DDoS attacks and protection

A denial of service attack tries to make a service unusable by sending it more traffic than it, or its connection to the internet, can handle. In a distributed denial of service (DDoS) attack, the traffic comes from many machines at once, often computers and devices that attackers have taken over, so blocking one sender does not stop it.

Floods

Huge amounts of traffic that fill the connection to your server, so that real traffic cannot get through.

Reflection attacks

The attacker sends small requests to other people's servers, with your address forged as the sender. Those servers send their much larger answers to you.

Connection floods

Masses of requests to open connections, which the server keeps track of until it runs out of room for real ones.

Application floods

Requests that look real, such as page loads on a website, sent faster than the site can answer them.

Protection filters traffic before it reaches your server. It drops packets that real traffic never contains, limits how fast one sender and all senders together may send, and applies rules for each address. The filtering has to happen where the network has room for the attack: once a flood fills your server's own connection, filtering on the server itself comes too late.

At Coritan, DDoS Shield filters the traffic to your floating IPs at the points of presence where it enters the network, before it reaches your instance or server. Coritan announces its addresses from several points of presence (anycast), so traffic from senders around the world enters at the point of presence nearest each of them, and each one filters what it receives (How the Coritan network works).

DDoS Shield is on for every floating IP from the moment Coritan assigns it, and the checks apply from the first packet of an attack. There is nothing to turn on (How DDoS Shield works).

DDoS Shield reads packet headers and does not look inside connections, so it cannot stop an application flood made of requests that look real. For a website, put a web proxy in front of it: the WAF checks each request, and the edge turns away clients that send too many (Web proxies, origins and the WAF).

When DDoS Shield drops traffic to an address at a high rate, it records an attack event, and the Events tab of DDoS Shield lists it (Read attack events). Coritan emails you when an attack on one of your floating IPs starts, and again when it ends (Attack emails). To drop all traffic from one sender or range, block it (Block a traffic source). If an attack still takes a service down, tell Coritan at once (Get help during an attack).

• Order a floating IP
• Change a floating IP's DDoS protection
• Game server protection
• Block a traffic source
• Get help during an attack
• The DDoS Shield product page on coritan.com