Second large Hetzner outage in a week caused by DDoS attack(status.hetzner.com) |
Second large Hetzner outage in a week caused by DDoS attack(status.hetzner.com) |
Cloudflare write in a recent attack:
The top networks included the German provider Hetzner Online GmbH (Autonomous System Number 24940), Azteca Comunicaciones Colombia (ASN 262186), OVH in France (ASN 16276), as well as other cloud providers.
A wise network operator once told me - never shit on people when they are under attack. Because in the not too distant future you are going to be the victim.
I assume this attack is UDP based unlike the one you linked too.
They aren't even in the top 10 here. Its the claim hetzner is larger than AWS? I find that highly unlikely.
Likely the attack isn't an overwhelming volumetric attack as I assume they have some fat pipes and big routers, but there's likely a bottleneck somewhere in their network.
- You need to identify the traffic to be filtered and the post states: "Due to always different destinations (IPs, ports, packet size) (..)"
- You need to maintain some agreement with a large number of ISPs
- You need to maintain some gossiping infrastructure to these ISPs
- ISPs may not care about your DDoS attack
As a participant you can avoid paying to send outbound attack traffic, and also identify attack sources within your own network.
Does anybody know what usually runs on those ports?
Hetzner is a popular host for game servers.
seriously, aren't they commonly the SOURCE of many DoS attacks...
any hosting provider where some random person on the internet and $5 of credit on a prepaid visa card will have this problem.
It is, because of the way that UDP is typically used for different applications than TCP. While there are a few old, well known TCP/UDP pairs like 53, UDP is more often used with a dynamic port assignment scheme sometimes with a coordinating TCP protocol - such as SIP/RTP for VoIP that uses >16k, WebRTC, etc. A lot of games uses ports above 10k. https://help.generationesports.com/hc/en-us/articles/3600611...
The NaWas infrastructure is designed as an on-demand service. After detecting an attack, the traffic is routed via BGP to the NaWas hardware and then the mitigation process starts. All traffic is then rerouted and the own connections can thus manage with less capacity and thus remain cheaper.
To connect to the NaWas, a port must be available from one of the following parties: AMS-IX, NL-IX, LINX, NET-IX, Top-IX, M-IX, V-IX or one of these cloud interconnects DCSPine, Epsilon, Megaport.
Most such games will either layer their own streaming channel atop UDP for guaranteed ordered delivery of important messages or use a separate TCP socket as well.
WoW, FFXIV, ESO, GW2, etc
Some might use TCP for login and character select, but its UDP while playing.