It also helps avoid distributed denial of service attacks.
Internet Protocol was designed around the idea that anyone should be able to send traffic to anyone, and that that party doesn’t really have control over traffic reaching them until it gets to them, where they can just drop it if they aren’t interested in it. That has some benefits.
However, this meant that if someone could round up enough computers with attached bandwidth, they could send traffic to one computer, and flood its network connection. This degrades its ability to talk to the rest of the Internet.
Some people decided to start going out and—often by compromising computers in one way or another—adding them to a “botnet”, which they could then use to flood servers on the Internet, making various services, mostly websites, slow or inaccessible. This is known as a distributed denial of service attack (DDoS). Some groups decided to try demanding ransoms from various websites.
If you try to flood a host behind CloudFlare, though, all you flood is CloudFlare, which is very large and has a lot of bandwidth and is going to be very difficult to bring down. You can try to reach the host behind CloudFlare via various methods—in fact, I posted something just the other day that specifically dealt with reaching that host, for a latency measurement—but if you’re trying to flood them that way, then CloudFlare is in a good position to detect and block your traffic at their computers. And, I’d expect that CloudFlare will also have a lot of expertise to try to counter very, very large-scale flooding before it even reaches their systems by communicating with major telcos.
I think that what we probably need is potentially for some kind of revision to IP that permits for hosts to have a way to blacklist or whitelist traffic and push those upstream, unless we want to have something like most Internet traffic being routed through CloudFlare or similar to solve the distributed denial of service problem. We…could do that, have the Internet basically be CloudFlare, Inc, but that’s not really what the designers of Internet Protocol intended, and I think that there are some good reasons not to go that route.
It also helps avoid distributed denial of service attacks.
Internet Protocol was designed around the idea that anyone should be able to send traffic to anyone, and that that party doesn’t really have control over traffic reaching them until it gets to them, where they can just drop it if they aren’t interested in it. That has some benefits.
However, this meant that if someone could round up enough computers with attached bandwidth, they could send traffic to one computer, and flood its network connection. This degrades its ability to talk to the rest of the Internet.
Some people decided to start going out and—often by compromising computers in one way or another—adding them to a “botnet”, which they could then use to flood servers on the Internet, making various services, mostly websites, slow or inaccessible. This is known as a distributed denial of service attack (DDoS). Some groups decided to try demanding ransoms from various websites.
If you try to flood a host behind CloudFlare, though, all you flood is CloudFlare, which is very large and has a lot of bandwidth and is going to be very difficult to bring down. You can try to reach the host behind CloudFlare via various methods—in fact, I posted something just the other day that specifically dealt with reaching that host, for a latency measurement—but if you’re trying to flood them that way, then CloudFlare is in a good position to detect and block your traffic at their computers. And, I’d expect that CloudFlare will also have a lot of expertise to try to counter very, very large-scale flooding before it even reaches their systems by communicating with major telcos.
I think that what we probably need is potentially for some kind of revision to IP that permits for hosts to have a way to blacklist or whitelist traffic and push those upstream, unless we want to have something like most Internet traffic being routed through CloudFlare or similar to solve the distributed denial of service problem. We…could do that, have the Internet basically be CloudFlare, Inc, but that’s not really what the designers of Internet Protocol intended, and I think that there are some good reasons not to go that route.