# Re: DDoS protection module suggestion

**URL:** <https://www.ruby-forum.com/t/re-ddos-protection-module-suggestion/198537>\
**Category:** NGINX\
**Created:** [November 3, 2010, 4:59am UTC](https://www.ruby-forum.com/t/re-ddos-protection-module-suggestion/198537 "2010-11-03T04:59:05Z")\
**Posts on this page:** 1\
**Page:** 2

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [November 5, 2010, 6:04pm UTC](https://www.ruby-forum.com/t/re-ddos-protection-module-suggestion/198537/21 "2010-11-05T18:04:05Z")

</div>

Hey Malte,

During a ddos attack, you are sending $possible\_bad-ip to a different  
server that just sits there and does nothing but Captcha. The cost for  
showing a captcha to a host is far less than the impact it would have on  
your network/servers.

also on the captcha you can implement cookie checks and if the host does  
not become valid say after seeing the page $n\_times then you can add the  
ip to an acl block list. Layer3-4 blocking cost is much less than  
layer7, same goes for if you are taking the threat away from your  
production internet facing servers and forcing the possible bad hosts go  
through a captcha system.

the last time i setup a network to handle 400mbps and 140k connection  
(not packets) a second attack it was with the suggestions and topology  
ive described, its worked without issues for me but perhaps you are  
seeing something that i have not.

Regards,  
-Payam

[Previous page](https://www.ruby-forum.com/t/re-ddos-protection-module-suggestion/198537.md?page=1)