bk99.de entertain the web since 1997

bk99.de
Own note · DDoSOwn post

A DDoS with almost 100 Mbit/s of incoming traffic

Summary

During a DDoS attack, live monitoring of eth0 showed 93.72 Mbit/s of incoming traffic at 21,246 packets per second, while almost nothing went out. vnStat was watching the network interface in live mode. Outgoing traffic was only 44 kbit/s at 19 packets per second.

Ideas

  • Highly asymmetric traffic can make an ongoing flooding attack visible.
  • Packets per second add the load on the network stack to the raw bandwidth.
  • A live view gives a quick overview but does not replace a permanent record.
  • Data from the provider helps to judge the attack type and bottlenecks outside the server.

Insights

  • An attack can exhaust resources before the nominal line bandwidth is fully used.
  • Bandwidth and packet rate describe different costs of a DDoS attack.
  • Without historical baselines, the scale of unusual traffic is hard to judge.

Facts

  • The measurement was taken on 13 September 2016.

Recommendations

  • During an attack, record bandwidth, packet rate, protocols and destination ports.
  • Keep measurements for later analysis and for talking to your provider.
  • Plan filtering and DDoS protection in front of the bottleneck of your own uplink.

References

View the original post

KrebsOnSecurity · 2025

6.3 Tbit/s: What came after Mirai

Brian Krebs examines a short 6.3 Tbit/s attack and links it to Aisuru, compromised IoT devices and a publicly rented DDoS service. The attack reached more than 6.3 Tbit/s. Google measured around 585 million packets per second.

KrebsOnSecurity · 2016

620 Gbit/s: Mirai announces a new class of DDoS

Brian Krebs documents a DDoS attack that was exceptional at the time and whose direct traffic floods pointed to a large botnet of compromised IoT devices. The attack began on the evening of 20 September 2016. After analysis, Akamai put the peak load at around 620 Gbit/s.

Hostblogger · 2007

DDoS against a public DNS blacklist

Manuel Schmitt reports on a DDoS attack on ix.dnsbl.manitu.net and then considers a list of permitted query networks. ix.dnsbl.manitu.net was hit by a DDoS attack in June 2007. Bert Ungerer and Manuel discussed operating on a whitelist basis.