I have a person asking me whether the DDoS Mitigation Service they're using is worth it. This is out of my expertise, but clearly at some point someone sold this service to the client.

Assuming I don't have anything but a domain name, what information can I gather about whether they are indeed under attack and/or how well the DDoS Mitigation Service is working?

Assume I don't have any administrative access to the site/server(s) in question.


You should ask your client have they ever experienced down time in the past which their provider could not explain? And if their provider said a server was DDoSed, where they the intended target or was another server or router attacked which affected them indirectly?

I think people are overly worried about getting DDoS with all the hacking incidents in the news. It's rare for most companies to be randomly targeted. If they are a big corporation who have reason to believe they will be targeted, they should discuss that with their hosting provider first before relying on some third party application which i'm sure they are paying for that may not be very helpful in the event of a massive DDoS.

If they've never had any down time they shouldn't need to pay extra. There are plenty of applications for windows and linux to monitor for port scans, DDoS, tutorials on setting up good IPTables/IPChains rules to limit types of packets to ports etc.

IMHO the mitigation service is just playing on companies fears of a future DDoS attack.

  • This jibes with my own thoughts, but I'm ignorant enough of the space that I'm not sure what I don't know about the topic. Thanks. – artlung Mar 8 '12 at 8:07

Download the LOIC tool, grab some friends and mount and attack, see what gives and what doesn't!

  • 3
    That approach is not advisable without first obtaining permission from all parties involved - and you have to keep in mind that your results may reflect DDoS mitigation tools and network policies applied at every hop. The only conclusive tests require access to the target server(s) and network(s) (or, at the very least, their logs). – danlefree Mar 8 '12 at 2:31
  • @danlefree Thanks, yes, it looks like indeed, there's not much one can do unless one has actual access to analytical tools on the box(es) of the site itself. – artlung Mar 8 '12 at 8:06
  • @danlefree makes a good point, it does depend on your budget, there are plenty of commercially available stress testing tools and security analysis services out there. – toomanyairmiles Mar 8 '12 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.