Recently, several friends doing social platforms ran to ask me, high defense CDN in the end how to choose, the price is not all like the legend so scary. To be honest, the first time I contacted this piece of time I also confused, the vendor quotation to see dazzling, from a few thousand to hundreds of thousands of all, in the end which is truly affordable, which is the IQ tax? Today I will combine the pit I stepped on and the actual test data, break open and talk about this.<\/p>\n
First pour pots of cold water: do not believe those \u201cunlimited defense\u201d \u201cnever downtime\u201d ghost words. This line of water is very deep, some vendors to 5Gbps defense labeled as 100Gbps sale, was hit directly to you back to the source, crying too late. I have tested a service that claims to \u201cignore any attack\u201d, the results of a simple CC attack on the broken defense - and later found that they did not even do the basic behavioral analysis.<\/p>\n
The cost of defense in the social business is essentially paying for monstrous spikes in traffic. Normal user access is a smooth curve, but attack traffic is like a seismic wave, instantly rushing high. The core value of a high-defense CDN is to digest this aberrant traffic at the edge nodes and not let it hit the source server. Here it involves two core costs: bandwidth costs and cleaning costs.<\/p>\n
Bandwidth costs look at normal business traffic, usually billed at 95 peaks per month or monthly totals. Cleaning cost is to pay for the defense capability, the current mainstream is billed by the peak attack or buy defense package. For example: If the daily bandwidth of the business is 200Mbps, one day suddenly encountered 300Gbps DDoS attack, then the billing benchmark is based on the 300Gbps cleaning capacity to calculate, even if it lasted only 5 minutes.<\/p>\n
Now for the real stuff. I pulled quotes from three common vendors to compare (CDN5, CDN07, 08Host), with data from real-world testing last year to help select a model for an audio\/video social platform:<\/p>\n
CDN5<\/strong>: Suitable for scenarios with lots of sudden attacks. The basic package starts at 20,000 per month, including 200Mbps bandwidth and 200Gbps defense. The excess cleaning traffic is billed at $0.8\/Gbps\/hour. The biggest advantage is that there are many nodes around the world, low latency in Southeast Asia, but the number of HTTP\/HTTPS requests counts for something else, and API calls are often easy to exceed the budget.<\/p>\n CDN07<\/strong>: More aggressive defense strategy, suitable for financial social applications. The basic package is 35,000\/month with 300Mbps bandwidth + 300Gbps defense, featuring a self-contained web application firewall that can block most CC attacks. I have tested their AI algorithm, and the recognition rate of slow attacks can reach 90%, but the number of nodes is small, and the latency of Americas user access is high.<\/p>\n 08Host<\/strong>The first choice for small and medium-sized social platforms is 15,000\/month for 100Mbps bandwidth + 100Gbps defense, and only $0.5\/Gbps\/hour for excess cleaning costs. The biggest highlight is the free provision of certificate management and basic WAF, but the node resistance to heavy traffic attacks will occasionally trigger the meltdown mechanism, you need to configure a good degradation strategy in advance.<\/p>\n Here is a pit to pay special attention to: many vendors of \u201cunlimited defense\u201d in fact, only for UDP Flood such as easy to clean the attack, encountered TCP connection-type attacks or advanced CC, directly dumped to the customer. It is best to clearly state the type of defense and compensation standards in the contract.<\/p>\n Configuration example is actually not that complicated, the core is to do a good job of traffic scheduling. I'd like to share a Nginx+Lua script that I commonly use to identify anomalous traffic and switch to a cleaning node:<\/p>\n The actual cost control also depends on the business characteristics. Pure text chat and live audio and video defense costs can be 10 times different. The former is mainly to prevent CC attacks, the number of requests per second (RPS) is a key indicator; the latter has to carry UDP Flood and DNS reflection attacks, the cost of bandwidth is a big head. Once a customer in order to save money only use the basic defense, the results of the live broadcast was 30Gbps UDP attack penetration, downtime loss of one day than the annual defense budget is higher.<\/p>\n Sincerely suggest that the bosses of social business: at least set aside 10% technology budget for security protection. Don't look at the business is calm now, when really being watched, temporary purchase of services is not the price. Last year, a dating platform was competitors played a set of combinations, temporary purchase of 500Gbps defense, a day to burn 200,000 - enough to buy a full-year package.<\/p>\n Finally, a tyrannical theory: these days, even CDNs have to \u201cprevent teammates\u201d. Some vendors do not have enough nodes to rent second-hand bandwidth, and when they are hit, the link overload directly collapses. It is best to ask for node topology diagrams and BGP broadcast information when selecting a model, but any stumbling directly pass.<\/p>\n To summarize, there is no standard answer to the social high defense CDN, the key to look at the business scenarios and attack characteristics. Small platforms first 08Host such cost-effective services, daily activity of more than a million and then consider CDN5 full link optimization, financial level demand and then look at CDN07. price from the monthly payment of a few thousand to hundreds of thousands of reasonable, but remember: the essence of the defense is the transfer of costs, the cost of uncontrollable attacks into a controllable budget for protection, it is worth the money spent.<\/p>\n If a vendor really quotes you a million dollar annual fee, just slap this article in his face - unless they can provide military-grade near-source cleaning and 7\u00d724 second response, it's all bullshit.<\/p>","protected":false},"excerpt":{"rendered":" Recently, several friends doing social platforms ran to ask me, high defense CDN in the end how to choose, the price is not all like the legend so scary. To be honest, the first time I contacted this piece of time I also confused, the vendor quotation to see dazzling, from a few thousand to hundreds of thousands of all, in the end which is truly affordable, which is the IQ tax? Today I will combine the pit I stepped on and the actual test data, break open and talk about this. First pour pots of cold water: do not believe those \u201cunlimited defense\u201d \u201cnever downtime\u201d ghost words. This line of water is very deep, some vendors put 5Gbps defense labeled as 100Gbps to sell, was hit directly to you back to the source, crying too late. I have tested a service that claims to \u201cignore any attack\u201d, the results of a simple CC attack on the broken defense - and later found that they did not even do the basic behavioral analysis.<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"gallery","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","footnotes":""},"categories":[150],"tags":[],"collection":[],"class_list":["post-1004","post","type-post","status-publish","format-gallery","hentry","category-updates","post_format-post-format-gallery"],"_links":{"self":[{"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/posts\/1004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/comments?post=1004"}],"version-history":[{"count":1,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/posts\/1004\/revisions"}],"predecessor-version":[{"id":1121,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/posts\/1004\/revisions\/1121"}],"wp:attachment":[{"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/media?parent=1004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/categories?post=1004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/tags?post=1004"},{"taxonomy":"collection","embeddable":true,"href":"https:\/\/www.ddosgj.com\/en\/wp-json\/wp\/v2\/collection?post=1004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}