DDoS attacks are painful for individuals and for small and medium internet companies alike — even some large enterprises struggle with them. Here’s my own take on how Cloudflare, a top-tier CDN and security vendor, absorbs DDoS attacks.
What a DDoS Attack Is
The material below is drawn from Wikipedia.
Start with DoS: a denial-of-service attack, also called a flood attack, is a network attack whose purpose is to exhaust the target computer’s network or system resources, interrupting or stopping the service so legitimate users cannot reach it.
Then DDoS: when an attacker uses two or more compromised computers on the network as “zombies” to launch a denial-of-service attack against a specific target, it’s called a distributed denial-of-service attack.
In principle you’d think a firewall or scrubbing appliance could just filter out the junk packets. So why can’t small and medium companies solve it, and why does it even give large enterprises a headache? There are many kinds of DDoS, but they often saturate the network bandwidth, and bandwidth is very expensive. In 2019, for example, Alibaba Cloud took a 1.7 Tbps DDoS attack. Buying enough bandwidth to absorb that would cost a fortune — using Alibaba Cloud’s retail anti-DDoS bandwidth pricing as a reference, 30 Gbps costs ¥210,000 a year and 600 Gbps costs ¥3.8 million a year. Defending against DDoS with bandwidth alone is so costly that many small and medium companies simply let hackers extort them.
Analyzing the Solution
Since a DDoS attack is distributed by nature — traffic comes from all over the world and converges on one point to form an enormous flood — the defense has to be distributed too, turning a point into a surface. Let me walk through two cases of how DDoS defense is actually implemented.
Cloudflare, a Top-Tier CDN and Security Vendor
Cloudflare’s free tier offers unlimited attack mitigation. Every other vendor caps you: once you exceed the threshold they stop protecting you and pass traffic through to origin. Cloudflare claims there is no upper limit — it will absorb as much traffic as it can absorb, and it never falls back to origin.
How can Cloudflare offer unlimited mitigation? That’s a big claim. You’ll even find people online trying to probe Cloudflare’s actual limit, and they usually fail — they find they can’t take Cloudflare’s IPs down, that it’s practically invincible. How? That comes down to Anycast.
Anycast
Cloudflare was among the first to deploy Anycast at massive scale, and that invincible mitigation capacity is thanks to Anycast. I’m not a networking professional, so this is just my understanding — I’ll explain it in plain language.
In a traditional network we think of one IP address as mapping to one host, and one IP range as routing to one data center. Given an IP you can find the data center or the specific server. That’s also why a DDoS can take down an entire data center. Anycast produces a rather magical effect.
Anycast lets multiple AS numbers announce the same IP range from different regions, so one IP address can exist in any country and any data center simultaneously — and I do mean simultaneously.
The result: traffic from every country and region hits the same IP, but flows to whichever nearby data center is closest. Because of this, a distributed DDoS that was converging on one point becomes a bunch of regional bots each attacking their own local node. They can’t concentrate fire on one place. The attack is distributed, and so is the defense — distributed beats distributed.
Cloudflare advertises over 51 Tbps of network mitigation capacity. That can’t be any single data center; it must be the sum across all of them, with Anycast distributing traffic among them.
China Telecom’s Cloud Dike
I don’t know whether China Telecom’s Cloud Dike uses Anycast, but the principle is the same: route traffic from each region into Cloud Dike’s regional facilities first, then forward it to the real origin address. When an attack comes, each region handles its own region’s attack traffic, which stops a flood from converging on one place. Cloud Dike also advertises an invincible mode where it simply can’t be taken down.