Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 4 down vote favorite
1

I have a person asking me whether the DDoS Mitigation Service they're using is worth it. This is out of my expertise, but clearly at some point someone sold this service to the client.

Assuming I don't have anything but a domain name, what information can I gather about whether they are indeed under attack and/or how well the DDoS Mitigation Service is working?

Assume I don't have any administrative access to the site/server(s) in question.

share|improve this question

2 Answers

up vote 2 down vote

You should ask your client have they ever experienced down time in the past which their provider could not explain? And if their provider said a server was DDoSed, where they the intended target or was another server or router attacked which affected them indirectly?

I think people are overly worried about getting DDoS with all the hacking incidents in the news. It's rare for most companies to be randomly targeted. If they are a big corporation who have reason to believe they will be targeted, they should discuss that with their hosting provider first before relying on some third party application which i'm sure they are paying for that may not be very helpful in the event of a massive DDoS.

If they've never had any down time they shouldn't need to pay extra. There are plenty of applications for windows and linux to monitor for port scans, DDoS, tutorials on setting up good IPTables/IPChains rules to limit types of packets to ports etc.

IMHO the mitigation service is just playing on companies fears of a future DDoS attack.

share|improve this answer
This jibes with my own thoughts, but I'm ignorant enough of the space that I'm not sure what I don't know about the topic. Thanks. – artlung Mar 8 '12 at 8:07
up vote 1 down vote

Download the LOIC tool, grab some friends and mount and attack, see what gives and what doesn't!

share|improve this answer
3  
That approach is not advisable without first obtaining permission from all parties involved - and you have to keep in mind that your results may reflect DDoS mitigation tools and network policies applied at every hop. The only conclusive tests require access to the target server(s) and network(s) (or, at the very least, their logs). – danlefree♦ Mar 8 '12 at 2:31
@danlefree Thanks, yes, it looks like indeed, there's not much one can do unless one has actual access to analytical tools on the box(es) of the site itself. – artlung Mar 8 '12 at 8:06
@danlefree makes a good point, it does depend on your budget, there are plenty of commercially available stress testing tools and security analysis services out there. – toomanyairmiles Mar 8 '12 at 9:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.