Have you ever been woken up at 3:00 am by an alarm call saying that your website is down again? I still remember that customer e-commerce station was 500Gbps DDoS filled bandwidth, the entire server room paralyzed nightmare - these days, even hackers have begun to “group-buy” traffic cannon. But don't panic, today we will break open the crumbs to understand, high defense CDN in the end how to carry the flood attack, while allowing users to access as fast as lightning.
High-defense CDN is essentially a “sword guard” and “courier brother”, it has to stop the sword, but also have to send the package accurately to the hands of the user. A lot of white people think that a set of CDN will be able to rest easy, the results of CC attacks directly kneel - because you may buy just an accelerated CDN, the defense ability is about equal to the paper wall. I found that 70% of the so-called “high defense” services on the market, even SYN Flood can not filter clean, not to mention the popular application layer of slow attacks.
First of all, the defense mechanism. The core principle is “traffic cleaning”: malicious traffic is led to the cleaning center to pinch off, and then clean traffic back to the source. The key here is the distributed Anycast network - a bunch of global nodes sharing the same IP, the attack traffic will be automatically routed to the nearest cleaning center. For example, in CDN07, the delay of their Anycast nodes is reduced to less than 2ms, and the attack will be pressed to death before it spreads. Do not believe those who blow the single point of defense vendors, last time a company blow 200Tbps defense, the actual one hit through, because the traffic is all crowded in an entrance, the physical network card first collapse for the respect.
Specifically to the technical layer, the cleaning center relies on three layers of fingerprinting + behavioral analysis linkage. Simply put, the first look at the IP reputation library (such as TOR nodes or known botnets), and then analyze the packet characteristics (number of requests per second, connection duration). I often so configure WAF rules to block CC attacks:
But that's just the basics. When it comes to advanced attacks, you have to rely on machine learning and dynamic modeling - for example, CDN5“s algorithms can recognize ”human behavior patterns": normal users click with random delays, but robots are accurate to the millisecond level. They resisted an 8 million QPS HTTP flood last year by adjusting thresholds in real time, which is ten times more flexible than traditional rulebases.
In addition to the acceleration mechanism, this is more test of the underlying architecture of the CDN. Acceleration is not simply caching static files, but with edge computing to dynamic content also “pressure” to the user's doorstep. 08Host in this piece of play very smooth: their intelligent routing algorithms can choose the optimal path in real time, to avoid international link congestion. I measured the loading speed of the same picture from Tokyo to Los Angeles, using ordinary CDN to 380ms, 08Host pressure to 90ms - the difference is like riding a bicycle and riding a rocket.
Cache strategy is the soul of acceleration. Stupid people only set Cache-Control header, veterans play with edge caching logic. For example, for semi-dynamic content such as e-commerce product pages, I would use edge computing nodes to do localized caching:
Don't forget to optimize TCP for these underlying details. A good high defense CDN has to adjust the kernel parameters like an old Chinese doctor adjusting the body: expanding the SYN queue, enabling Fast Open, and adjusting the congestion algorithm.CDN07 even magically altered the BBR algorithm, which can still run full bandwidth on a link with a packet loss rate of 20%, and the measured video lagging rate dropped by 70% - this The technical barriers are enough for friends to chase for three years.
Now let's compare the actual combat data of several vendors. Last year, I did a stress test to simulate a hybrid attack (DDoS+CC+slow connection) when selecting a model for a financial client:
CDN5: cleaning delay <50ms, acceleration ratio 1:8 (i.e. 1Gbps back to the source to carry 8Gbps edge traffic), but the price is dead expensive, suitable for tycoon companies.
CDN07: Defense success rate of 99.99%, but dynamic acceleration is weaker, suitable for games such as defense priority scenarios.
08Host: the king of cost-effective, the best balance of defense and acceleration, especially good at the Asia-Pacific line, small businesses closed eyes into.
Lastly, I would like to say a few words from the bottom of my heart: don't look at the advertisements to see the efficacy of choosing a high-defense CDN. Be sure to ask vendors to provide real attack logs and MTR route tracking reports - I've seen too many second-rate dealers using CloudFlare fake data to fool people. Remember, those who can do both defense and acceleration well must be masters of both the underlying network and algorithms. Go check your CDN configuration now, don't wait until it blows up to pat yourself on the back.
