I just bumped into this thread and the more I read the more my jaw dropped. And finally I went like … WTF … these dudes are clueless on what DDos means.
ELI from bluehatseo.com seems to have pissed someone off and got a DDos hit smack in the face. And, while the admirers are drooling all over the place, he tells them he redirected the attack to WhiteHouse.gov (so the FBI'n'shit will track it down) … with a .htaccess redirect! OMFG.
WTF are they talking about? Let's rewind!
To understand the below we need to know what a DDos Attack actually is and what the 1st D actually stands for: Distributed Denial Of Service. In Scraping At The Speed Of Light I mentioned that a connection has several states before it actually gets established. It's the 3-way handshake that eventually leads to the success or failure of the connection attempt:
A DDos attack involves a large number of hosts (zombies - usually remote controlled innocent users) creating a lot of half-open connections. These connections are stopped at Step#2. So you never send the last ACK back to server which will make the server wait for you for a short while. This is where the magic happens! By creating a lot of half-open connections you can lock down the server and disable its capacity to accept new clients by keeping busy all the client slots available on the server!
It's all a game of numbers. The more zombies you have to attack the more damage you will do and the more you will keep the host offline.
If you were in an apartment building and wanted to visit someone you would knock on the door, be asked who you are and then the door would either stay closed or open. This is exactly how it works for connections. But what if you started to knock on every door of the apartment building, said who you are, got the door opened but you would never go in. This is how half-open connections work. They knock on every door, are asked in but never enter. The door stays open for a while so noone else can knock during that time:)
Version#2 works differently and is a bit more resource intensive for the attacker too! You no longer play with half-open connections but you actually establish them. So you open a lot of requests and keep them hanging as much as you can … by not sending HTTP GET requests for example (but DDos can attack any open PORT / IP). Simple!
HTTP is very susceptible to this second method of attack as the server waits for you to say the first thing. And you can hang it for a decent period of time!
There are! Like massive pinging with large packets. I've done this once and it was actually fun. Kept a dialup provider down half-a-day with only 50 zombies. There are others but this is enough for now.
A .htaccess redirect needs a client to be connected to the server to send it a 301 or 302 HTTP code to reroute it. You can't redirect internally in .htaccess (without 301/302) as the client will no longer be the one asking for the page but your server who reroutes will appear as asking for webpage.
Either way you look at this you can't fight a DDos with a .htaccess redirect as a real DDos does not need the connection to be established or have anything to do with the HTTP protocol.
In case you get a Method#2 DDos attack a .htaccess redirect will never work! Because following the 301/302 redirect is a voluntary action in HTTP protocol. So you send the redirect and new address but … will the zombies follow it? I don't think so!
I've noticed 1 or 2 members on the thread seem to be aware of what a DDos attack actually is. Everyone else was starstruck that ELI redirected all his traffic to WhiteHouse.gov … for what? To reroute real traffic?:)
Not really. It's all done hardware and you will only drop the connection attempts if they exceed a limit per second / per IP sometimes. This is it. Or you can go offline! Some say a DNS change to point your domain name elsewhere will help but those who do DDos as it's supposed to use IP addresses and not domain names. So … It's not gonna work and it could get you into legal trouble as it will show intention to harm other sites.
When you're DDos attacked you can only hope your hosting company has defence setup and they treat you nicely.
PS: Looking forward to your feedback!
