Skip to content

[DDoS Protection] Various updates #17865

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Oct 30, 2024
Merged

[DDoS Protection] Various updates #17865

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
42d2b8c
botnet threat feed offense
patriciasantaana Oct 29, 2024
746915a
recommendations for ddos tests
patriciasantaana Oct 29, 2024
436c68c
edit
patriciasantaana Oct 29, 2024
06c34af
remove ddos billing note
patriciasantaana Oct 29, 2024
b8ca216
space
patriciasantaana Oct 30, 2024
a11228a
Update src/content/docs/ddos-protection/botnet-threat-feed.mdx
patriciasantaana Oct 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions src/content/docs/ddos-protection/about/how-ddos-protection-works.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,11 +33,6 @@ Once attack traffic matches a rule, Cloudflare's systems will track that traffic
| Log | Records matching requests in the Cloudflare Logs. |
| Use rule defaults | Uses the default action that is pre-defined for each rule. |

:::note

DDoS attack traffic is automatically excluded from billing systems.
:::

## Time to mitigate

- Immediate mitigation for Advanced TCP and DNS Protection systems.
Expand Down
6 changes: 4 additions & 2 deletions src/content/docs/ddos-protection/botnet-threat-feed.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,11 @@ head:

The Cloudflare DDoS Botnet Threat Feed is a threat intelligence feed for service providers (SPs) such as hosting providers and Internet service providers (ISPs) that provides information about their own IP addresses that have participated in HTTP DDoS attacks as observed from Cloudflare's global network. The feed aims to help service providers stop the abuse and reduce DDoS attacks originating from within their networks.

Each service provider can only get information about IP addresses associated with their autonomous system numbers (ASNs). The affiliation of a service provider with their ASNs will be checked against [PeeringDB](https://www.peeringdb.com/), a reliable and globally recognized interconnection database.
Each offense is a mitigated HTTP request from the specific IP address. For example, if an IP has 3,000 offenses, it means that Cloudflare has mitigated 3,000 HTTP requests from that IP.

To ensure the feed’s accuracy, Cloudflare will only include in the feed IP addresses that have participated in multiple HTTP DDoS attacks and have triggered high-confidence rules.
A service provider can only get information about IP addresses associated with their autonomous system numbers (ASNs). The affiliation of a service provider with their ASNs will be checked against [PeeringDB](https://www.peeringdb.com/), a reliable and globally recognized interconnection database.

To ensure the feed's accuracy, Cloudflare will only include in the feed IP addresses that have participated in multiple HTTP DDoS attacks and have triggered high-confidence rules.

## Context

Expand Down
2 changes: 2 additions & 0 deletions src/content/docs/ddos-protection/reference/simulate-ddos-attack.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,6 @@ You can only launch DDoS attacks against your own Internet properties — your z

You do not have to obtain permission from Cloudflare to launch a DDoS attack simulation against your own Internet properties. However, before launching the simulated attack, you must [open a Support ticket](/support/contacting-cloudflare-support/) and provide the information below. All fields are mandatory.

It is recommended that you choose the right service and enable the correct features to test against the corresponding DDoS attacks. For example, if you want to test Cloudflare against an HTTP DDoS attack and you are only using Magic Transit, the test is going to fail because you need to onboard your HTTP application to Cloudflare's reverse proxy service to test our HTTP DDoS Protection.

<Render file="support-ticket-information" product="fundamentals" params={{ one: "Attack" }} />
Loading