Recently, customers always ask a question: “How much do you use the high defense CDN a month in the end?” To be honest, this question is the same as asking “how much a car” - depends on whether you want to buy a Wuling Hongguang or a Porsche. I have been practicing network security for eight years, hand over the high defense CDN not a hundred there are eighty sets, today simply the bottom of the industry pants down, talk about the price of those things.
First of all, I'd like to throw a pot of cold water: but where the fixed monthly fee is directly reported, 80% is a two-way street vendor. The real reliable high defense CDN are on-demand billing, price = basic package + flexible costs + hidden costs. Last year, our company suffered a wave of 500G DDoS, then used an international factory billed by the flow, overnight bill enough to buy a Model 3 - blood lessons told me that the CDN can not just look at the numbers on the quotation.
The waters run deep for basic packagesThe following two models are common in the market. There are two common models on the market: one is like CDN5 such as domestic service providers, like to push the “guaranteed bandwidth + elastic expansion”, such as 100Mbps guaranteed bandwidth + 2T traffic package monthly fee of about 3,000; the other is the international vendors such as CDN07, directly by the number of requests charged per million requests from 0.5 knife. I found that small and medium-sized sites with the former more cost-effective, after all, the sudden traffic will not accelerate the heartbeat.
But here comes the point:It's the cost of defense that's the big one.. Ordinary CC protection may just add 500 yuan / month, really want to carry T-level DDoS, the price directly exponential rise. Last year, we tested 08Host's 300G defense package, monthly payment of 6800 looked at the pain, but compared to the loss of business downtime was pierced, simply a drop in the bucket.
Here is an unspoken rule of the industry: many vendors write “unlimited defense” is purely a word game. Really encountered a huge traffic attack, people directly give you empty routes, not as clear as the price of the manufacturer of the upper limit of protection is really clear. I have suffered this loss - a vendor contract hidden in the sentence “more than 5T traffic right to suspend service”, the attack came really direct pinch line, customer service also smiled and said “This is for your cost considerations! ”This is for your cost consideration.
Traffic billing pits are more exciting. Look at this configuration code for typical billing logic for CDN07:
Doesn't look like much per unit, does it? But don't forget that HTTPS requests are billed extra! If you do a picture site, billions of requests per month, the bill can scare out of the heart. Tested an e-commerce site, monthly traffic 20TB +300 million requests, the final bill equivalent to 21,000 yuan, four times more expensive than the basic package.
Burst traffic protection is the litmus testThe first thing you need to do is to get rid of it. Some vendors boast “free super defense”, really encountered an attack either cleaning delay is ridiculously high, or directly dumped to the “force majeure”. I now choose vendors must look at two points: whether there is a second effect of the elastic expansion mechanism, and whether the excess traffic allowed to make up the ticket after the fact. 08Host in this piece of work is quite real, the attack on the peak over the package limit is automatically billed at 0.8 yuan / GB, the business is not interrupted at all.
There's a much more dramatic maneuver--Regional pricing differences. The same level of protection, the North American node may be 40% more expensive than Southeast Asia, but many vendors do not take the initiative to inform when they quote. Have helped customers deploy global business, the original budget of 50,000 / month, and finally due to Europe and the United States node overrun to 70,000 yuan. Later learned a good lesson, and now require vendors to produce a node unit price table:
Don't buy into the “unlimited defense” crap.. Any vendor who really dares to write about unlimited defense should be asked three direct questions: What is the total capacity of the cleaning center? What is the maximum size of the attack that has been handled? When the volume is exceeded, is the empty route or continue to clean? After asking the other side stammered, basically can pass. The actual industry ceiling is in the 3-4T or so, and then up to rely on multi-vendor triage.
Now to be honest:What should SMEs chooseThe following are some of the most common features of the CDN5. Average daily traffic of less than 100GB site, with CDN5 entry package is enough, 1500-2000 yuan / month with 20G protection; if the e-commerce or gaming business, it is recommended to choose 08Host customized program, 5000 yuan to start but with intelligent CC protection; really not bad money on CDN07 Global Acceleration, the monthly payment of no less than 20,000, but wins the statement to do a good job, the boss looked! Happy.
A final reveal:Hidden Costs Are Worse Than Explicit PricesDo I need to buy additional SSL certificates? How do you bill for return traffic? Do you charge for log analysis? Some vendors even charge for API calls! I have seen the most outrageous - a certain family charged by the number of attacks, was attacked by SYN Flood 24 hours in a row, the next day to receive the bill almost alarm.
My ultimate advice:Buy the basic monthly subscription first, then turn on pay-per-useThis is so that the cost is manageable in normal times and there is no interruption of service. This way the cost is usually manageable and the service is not interrupted when there is an emergency. The test phase must be run with real traffic for seven days, focusing on peak latency and cleaning accuracy. Don't forget to cut the price! The CDN industry gross margin is as high as 60%, with a lot of space, and the annual payment can usually be discounted by 70%.
These days even the CDN have to “prevent teammates”, price traps than DDoS is also difficult to prevent. Remember the saying: cheap may not be no good goods, but good goods are certainly not cheap. The key to see what the business can not afford to lose - is money, or user trust.
