DDoS appliances reviews needed

[nanogml at Mail.DDoS-Mitigator.net (alvin nanog)]

hi ramy

On 08/26/15 at 12:54pm, Aftab Siddiqui wrote:
> 
> > Anybody here has experienced a PoC for any anti DDoS appliance, or already
> > using a anti DDoS appliance in production and able to share his user
> > experience/review?
> >
> 
> only interested in appliance? why not scrubbing services? is it for own use
> (industry reviews before purchase) or some article/publication/research?

see previous similar thread for some "real world reviews by folks"

http://mailman.nanog.org/pipermail/nanog/2015-April/074410.html

i think a "benchmarking ddos lab" would be fun to build and publish findings..
to test all the ddos appliances from those competitors willing to participate

---

for your "reviewing" or collecing info from folks ..
- what's your metrics that is important to you ?
- what (ddos) problems are you trying to resolve ?

- do you want to see the ddos attacks in progress and how you're being attacked
	http://ddos-mitigator.net/cgi-bin/IPtables-GUI.pl

- do you want 100% automated ddos defense with zero false positives :-)

my $0.02 ddos experiences n summary over the years, aka mitigation in production use ...

usually, arp-based ddos attacks requires fixing your infrastructure, 
  a ddos appliance may not help you

usually, udp and icmp ddos attacks can only be resolved by the ISP or scrubbing centers
	- if you limit udp/icmp at your appliance, the damage is already done,
	since those packets used your bandwidth, cpu, memory, diskspace and your time

spoof'd source addresses can only be resolved by having the ISP preventing outgoing
spoofed address ( fix egress filters ) at their edge routers

my requirement: all tcp-based ddos attacks must be tarpit'd ... ddos attacks
are now 1% of it's peak a few years ago where "firefox google.com" wouldn't come up

	- you must be able to distinguish legit tcp traffic from ddos attacks
	which is ez if you build/install/configure the servers properly

	i want the attacking zombies and script kiddies to pay a penalty for 
	attacking my customer's servers

	to sustain a 100,000 tcp packets attack requires lots of kernel memory 
	( 100,000 packets * 1500 byte/packet * 120 seconds ) for 2minute tcp timeouts 

	there are 65,535 tcp they could be attacking ... imho, an ssh-based solution
	or apache-based solution would be useless ... add another 65,535 udp ports

always keep your servers up to date ... patch your OS, apps, etc, etc

volumetric attacks can only be resolved by (expensive) ddos scrubbers or installing 
your own geographcially separated colo in usa, europe, asia like the scrubbers ... 
if you are high profile target, the ddos attackers probably has more bandwidth than 
you could afford and the ddos attacks will probably make the evening news

magic pixie dust
alvin
# DDoS-Mitigator.net/Competitors
# DDoS-Mitigator.net/InHouse-vs-Cloud
# DDoS-Simulator.net
#