DDoS Protection

// Category 1: Volumetric — flood the pipe
// UDP Flood: send millions of UDP packets to random ports
//   target receives → checks no listener → sends ICMP "port unreachable"
//   → exhausts outbound bandwidth replying to spoofed sources
// DNS Amplification: send small DNS query with spoofed source IP
//   open resolver replies with 50× larger response to victim
//   amplification factor: ~50x

// Category 2: Protocol — exhaust connection state
// SYN Flood:
//   Attacker sends thousands of TCP SYN packets (spoofed source IPs)
//   Server allocates half-open connection state (SYN_RCVD) and sends SYN-ACK
//   ACK never arrives → connection table fills up → new legitimate SYNs rejected
//   Mitigation: SYN cookies (server encodes state in ISN, no table needed)

// Category 3: Application — mimic legitimate requests
// HTTP Flood: thousands of bots send valid GET /search?q=... requests
//   Server must execute DB queries, render pages
//   Hard to distinguish from legitimate traffic — requires rate limiting + fingerprinting
// Slowloris: open many connections, send headers very slowly
//   Keeps server connections open → pool exhaustion

// Normal TCP: server stores half-open state
// SYN received → allocate connection in SYN_RCVD table → SYN-ACK
// (table fills up under SYN flood)

// SYN Cookies: no state stored on SYN
// SYN received from client (src=1.2.3.4:54321, dst=10.0.0.5:443)
// Server computes:
//   cookie = HMAC(secret_key, src_ip, src_port, dst_ip, dst_port, timestamp)
//   ISN = encode(cookie, MSS, timestamp) in 32 bits
// Server sends SYN-ACK with ISN = cookie (no state stored)
//
// If attacker (spoofed): ACK never arrives → no cost to server
//
// If legitimate client: sends ACK with ack_number = cookie + 1
//   Server recomputes cookie from packet fields → matches → create connection
//   Recover MSS from encoded bits → allocate socket

// Linux:
sysctl -w net.ipv4.tcp_syncookies=1
// Nginx: listen 443 ssl backlog=65535;

// Anycast routing:
// Your IP block (e.g. 203.0.113.0/24) is announced via BGP from 200+ PoPs worldwide
// Attacker's traffic naturally routes to the nearest PoP (BGP shortest path)
// Each PoP can absorb 10–100 Gbps → total capacity: Tbps-scale
//
// Scrubbing pipeline (simplified):
// 1. Volumetric: rate-limit by src ASN, drop known bad IP ranges (BGP Blackhole)
// 2. Protocol:   SYN proxy — PoP terminates TCP, forwards only established conns
// 3. Application: WAF rules, CAPTCHA challenge, JS challenge for browsers
//
// AWS Shield tiers:
// Standard — always-on, free, protects against most volumetric attacks
// Advanced — $3,000/month, SRT (Shield Response Team), Layer 7 protection,
//             cost protection (absorbs AWS data transfer charges during attack)

// Cloudflare Under Attack Mode — JS challenge on every request:
// Forces browser to execute CPU-intensive JS proof-of-work
// Bots without JS engine fail; real browsers pass

// Nginx rate limiting (token bucket):
http {
  limit_req_zone $binary_remote_addr zone=api:10m rate=100r/m;

  server {
    location /api/ {
      limit_req zone=api burst=20 nodelay;
      limit_req_status 429;
    }
  }
}

// Spring Boot rate limiting (Resilience4j):
@Bean
public RateLimiter rateLimiter() {
  return RateLimiter.of("api", RateLimiterConfig.custom()
      .limitRefreshPeriod(Duration.ofSeconds(1))
      .limitForPeriod(100)            // 100 req/sec
      .timeoutDuration(Duration.ofMillis(500))
      .build());
}

// Connection limits to prevent Slowloris:
// Nginx:
worker_connections 10000;
keepalive_timeout 30s;          // close idle connections quickly
client_header_timeout 10s;      // timeout if headers arrive too slowly
client_body_timeout 10s;