Raw rate limit how? Cloudflare already at it's peak. Host needs to rate limit. I just actually requested if they could setup a rate limit through PATH.
Hopefully you've resolved the attack or it has subsided now.
I was hoping you could perhaps rate limit the connections coming through from cloudflare to your own servers so that they are dealing with a level of traffic that is more appropriate (ie x requests per second). Their documentation can be found at
https://developers.cloudflare.com/waf/rate-limiting-rules/ although looking at it now unless you are on their top tiers of support you seem to be restricted to rate limits by IP address. Which is going to be of rather limited use in a DDOS that is using a vast number of source addresses. So apologies that may well not have been much use as a suggestion. Although it's been some years since I properly used any other webserver I imagine most have some rate limiting options like
Nginx does. Assuming the attack is all at the application layer (which I guess it would be if coming via Cloudflare) some rate limiting there might help, although unless there is an element you can build a common key on you're again stuck if each request is a fresh one.
Would kill all guest traffic
That was the idea!
Generally if your servers are under extreme load it can be hard to actually do log analytics and so forth - so gaining control has always been my first goto, once you have some control back you can ease up on the restrictions. A really good DDOS would be totally indistinguishable from legitimate guest traffic so blocking that might be all you could do until they got bored or ran out of money.
Already did so much. Every other attack I would have mitigated by now but this one I am at a lost.
Was Cloudflare's "under attack" of no use then, or was the attack large enough that it made little difference? I guess there are probably ways those launching the attacks
bypass the interstitial page now. I'm certainly fascinated since Cloudflare is often sold as the solution for these kind of issues, but we've had a few recent threads where attacks have not been mitigated by it. Granted of course traffic offloading via caching and so forth is of value in addition to attack mitigation.
Did you (or Todo10) manage to get this one under control successfully? I'd be interested if you're able to share any learning since really distributed attacks are everyone's nightmare. FWIW in my idle searching this morning I did stumble on this (not new and quite basic)
guide for DOS mitigation using Cloudflare, reading it now...
