Lessons · Cybersecurity · denial of service, seen from inside
Denial of service, seen from inside
A denial of service is a flood of traffic or requests that uses up a system's capacity so real users cannot get in; it breaks availability and nothing else.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
Launch morning, the site is timing out, and the first guess is that you are being attacked. Sometimes it is a flood and sometimes it is the marketing email that went to a million people at once. From inside they look alike, and reading the numbers is how you tell them apart.
How to think about it
Look at the shape: how many requests, from how many sources, asking for what. A flood from many sources for one page nobody normally asks for is an attack. A rise from your own customers on the pages you advertised is success.
Worked example
Baseline: 200 requests per second, spread across the siteWritten down before the bad day, or there is nothing to compare with.
Today: 9,000 requests per second, all for one search URL9,000 / 200 = 45 times the normal load, on one page.
Inside: processor at 100 per cent, connections at the limitWhat availability failing looks like on the dashboard.
Response: filter the pattern upstream, then add capacity, then tell the businessDrop the flood before it reaches you; capacity second; people third.
Your turn
A flood of requests takes the website offline. Write which of the three words it broke.
broken:
Solve one, graded on the server
The trap
Restarting the server. The flood is still arriving, so it comes back up and falls over again. The fix is upstream, where the traffic can be dropped before it costs you anything.