I was thinking, if a DDoS attack can come in 2 ways:

  1. Sending large packets.
  2. Sending many packets.

Why don't network administrators limit IP connections, to let's say 3 users/IP's and set a limit on their bandwidth?

I don't see the problem. I know many software products, such as NetLimiter 3 Pro, that work fine to limit bandwidth, but they don't limit users/IP's.

  • 3
    How do you distinguish between legitimate traffic to a popular website, versus a DDoS? – user3463 Oct 4 '13 at 22:35
  • If you see 100 ips with same download rate, maybe you see. Or if you have 1 ip downloading all of your internet, ........... – Marcus N Oct 4 '13 at 22:36
  • 1
    So it depends, right? No algorithm is going to solve it without some form of intelligence. That's where people like CloudFlare come in. – user3463 Oct 4 '13 at 22:37
  • 1
    Can you rewrite the question? Besides being hard to understand what you are really asking, this will get a lot of opinion-based answers. – Doktoro Reichard Oct 4 '13 at 22:38
  • 2
    I then refer you to the about page and the help page. It seems to me like a lack of respect when you didn't even bother to read what is expected of the community. – Doktoro Reichard Oct 4 '13 at 22:46

Well, firstly, let's define the term "DDOS". That stands for Distributed Denial Of Service, keyword being distributed. If you limit the number of connections per IP, it doesn't matter, because you have a hundred thousand different IP addresses hammering your system.

So you limit by request size. Great, how do you distinguish between some guy F5ing and a node in a botnet?

But whatever, let's say we have a magic behavioural analysing algorithm. DDoS attacks seek to exhaust server resources and ensure the machine is not reachable--throwing complex data analytics at a problem caused by resource starvation is going to exacerbate the issue, not solve it.

The unfortunate fact of the matter is, even ignoring a connection takes some resources. You could consider looking into a service like Cloudflare, which mixes caching for low resource usage per request with (I believe) human aided DDoS detection, but re-implementing this service yourself is likely out of scope for most projects and would massively increase complexity.

  • Okay, I just dont know why nobody invented more security, ... its been years since internet and ports was invented. But I understand, you mean that computer virus that DDOS without you knowing it, with thousands of computers. THNX. – Marcus N Oct 4 '13 at 22:50
  • @MarcusN - The whole point is every single one of those connections could be a real connection. While you can place in some prevention like Cloudflare which will serve cache content instead of live content it still cannot tell the difference between a fake or real connection. – Ramhound Oct 4 '13 at 22:52
  • Ahaa, I should tell the DDOSED MMORPG owners CIPSOFT that o_O maybe they could make a solution. Ok interesting:P – Marcus N Oct 4 '13 at 22:54
  • @MarcusN: There is no solution in the general case. Even throwing up a black hole over entire IP ranges still requires your network hardware to identify and discard those connections, which still takes resources. You can make it harder, of course, but a DDoS attack relies on sheer scale, and in order to beat an attack which can scale up almost indefinitely you would need a machine capable of doing infinite work, which is impossible. – Phoshi Oct 5 '13 at 12:50

You can't limit them. If someone is shooting bullets at you, how do you impose a limit on how many bullets they can fire at you? By the time the bullet gets to you, the damage is already done.

  • Well, in this analogy you'd have to be god and able to heal yourself from a bullet wound as soon as the shooting stops. – Jon Oct 5 '13 at 1:11
  • 1
    The best analogy I have ever heard of a DDOS is a magnifying glass. If you take the light from the sun and let it fall on your hand it feels nice, but if you take a magnifying glass and focus that same amount of light on to a single point it causes the damage. Its the same light, nothing changed it is just focused. Like a DDoS, its the same packets, in fact it could be legitimate requests, but a large mass botnet focused on a single server/website with many many more requests than it was designed to handle causes the problem. – Scott Chamberlain Oct 5 '13 at 3:02
  • 1
    my metaphor for networking always focuses on water in a pipe. if your town is flooded, your storm sewer system is flooded as well, so because the pipes are full, water from the street can't move into and through the system at an optimal rate. – Frank Thomas Oct 5 '13 at 4:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.