Flowtrackd: DDoS Protection with Unidirectional TCP Flow Tracking

https://blog.cloudflare.com/announcing-flowtrackd/

by jgrahamc • 6 years ago

33 21 6 years ago

blog.cloudflare.com

gruez3• 6 years ago

This seems like a marketing piece light on technical details. For instance

flowtrackd is then able to determine if a packet is part of a new connection, an open one, a connection that is closing, one that is closed, or if it’s an out of state packet.

How?

xmichael0• 6 years ago

That is common with Cloudflare... Never understood why so many tech. praise them when clearly many of their claims are false. You would think that 99% of the internet was under a ddos attack 99% of the time.

jgrahamc• 6 years ago

Never understood why so many tech. praise them when clearly many of their claims are false.

Which of our claims are false according to you?

sroussey• 6 years ago

Almost everything I’ve ever worked on has been under ddos attack. I actually met the founders of Cloudflare just after they got started because they saved my bacon.

Later pursuits used different providers where we could use BGP to shift our network around.

kevin_thibedeau• 6 years ago

sequence numbers

gruez3• 6 years ago

But in the article they mention that they don't see the server's response. What's preventing you from spamming ACKs with sequential sequence numbers?

njsubedi2• 6 years ago

More and more of the internet is now moving behind Cloudflare, one feature at a time. I saved some serious amount of money by just by using free service they offer. I am astonished every time Cloudflare comes up with a solution for the problems of the internet.

cremp• 6 years ago

More and more of the internet is now moving behind Cloudflare

This is a big double-standard here on HN. Everyone hates Google for making decisions on behalf of the internet as a whole; yet Cloudflare has done the exact same thing with a different OSI layer.

I'm not very trusting of Google, but I certainly dont trust Cloudflare any more-so, because they keep things much closer to the chest.

infogulch• 6 years ago

double-standard

Meanwhile upthread...

Cloudflare essentially centralizing the Internet is disturbing to me.

Maybe different people have different standards, and HN isn't a completely homogeneous group with a single viewpoint. Just like every other group where individuals are free to express themselves.

njsubedi2• 6 years ago

I think we can trust them for now. They seem like good people and company. I don't know what's at stake in the future, but Mozilla has trusted their service, so there's bo good reason not to.

invokestatic2• 6 years ago

Cloudflare essentially centralizing the Internet is disturbing to me. They have the capability to MITM huge swathes of internet traffic, and coupled with the fact they’re a US company, I’m pretty wary of them receiving some sort of order from the NSA.

Every time I’ve used Cloudflare, it’s been on a dedicated, cookieless subdomain serving static content only. Call me paranoid, but this company may be doing serious damage to our privacy online.

londons_explore• 6 years ago

If you're going to go to those lengths, you need to not have that domain, or any other domain, host any scripts for your site or service...

Thats pretty difficult with nearly all web service companies saying 'just put our script in <head>'

invokestatic2• 6 years ago

That's where SRI comes into play. And even if SRI isn't used, having a separate subdomain still makes it impossible to surreptitiously MITM host traffic, since attacking the site via scripts served by CDN would leave behind evidence.

stiray• 6 years ago

It is the same thing as google, amazon or microsoft - they are all centralizing the internet.

I have written a mitming proxy that is capable of blocking by ASN (https://en.wikipedia.org/wiki/Autonomous_system_(Internet)), beside blocking domains and other things we are used from the times of proxomitron. I have once tryed to block all 3 companies to see what will happen.

Nothing worked any more. From CDNs breaking pages of those rare occurances where they werent hosted on some cloud owned by those 3 companies. Even duckduckgo wasnt accessible anymore.

The funny thing was that yandex and baidu were still working flawlessly.

Welcome to dark ages of internet, we blew it. Instead of beeing capable of surviving third world war (as it was designed for) it is now in hands of 3 companies out of pure lazyness, lack of knowlidge and greed.

(I will release the proxy in next 2-3 months)

fivre• 6 years ago

Is this stuff news to people? Having worked in that segment of industry, yes, that is how things largely work now, and that's largely how they've always worked, even if perhaps there's a bit more consolidation now (market factors do that somewhat automatically, if not always in the same direction).

This may be my relative youth, but I don't really recall people complaining that Akamai or--well, I don't know as good an analog to the modern major cloud providers, but maybe, say, Equinix or Rackspace--handled so much of the internet back in the day.

Cloudflare may have more of a consumer brand presence because they intentionally market that with their free plan, branded error pages (the "Intel Inside" of CDN services), and ancillary services (1.1.1.1 and their phone VPN), but it's not like the internet of yore was some decentralized collaboration of freeholder fiber owners running their little own 1-person ISP cum hosting provider. Maybe in the early, early, more academic and hobbyist days, but I don't think it's surprising that those were more of an anomalous landscape after the internet's birth than the norm.

coolspot• 6 years ago

Sounds like great project for some specific scenarios, like malware analysis and application sandboxing.

Flowtrackd: DDoS Protection with Unidirectional TCP Flow Tracking

Related Stories