Lessons From Defending The Indefensible
summary
Cloudflare defensive checklist with numbers and actual results: use BPF bytecode in iptables to drop payload-matching UDP/DNS floods (reduces false positives), expect ~2M pps in-kernel filtering and ~3M pps on a single core with partial kernel bypass (netmap/DPDK-style offload); NICs do ~10M pps, only ~1 in 10,000 packets is legitimate, fleet-wide drops hit ~75M pps. Beware: larger listen backlog hurts, Linux sends ~200–300k SYN cookies/s unless patched, and conntrack must be tuned or it creates state explosions.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 0:49Service Attacks
- 1:21Denial of Service
- 2:08Infrastructure
- 4:00Network
- 4:16Routing
- 5:45From Now On
- 6:30DNS Flood
- 6:45DNS Server
- 7:00Denial of Service Tools
- 7:23Dropping Packets
- 7:53Identifying Invalid Packets
- 8:57BPF
- 12:17Network Cards
- 12:45Colonel Bypass
- 13:17Partial Credit Card No Bypass
- 13:52No Bypass
- 14:55Performance
- 15:39Packet floods
- 16:01Up flags
- 16:17Stateful firewall
- 16:54Syn floods
- 17:13Syn contracts
- 19:26Real botnets
- 20:03Overload and application
- 21:33HTTP Keeper Lives
- 22:04botnets
- 23:08detective
- 23:25mitigation
- 24:00TCP Dump
- 24:47Conclusion
related talks
40mThe new reality of DDOS
28mA World-View of IP Spoofing in L4 Volumetric DoS Attacks - and a Call to Enable BCP38
41mAre DDoS attacks a threat to the decentralised internet?
36mThe black art of network performances
52mInvestigating DDOS - Architecture Actors and Attribution
44meBPF as an Active Security Enforcement Layer Stop DNS Data Breaches : Beyond Passive Observability
37mCrush Cred Stuffing: A Method for Neutralizing Credential Stuffing Attacks
45mAnatomy of a DDoS