Slashdot Mirror
Akamai: How They Fought Recent DDoS Attacks
yootje writes "Infoworld is running an interesting article about Akamai and the DDoS attack that hit the network of Akamai Tuesday. According to this article one of the defenses of Akamai is the big diversity of their hardware: 'We deliberately use different operating systems, different name server implementations, different kinds of routers, different kinds of switches, different kinds of CPUs, and especially, different operational procedures.' So says Paul Vixie, architect of BIND and president of the ITC." Yootje points to another article on this subject as well, this one at Internetnews.com. Update: 07/07 19:38 GMT by T : Note that Vixie's quote here is actually presented out of context; he was commenting by way of contrast on the diversity of the root DNS servers, not Akamai's content-serving system.
The diversity of hardware and software may be an IT nightmare but I think this shows how effective it really is. Now all we need is a concise cost/benefit analysis.
nobody knows what they run, so nobody can make a decent attack ..
I have to wonder if the diversity of systems was an intentional choice of theirs way back to face these kinds of attacks or if it just grew that way from rapid growth and having their systems spread all over.
They survived the attack and "Oh yea, we MEANT for it to happen that way".
I think it's spin.
The quote on diversity is by Vixie wrt the roots servers--it's a criticism of Akamai! Jesus H. Christ, it's in the first paragraph!
Media that can be recorded and distributed can be recorded and distributed.
-kfg
This article has nothing to do with Akamai, other than pointing out that Akamai DNS is vulnerable to DOS.
Most of this "article" is a puff-piece (or paid advert) for one "CloudShield Technologies," pimping their (vaporware) "server for applications that do deep packet processing at gigabit-per-second rates."
-Isaac
I am not a lawyer, and this is not legal advice. For Entertainment Purposes Only.
I know you were trying to be sarcastic, but I bet that they indeed do prefer things this way.
When the pager goes off at 3AM that there's a suspected new worm attacking your dos-based systems, it's nice to simply turn them off and let the other systems handle the load until morning when you can investigate the problem at your leisure.
Actually, according to the article the diversity approach is part of what's used to defend the DNS root servers, not Akamai. Vixie specifically mentions that this approach is not practical for an ordinary content provider like Akamai because, 'the cost would "drive their accountants crazy."' I'm dubious about just how helpful diversity would be against a DDoS attack in the first place. Diversity won't solve the problem of requests coming in faster than they can be processed.
There's no point in questioning authority if you aren't going to listen to the answers.
Having your sysadmins LEARNING how to use new architectures, procedures and so on costs money - because their time is on salary, you pay for that learning process, their lack of knowledge in the beginning adding time to solving problems, and bringing in help costs more because you'd prefer they'd have that broad experience already.
Remember.. [insert product here] is free if your time is worthless.
Neko
A valid tactic... it mitigates the problems with a unified vendor, but it costs lots more...
I wish the net was headed in the right direction, but it's not. No single site or company will ever "win". The resilience of the web lies in it's redundancy and distribution. What I see is continued centralization and creation of points of failure. As "Broadband" internet access is more monopolized and treated as a platform for mindless browsing, and smaller ISPs are destroyed, the net is being squeezed into fewer and fewer hands. This invites attacks that can not be protected against. The real solution is to let everyone run everthing they want. That's the only way to route around damage.
Friends don't help friends install M$ junk.
...is like trying to wipe out swarm of gnats with a shotgun.
dinner: it's what's for beer
If you have not realized that every place is a classroom, then, my friend, you have not learned a single thing.
"I'm just here to regulate funkiness."
Actually, at 3AM they're probably still awake, trying to figure out how to get all these different systems to behave exactly the same under normal operating conditions.
Life in Orange County
What the heck are those? Are they like bad karma points for articles that have overlapping information with other articles?
By the way, which one of the articles is it that says Akamai did anything right to fight attacks?
Just because you can, does not mean you should.
'It's about CloudShield Technologies ... recently announced CS-2000', and nothing but a fluff peice meant to sell some hardware. Sure, Akami's DDOS is discussed ("DDOSs are ba-ad, mmkay."), but then it just goes on to talk about the CS-2000.
RandomAndInteresting.comdefending the world from stupidity since 1979
not only did the submitter not rtfa
the editors did not rtfa
and after the first five posts pointing this out, it was obvious that nobody was reading the responses either.
nobody was reading anything, and now we have a 1000 responses saying the same thing, it wasn't akamai, it was the root servers, blah blah blah.
different operating systesm ... Wow, your sys admins and help desk must LOVE supporting that!
I know you were trying to be sarcastic, but I bet that they indeed do prefer things this way.
When the pager goes off at 3AM that there's a suspected new worm attacking your dos-based systems, it's nice to simply turn them off and let the other systems handle the load until morning when you can investigate the problem at your leisure.
Actually, they love it because when the pager goes off at 3AM, they know the backups are able to take over so they can work on what is causing the problem, and have everything back up and running by 8:00am when the boss walks through the door. Otherwise they end up scrambling at 3:00am to get something, _anything_, up and running so your critical services can be restored BEFOR working on the problem at hand.
Can I ask an obvious question here?
.NET application servers running on Windows 2000. As an app environment .NET is stable and actually quite fast, and run on much less expensive equipment. However there are only four of them and failover between boxes is sketchy, so on the rare occasion that there is a non-code related outage, it takes longer to get the environment back up to spec.
Who the atech-ee-double-hockey-sticks runs "dos-based" systems anymore? I thought Microsoft abandoned the technology starting in 1995, and I personally submitted the "official end of life for DOS support" article to Slashdot several years ago.
We run heterogenious systems and support them because they provide different benefits and features for our many needs. Sometimes Windows OS servers actually are cheaper, more stable, and easier to support than their Unix counterparts. Sometimes not.
For instance, we have WebSphere running on Solaris and AIX as an app server platform, and it is great for high volume and failover. But we spend far more time (proportionally) troubleshooting that technology (and the hundred or so servers that run it) than the
Just my anecdotal experience.
Dude, calm down. I'm sorry, I admit I wanted to have it fast on Slashdot, but not for my ego, but I like it to have it on Slashdot quick. You are talking to real persons, it was a mistake. Come on, it's not like your life depends on Slashdot.
My photo's.
Also please make sure it's not a paid ad for some ByMeNow-5000 product rather than an actual article.
Paul should shut up about this topic. Companies should not go commenting about attacks made against their competitors - period.
His statement about the root servers is way off base. Only four of the 13 servers stayed up and the software running on them did not affect the outcome in any way. Most of the servers that went down were running a version of BIND as were two of the servers that stayed up. The other two roots were running ATLAS which is the ultimate in closed source proprietary systems, nobody outside VeriSign has seen the executable, let alone the source code.
I don't see how anyone could draw any conclusions either way on the basis of this sample. The distinguishing feature was the bandwidth available to the systems, not the software they run.
Paul should think more and speak to journalists less.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/