DDOS attack

[Rueby]

I've heard that DDoS attacks can be costly for the attacker as well, so it's not really sustainable for a long period I think. I think also the longer the attack goes the more Intrusion Protection Systems (IPS) start to kick in...I found it very interesting but I plan to research it further because my brain isn't wrinkly enough for this.

So I wonder if it's more of a 'weather it out' kinda thing until the body guard kicks in.

My smooth brain translated DDoS to this following analogy

Imagine you're at a restaurant, making an order....suddenly an influx of hundreds of customers come in, they start to occupy the space and begin to engage with the staff be it by complaining or placing an absurd amount of orders. The staff is overwhelmed by this chaotic situation and you (the legit user) is not getting proper service. The manager (network admin) then calls the police (IPS) starts to restore order (mitigate the attack) by dealing with these troublemakers (malicious traffic)

I guess an upside of all this is a stress test for SE to hopefully prepare for DT. Here's to hoping for a smooth release...

[UkcsAlias]

I've heard that DDoS attacks can be costly for the attacker as well, so it's not really sustainable for a long period I think. I think also the longer the attack goes the more Intrusion Protection Systems (IPS) start to kick in...I found it very interesting but I plan to research it further because my brain isn't wrinkly enough for this.

For ddos attacks the prices differ massively, and prices arent linear. The heavier the attack, the faster the price goes up. And especialy when they become very heavy, its exponential. The price betweeen the strongest attack and one at half of that is a diffirence of like 500x here. Maintaining large botnets is very expensive.

This is why IPS systems are problematic for ddos attacks long term. Initialy the ddos is cheaper than the defense, but once they scale up, pricing here is quite linear. As long as you can buy a server, you already require a ddos to be significantly stronger to compensate.

Also, if its detected which sources are known to be part, they can be blocked well ahead of the target. It only needs to pass through 1 of the datacenters that are part of a global system to avoid big ddos attacks, and suddenly your attack becomes crippled. And yes, large datacenters do these things because they otherwise would also risk hardware damage when a target is near one of their DCs.