Running at 99% Surviging an Application DoS
summary
Strikes against application logic and resource pools drive decisions: a small Node.js reverse proxy called bouncer sits in front of Apache, closes blacklisted sockets, adjusts header and read timeouts, and offloads slow attacks so backend servers stay responsive; a demo fires 2,000 slow connections with slow http test and shows Apache idle while the proxy handles load; identification uses Redis, GeoIP and headers; an aggregator on AWS sustains 62,000 requests a second; one real case involved ~100,000 hosts at three requests per minute.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:50$denial of service
- 2:37$application Dos
- 6:35$slow read
- 11:57$strategies
- 13:12$identification
- 16:45$a real example
- 19:07$seriously why node.js?
- 21:12$architecture
- 22:00$message format
- 27:21$aggregator.js (does)
- 28:07$consumers
- 29:43$consumer commands
- 30:41$example commands
- 36:43$example consumer 3
- 38:54$performance testing
- 39:36$other uses
- 41:04$the future, Conan?
related talks
45m56k Denial of Service
01h 04mServer-Side Browsing Considered Harmful
52mKnock Knock: Understanding Who is Using Your Web Applications
42mThe Node.js Highway: Attacks Are At Full Throttle
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection
12mWhat hit my webservice with 408?!
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
52mInvestigating DDOS - Architecture Actors and Attribution