Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Most attacks are trivial to detect, you don't need AI. It's just hard to get useful work done when all your incoming interfaces are overloaded with easily detectable abuse.


The "best" way would be to have application logic to detect non-legitimate requests, and make an API call out of band to upstream networking gear to insert a null route for that IP (so as to drop the traffic at the edge before any real "work" takes place on it).

In a previous life, I ran physical datacenters, and while the gear wasn't terribly powerful then (we're still worried about running out of memory on core routers, hence why IP blocks don't get sliced up and piecemealed out with the exhaustion of IPv4 space), I'd expect newer hardware to be able to keep up.

The network can remain irrational longer than you can stay online.


Problem is, beyond a certain volume, even the upstream gear is gonna get saturated just reading the header on the bogus packets and directing them into the bit bucket. It's not unheard of for the larger attacks to take down entire ISPs.


Unless you keep propagating "upstream" and the message gets to the "source" ISP, and they block the actual misbehaving user/account. For all we know, they can kick them off the network after sufficient transgression, and ban their account at the hardware ADSL level (assuming that's what it is). This also presumes the ISP is willing to implement such a feature, and kick-off their paying (albeit infected) users.

I don't know much about this stuff, so I'm extrapolating and pseudo-solving.


Usually there's a lot of diversity in the immediate source of the traffic. If it's a volumetric attack, the immediate source is the misconfigured servers that spoofed packets are being sent to. If it's an in band attack, the immediate source is usually botnet members, but occasionally regular browsers being served bad scripts by a compromised or mitmed site.

You could work to notify the network owners, but it's whack-a-mole; even with strong efforts there are enough DNS and ntp servers out there configured to generate a pretty big reflection.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: