10

I’m wondering if the maximum speed of a network card would reduce the chances of a DDoS affecting a home-hosted website.

In this scenario, I’m hosting my website from an Android Tablet where the maximum speed incoming/outgoing is 10mbps.

  • 36
    "I’m hosting my website from an Android Tablet" what? – Braiam Dec 30 '14 at 2:50
  • 1
    (In reply to person above) Using a webserver application you can run a webserver with PHP and MySQL on android – TheJamaicanGuy Dec 30 '14 at 2:53
  • 8
    I want to say something sarcastic about using an Android Tablet for a webserver, but a computer is a computer. But the thing is with an Android Tablet you will be limited in what you can do to tweak the system. My answer is about more of a standard server environment. Whatever tweaks one could make there might be doable on the Android Tablet, but only if you have truly deep configuration abilities. – JakeGould Dec 30 '14 at 3:07
  • 11
    I'm having trouble understanding the logic here. If the network connection is slower, doesn't that make it easier for an attacker to saturate it and thus deny service to legitimate users? – cpast Dec 30 '14 at 5:19
  • 2
    @IsmaelMiguel I have an old Celeron around (2.6ghz single-core, 1280mb ram) which still works flawlessly. Would that be better to use compared to the tablet (1.2ghz dual-core, 512mb ram)? – TheJamaicanGuy Dec 30 '14 at 21:24
17

I’m wondering if the maximum speed of a network card would reduce the chances of a DDoS affecting a home-hosted website.

Not really. Perhaps the network bandwidth could be saturated to the point of the network connection being unusable, but a faster network connection would not prevent that from happening. It would only delay the inevitable by seconds/minutes.

The core detrimental impact of a DDoS attack is not really the network connection itself but rather the services behind it. Meaning if you are running a classic L.A.M.P. stack website (Linux, Apache, MySQL & PHP) then a DDoS attack would be most detrimental to those services. And the impact would hinge on the way the site is coded and how those subsystems work.

For example, let’s say your site uses tons of database calls. And you really only tested it on your desktop development environment where you are the sole use. Then the reality is that even a minimal amount of traffic could cause your database server to choke based on the basic engineering of the site. Similarly, if you are using pre-canned CMS systems or frameworks, let’s say someone discovers an exploit to that CMS or framework, then they could just pummel your site based on that exploit and next thing you know… Your site is down.

Basically, I am focusing on the database (MySQL) aspect based on my experience of doing 20+ years worth of web development, engineering and Linux systems administration. And as I move into the world of Ruby-on-Rails and apps that use MongoDB as a datastore I see similar issues. Generally, the database is pretty much the weakest link on a dynamic website and the lack of proper configuration/optimization will bring your site down faster than you can imagine. I once managed a site where the developer made 400+ (!!!) individual MySQL calls for one simple page; and the developer was oblivious to the fact that 400+ calls to MySQL would slow the page down. Details like that matter.

So if DDoS is a concern—but you don’t feel like performance tuning your base web server software install—I would recommend pumping up the RAM on that server and perhaps having faster hard drives installed. Past that, network card speed is a non-factor at best.

  • 5
    While some DDoS attacks do indeed work by depleting the server's resources (RAM, CPU, storage, etc.), a lot of the DDoS attacks we've seen lately focus on oversaturating the victim's bandwidth. Actually, I've noticed that they're pretty much the majority of attacks we have around now, mainly because of the availability of commercial botnets and the recent popularity of magnification-based attacks. – Adi Dec 30 '14 at 4:14
  • @Adnan Fair enough, but even in that case the pipeline would be saturated in a way that the extra perceived speed of the connection only delays the DDoS by seconds/minutes. – JakeGould Dec 30 '14 at 4:25
  • In addition to this great answer, I'd like to point out that if you don't feel like/don't know how to optimize your app, an easy solution is to install a reverse caching proxy like Squid or Varnish in front of the server; it works great for sites that don't change frequently like blogs. – user256743 Dec 30 '14 at 7:34
  • @JakeGould Your answer made me wonder. Suppose someone discover a way to magically identify all DDoS-purpose packets and I create a rule with that method in iptables or any other firewall. If attackers keep nuking me and my firewall keep dropping all the packets, does my connection still get saturated? – mordack550 Dec 30 '14 at 14:19
  • Bitrate refers to the speed at which data flows in and out of a network, often measured in bits per second (bps). During a DDoS attack, the bitrate of the target network is significantly increased, which can cause problems with resource availability – akash ujjwal Dec 30 '14 at 16:16
7

Basically no. There are several DDOS types of attacks, some of which require very little bandwidth. For example, a syn attack in which the attacker sends a syn packet to your site saying "Hey, I want to establish a connection." Your server reserves a small amount of memory and sends a syn-ack reply. The address was spoofed so it goes nowhere. The attacker just rinses and repeats and it requires very little bandwidth on their side. Meanwhile on your server, it keeps allocating memory to establish the bogus sessions that it basically runs your server out of RAM. This is only one type of attack and some servers are resistant, but there are many other types. It isn't the LAN port that gets saturated in these types of attacks, it is your server RAM.

5

In addition to the other answers here, DDoS attacks often don't need to even reach your webserver many types will hit the modem/router of your public IP and overload that interface.

If you had a gigabit internal network from your router/switch to your web server but only a 20mb link connection to your ISP it is the latter which suffers from a DDoS attack.

Even having a good firewall to block those attacks from reaching your web server doesn't prevent the attack because there is so much traffic/noise that legitimate requests get missed/are unable to get responses due to the node before the webserver being overloaded.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.