest in news websites — there we also saw a clear interest in the Macron-Le Pen debate on April 20.

We have discussed before that election days usually don’t have a major impact on overall Internet traffic. Let’s compare April 10 with 24, the two Sundays when the elections were held. The trends throughout the day are incredibly similar (with a slight increase in traffic on April 24), even with a two-week gap between them.

Two voting days, a debate and a polling rule in France impacts the Internet

Another election-day trend is the use of mobile devices to access the Internet, mainly at night. The largest spikes in number of requests made using mobile devices in Continue reading

Deux jours de vote, un débat et une réglementation concernant les élections en France impactent l’Internet

Deux jours de vote, un débat et une réglementation concernant les élections en France impactent l'Internet
Deux jours de vote, un débat et une réglementation concernant les élections en France impactent l'Internet

Nous avons publié un article de blog consacré à certaines tendances concernant le premier tour de l'élection présidentielle française de 2022, qui s'est déroulé le 10 avril. Nous nous intéressons ici au second tour de l'élection, qui a eu lieu le dimanche 24 avril et a abouti à la réélection d'Emmanuel Macron à la présidence de la France.

Tout d'abord, les deux principales tendances : les sites d'information francophones situés hors de France ont été clairement impactés par la réglementation locale, qui stipule que les estimations ne peuvent être publiées qu'après 20 heures.

Le trafic Internet a été similaire les deux jours de l'élection (les 10 et 24 avril), et cela inclut l'augmentation de l'utilisation des appareils mobiles et l'intérêt pour les sites d'actualités – - là aussi, nous avons constaté un net intérêt pour le débat Macron-Le Pen du 20 avril.

Nous avons déjà évoqué le fait que les jours d'élections n'ont généralement pas un impact majeur sur le trafic Internet global. Comparons les journées des 10 et 24 avril, les deux dimanches où ont eu lieu les élections. Les tendances tout au long de la journée sont incroyablement similaires (avec une légère augmentation du trafic le 24 Continue reading

How To Work With A Sponsor For Your IT Blog

For many years, I’ve been working with B2B IT vendors who sponsor content with my company to market their offerings. My co-founder and I have learned many lessons–some the hard way–about dealing with these vendors and the content they create with us.

In this article, I’ll focus on handling a specific scenario. You’ve got a niche blog where you write as a deeply technical expert in a IT field such as cloud, networking, storage, development, or security. Your audience is made up of fellow nerds in similar orbits. You’ve been writing for years, and have developed a faithful audience who reads most of your stuff. After all this time, a real-deal vendor appears, wanting to place a sponsored blog post on your hallowed site. Now what?

You might think the sponsored content itself would be the most complicated part, and that once you hit publish, you’re mostly done. Not really. Back end logistics will likely take up more of your time. There are other considerations, too. Consider them carefully before trying to monetize your blogging hobby.

Mark Sponsored Content As Sponsored

If this is your first sponsored post, you might feel weird about it. The temptation can be to hide Continue reading

BGP Remotely Triggered Blackhole (RTBH)

DDoS attacks and BGP Flowspec responses describes how to simulate and mitigate common DDoS attacks. This article builds on the previous examples to show how BGP Remotely Triggered Blackhole (RTBH) controls can be applied in situations where BGP Flowpsec is not available, or is unsuitable as a mitigation response.
docker run --rm -it --privileged --network host --pid="host" \
-v /var/run/docker.sock:/var/run/docker.sock -v /run/netns:/run/netns \
-v ~/clab:/home/clab -w /home/clab \
ghcr.io/srl-labs/clab bash
Start Containerlab.
curl -O https://raw.githubusercontent.com/sflow-rt/containerlab/master/ddos.yml
Download the Containerlab topology file.
sed -i "s/\\.ip_flood\\.action=filter/\\.ip_flood\\.action=drop/g" ddos.yml
Change mitigation policy for IP Flood attacks from Flowspec filter to RTBH.
containerlab deploy -t ddos.yml
Deploy the topology.
Access the DDoS Protect screen at http://localhost:8008/app/ddos-protect/html/
docker exec -it clab-ddos-attacker hping3 \
--flood --rawip -H 47 192.0.2.129
Launch an IP Flood attack. The DDoS Protect dashboard shows that as soon as the ip_flood attack traffic reaches the threshold a control is implemented and the attack traffic is immediately dropped. The entire process between the attack being launched, detected, and mitigated happens within a second, ensuring minimal impact on network capacity and services.
docker exec -it clab-ddos-sp-router vtysh -c "show running-config"
See Continue reading

What is a SAN and how does it differ from NAS?

A storage area network (SAN) is a dedicated, high-speed network that provides access to block-level storage. SANs were adopted to improve application availability and performance by segregating storage traffic from the rest of the LAN. SANs enable enterprises to more easily allocate and manage storage resources, achieving better efficiency. “Instead of having isolated storage capacities across different servers, you can share a pool of capacity across a bunch of different workloads and carve it up as you need. It’s easier to protect, it’s easier to manage,” says Scott Sinclair, senior analyst with Enterprise Strategy Group.To read this article in full, please click here

China Stretches Another AI Framework To Exascale

The nexus of traditional high performance computing and artificial intelligence is a fact, not a theory, and the exascale-class machinery installed in the United States, Europe, China, and Japan will be a showcase for how these two powerful simulation and analytical prediction techniques can be brought together in many different ways.

China Stretches Another AI Framework To Exascale was written by Jeffrey Burt at The Next Platform.

Full Stack Journey 065: Developer Tools And Practices Other IT Disciplines Can Adopt

Today's Full Stack Journey asks: Are there tools, techniques, or practices common to software development that other IT disciplines should consider adopting? Can these tools and practices help other IT disciplines improve automation, operations, and daily tasks? Guests Adeel Ahmad and Kurt Seifried join host Scott Lowe to discuss.

The post Full Stack Journey 065: Developer Tools And Practices Other IT Disciplines Can Adopt appeared first on Packet Pushers.

Practical Python For Networking: 6.1 Python Packages – Introduction To Packages – Video

This lesson introduces packages, which let you bundle together different Python modules to re-use and share. Course files are in a GitHub repository: https://github.com/ericchou1/pp_practical_lessons_1_route_alerts Additional Resources: Packages Tutorial: https://docs.python.org/3/tutorial/modules.html#packages Python Modules And Packages: An Introduction: https://realpython.com/python-modules-packages/ Eric Chou is a network engineer with 20 years of experience, including managing networks at Amazon AWS and Microsoft […]

The post Practical Python For Networking: 6.1 Python Packages – Introduction To Packages – Video appeared first on Packet Pushers.

Building many private virtual networks through Cloudflare Zero Trust

Building many private virtual networks through Cloudflare Zero Trust

We built Cloudflare’s Zero Trust platform to help companies rely on our network to connect their private networks securely, while improving performance and reducing operational burden. With it, you could build a single virtual private network, where all your connected private networks had to be uniquely identifiable.

Starting today, we are thrilled to announce that you can start building many segregated virtual private networks over Cloudflare Zero Trust, beginning with virtualized connectivity for the connectors Cloudflare WARP and Cloudflare Tunnel.

Connecting your private networks through Cloudflare

Consider your team, with various services hosted across distinct private networks, and employees accessing those resources. More than ever, those employees may be roaming, remote, or actually in a company office. Regardless, you need to ensure only they can access your private services. Even then, you want to have granular control over what each user can access within your network.

This is where Cloudflare can help you. We make our global, performant network available to you, acting as a virtual bridge between your employees and private services. With your employees’ devices running Cloudflare WARP, their traffic egresses through Cloudflare’s network. On the other side, your private services are behind Cloudflare Tunnel, accessible Continue reading