4th Gen Bot Attacks vs Raw Power DDoS on CDNs
Since DiamWall beta opening, we had hundreds of clients looking for DDoS Protection, this needing was related to the 4th Generation Bot Attacks which led to their current Anti-DDoS provider being bypassed (More information at: The four generations of bots and the upcoming fifth generation).
Most of these clients weren't only attacked by "smart" attacks, which simulated real browsers, but in addition to that, hackers usually mix it with raw power. Making this easy to understand, nowadays attacks aim to bypass the protection by solving their Javascript Challenge or Captchas, these attacks are normally launched by the headless environment, such as headless chrome, which does a lot of resources consumption by these words we mean that a 4th gen attack takes to the attacker tons of resources, it means that this attack overall does not generate many connections per second.
As a Content Delivery Network that handles these attacks mitigation for our clients, mitigating 4th gen attacks is a case of 'intelligence' and not 'resources power' since for us it consumes almost nothing, but, raw power is another conversation, raw power doesn't aim to bypass protections or fully fill the webserver needs such as sending the right HTTP Headers, instead of that, raw power aims in sending an exorbitant HTTP/TLS connections per second that could fully fill the resources of the whole network, even an anycast network. When a new CDN arrives, hackers don't normally try to 'bypass' them, instead of that, they use their raw power to fully fill the CDN resources and bring all their clients offline.
Handling Millions of Requests Per Second: The Importance of a Powerful Network for DDoS Mitigation
As on DiamWall, we are always ready to combat any DDoS Attack, so the question that might sustain the reader is... How can we handle millions of requests per second?
To understand the needing of handling such attacks here is one of the Raw DDoS Attacks captured by DiamWall aiming at one of our customers:
* In this image, the customer was currently under a 2.6mr/s DDoS Attack, almost 3 hours later, the service was still under attack and it could spike into a 6mr/s
We have no issue handling 6 million requests per second since DiamWall mitigation can detect such an attack and instantly drop it, but as a security company we have to put all our cards on the table, let's imagine there is no mitigation system, could we handle such traffic?
This is where we understood that we needed a bigger and more powerful network, while our current provider wasn't able to provide us BGP Sessions or the customized hardware necessary for our needings, we had to search for something else.
This is where we meet DataPacket,
DataPacket was the only provider we can say fit all our needings, we got our custom hardware, 20gbit/s port speed (per machine), and amazing support. Since our old provider didn't let us build our BGP Network, we used GeoDNS for our anycast network, but Datapacket provided us with every single necessary feature.
Being DataPacket a hoster that any CDN service can dream about, everything seemed too perfect to be true, so we had to run our own tests on their Network Speed and the stability of the resources, and we would love to share them.
Performance Testing: Handling 1.2 Million Connections Per Second on a Single Machine
We did a raw test at one of their 3rd EPYC machines (48 cores), where we wanted to see without our mitigation applied and using only our CDN Optimizations, how many connections per second a unique machine could handle, and this was the result:
From our 3 personal domains, we did the test under 1 of the personal, my personal domain, pointing to a single machine, as we can break down this screenshot we can see that the connections per second are at 1.2m, and the average CPU Usage is at 58%.
So, without our mitigation applied, using our own CDN Systems & Optimizations, we could make a single machine handle 1.2mr/s at 58% CPU Usage, you can imagine what we can do with anycast with hundreds of machines.
Of course, this is only for performance testing purposes, since our mitigation wouldn't let an attack reach even 200kr/s, but is always good for us to see how far we can go.
We have to thank DataPacket for providing us with such amazing hardware, amazing stability, and an amazing network, we couldn't ask for better.
With our own CDN Systems, Mitigation Intelligence, and datapacket amazing hardware we are unstoppable, and ready to handle an unmetered number of clients with an unmetered number of legit req/s.
Important Information: All of these tests were made on a single machine, while currently, DiamWall anycast counts with machines worldwide.