Menene layukan kariya DDoS, da kuma abin da kowane yana kula da shi?

Question

Accepted Answer

Kariya DDoS ita ce **kariya mai zurfin**: babu wani kontrolin da ke tsayar da kowane hari, don haka kuna tatara layukan da kowane yana sha, tsaurar, ko tsaye wani taray traffic. Tsari yana da mahimmanci — tura aiki da yawa zuwa gida, nisa da jiya.

## Layukan, daga gida zuwa ciki

- **CDN / wuraren tsaurar** (Cloudflare, Akamai, AWS Shield) — sokewar sarari. Tare da **anycast**, IP iri ɗaya ana gabatar da shi daga wurare masu kasua da yawa, don haka albarkatun jami'u ana **ɗaga abubuwan duniya** maimakon gida ɗaya. Wuraren tsaurar suna sha albarkatun kuma kawai suna gabatar da traffic mai safiya.
- **WAF (Web Application Firewall)** — bana HTTP bukatun da bana matsega masu zalunci: sauki mai zalunci, mai ba buƙatu da ke da alamar shan zafi, sanannun IP masu zalunci, da **Layer 7** albarkatun da suke nuna gida ainihi bukatun.
- **Rate limiting** — ƙungiyar bukatun bisa IP, maɓalli API, ko mai amfani a lokaci gida, jiya `429 Too Many Requests`. Tsayar mai saurin ɗumin maɓalli ba tare da cutar mutanen yau.
- **Upstream / ISP blackhole (null-route)** — ƙarshen ƙarewa don jami'u na yaudara. Mabugga yana jefar da traffic duka ga IP da aka damaje (**remotely-triggered blackhole, RTBH**), abin da ye fitar da IP gida don kare komai.
- **Autoscaling + overprovisioning** — karfin jiya mai karewa don **sha** abin da ya lace, kamar lokaci yayin da layukan sauran aje.

## Yayadda suke aiki juna

Ukali shine **absorb -> filter -> block** :

```text
Internet flood
  -> CDN + anycast      : ABSORB volume across global PoPs
  -> scrubbing          : drop obvious junk (L3/L4 floods)
  -> WAF                : FILTER malicious HTTP (L7)
  -> rate limiting       : throttle abusive clients (429)
  -> origin (autoscaled) : serve the clean remainder
  -> ISP null-route      : last resort if origin IP is overwhelmed
```

Albarkatun jami'u suna mutu a CDN/scrubbing layuka; albarkatun aikace-aikacen da ke kamar komai hankali traffic suna an tsaurar ta WAF da rate limiter.

## Me yasa ya yi muhimmanci

Mangane kariya akan layuka gida na kujerada ban gida: WAF ba tare da tsayar da albarkatun 1 Tbps (baba tace na farko), kuma CDN gida ne ne sai ma dabshi da alhaki mai ushi HTTP zai yi zuwa jiya. Layukan zaiay sai kowane albarkatun taray sai ma samun kariya da aka kera ga shi, kuma jiya ba tare da kallo bukatun da layukan sokewar ba su iya samun zuwa kansu.