DDoS Shield

Last week, one of my clients had multiple DDOS attacks, such as Syn-flood, UDP network attacks, and HTTP get floods at rates of 90K to 700K packets per second. DDos and http get attacks was so large that it shut down their web-servers which resulted in a complete network outage for several days. Once we were notified of the problem, my facility manager, Mike Mazzei and our Engineer, Payam Tarverdyan Phychi, initiated our DDos Shield service to mitigate their traffic. Our DDos Shield utilizes the latest bleeding edge technology devices which is made up of multiple vendors.

Our DDos Shield uses high end ASIC boards to process/analyze the packets which decreases latency when new devises are introduced into the mesh. This allows the security devices to scrub the packets to determine good vs bad packets based not only on signatures but also behavioral aspects and sourced based filtering. In a severe attack (over 200KPPS or depending on how large the traffic rate is) our DDoS Shield will work with our Cisco/Juniper Routers to distribute traffic over several of our upstream providers  to allow multiple ingress points for the attack and as such reduces the changes of saturating any given transit or transport. Once the distributed mode has been activated, all traffic will be automatically routed within the peer1 backbone and sent to designated locations designed to handle attacks upwards of 10 Million packets/sec and up to 5gigs/sce. This number will drastically increase in the weeks to come.

This customer operates a social networking site that was enabled during these attacks. Once on our DDoS Shield service he was back up in hours after initiating the service. If you would like more information regarding our DDoS Shield or any of our services you can contact me at woody@globalcoloquote.com or Ypigsfly.com.

56 Marietta Street Co-location

I just worked out the details for a new vendor in Atlanta at 56 Marietta Street. This makes two colocation vendors for that location and several IP Transit providers. Organizations will have a choice of 4U, 10U, 22U, 42U, and of course cage space if needed. There is plenty of power in both datacenters and one also offers managed hosting. You can view the website and promotional information at www.56-marietta-colocation.com or reach me at 917-710-5226.

Virtualization

Netcraft released it’s Web Server Survey for December last week and it’s no surprise that the total has grown by 1.56 million since the November total which was 185 million sites. Domain growth is continuing and Apache continues to be the leader in running web servers. Just a tidbit of information that is interesting considering the economic woes we are all experiencing. Now on to more opinionating comments. I’m continuing to see increased interest in virtualization but typically clients are just interested in learning more about virtualization but not purchasing. One of the most misleading perceptions is that all resources in a virtualized environment are shared. The hardware is dedicated to the individual client and the end user would create virtual machines as needed. The advantage of virtualization is scalability and failover abilities. And the ability to share resources in a dedicated hardware environment.

For more information I can be reached at sales@globalcoloquote.com or 917-710-5226.

CDN Costs Justified

I spend a large portion of my day speaking with potential (and existing) clients about our services and pricing components. The pricing components for a CDN are not complex. Basically, it is all based on transfer. The higher the monthly commitment (transfer), the better the rate. The monthly commitment starts at 250GB and goes up to 300TB+ and typically the set-up fee is free unless the client has 10+ Domains and even then it’s minimal. There are a few schools of thought about justifying a CDN and most agree that performance is the underlying reason for using a CDN. Using a CDN to increase performance will directly increase the revenue stream. One of my clients addressed this issue in his blog. Steve writes “ I’m betting that since the site is that much faster Google will increase the position of our site pages in its SERPs within a month and we’ll see a real return on our CDN investment at that point.” It’s a basic strategy for a basic concept- increase traffic, increase revenue! It’s true that not all sites are geared towards increasing ad revenue based on page views but the same rule applies to any site or business. This I know- Increasing performance of your site will increase traffic, period!

RAID

Today there was some confusion from a client about RAID so I thought the least I could do is post defintions. It’s difficult to explain without a real case but at least the definitions explain how many drives you will require to provide redundancy or a version of redundancy.

RAID 0 (striping)

RAID 0 uses the read/write capabilities of two or more hard drives working in unison to maximize the storage performance of a computer system. Data in a RAID 0 volume is arranged into blocks that are interleaved among the disks so that reads and writes can be performed in parallel (see below diagram). This technique, known as “striping”, is the fastest of all of the RAID levels, especially for reading and writing large sequential files. Real world tasks where RAID 0 can be of particular benefit include loading large files into image editing applications, saving large movie files in a video editing application, or creating CD or DVD images with a CD/DVD authoring package.

The hard drives in a RAID 0 volume are combined to form one volume which appears as a single virtual drive to the operating system. For example, two 400 GB hard drives in a RAID 0 array will appear as a single 800 GB hard drive to the operating system.

No redundancy information is stored in a RAID 0 volume. This means that if one hard drive fails, all data on both drives is lost. This lack of redundancy is also reflected by the RAID level 0, which indicates no redundancy. RAID 0 is not recommended for use in servers or other environments where data redundancy is a primary goal.

RAID 1 (mirroring)

A RAID 1 array contains two hard drives where the data between the two is mirrored in real time. Because all of the data is duplicated, the operating system treats the usable space of a RAID 1 array as the maximum size of one hard drive in the array. For example, two 400 GB hard drives in a RAID 1 array will appear as a single 400 GB hard drive to the operating system.

The primary benefit of RAID 1 mirroring is that it provides good data reliability in the case of a single disk failure. When one disk drive fails, all data is immediately available on the other without any impact to the data integrity. In the case of a disk failure, the computer system will remain fully operational to ensure maximum productivity.

The performance of a RAID 1 array is greater than that of a single drive because data can be read from multiple disks – the original and the mirror – simultaneously. Disk writes do not realize the same benefit because data must first be written to one drive, then mirrored to the other.

RAID 5 (striping with parity)

A RAID 5 array contains three or more hard drives where the data is divided into manageable blocks called strips. Parity is a mathematical method for recreating data that was lost from a single drive, which increases fault-tolerance. The data and parity are striped across all the hard drives in the array. The parity is striped in a rotating sequence to reduce bottlenecks associated with the parity calculations.

The capacity of a RAID 5 array is the size of the smallest drive multiplied by one less than the number of drives in the array. The equivalent of only a single hard drive is used to store the parity information, allowing for fault-tolerance with less than the 50% capacity reduction of RAID 1. For example, three 400 GB hard drives in a RAID 5 array will appear as a single 800 GB hard drive to the operating system.

The primary benefits of RAID 5 include capacity and data protection.  Because parity is used for data protection, up to 75% of the total drive capacity is usable.  Further, any single drive can fail and it is possible to rebuild the data after replacing the failed hard drive with a new drive. However, the extra work of calculating the missing data will degrade the write performance to the RAID 5 volume while the volume is being rebuilt.

The read performance of a RAID 5 array is greater than that of a single drive because data can be read from multiple disks simultaneously. Disk writes do not realize the same benefit because parity must be calculated and written to all the drives.

RAID 10

A RAID 10 array uses four hard drives to create a combination of RAID levels 0 and 1 by forming a RAID 0 array from two RAID 1 arrays.

Since all of the data on the RAID 0 array is duplicated, the capacity of a RAID 10 array is the size of the RAID 0 array. For example, four 400 GB hard drives in a RAID 10 array will appear as a single 800 GB hard drive to the operating system.

The primary benefit of RAID 10 is that it combines the benefits of RAID 0 performance and RAID 1 fault-tolerance. It provides good data reliability in the case of a single drive failure. When one hard drive fails, all data is immediately available from the other half of the mirror without any impact to the data integrity. In the case of a disk failure, the computer system will remain fully operational to ensure maximum productivity. Data fault-tolerance can be restored by replacing the failed drive.

The performance of a RAID 10 array is greater than that of a single drive since data can be read from multiple disks simultaneously. Compared to a two-disk RAID 0, RAID 10 read performance is higher as data can be read from either half of the mirror, but write performance is slightly lower due to ensuring data is written out completely to the array.

Serverside Graphics, Inc- comments

Serverside Group is the global technology leader in digital card design and a provider of innovative online marketing solutions to the payment cards industry. We build web sites for large, demanding organizations that expect nothing less but the top notch level of service from us. Peer-1 New York has consistently provided us with a reliable, friendly, responsive and informed hosting service.  They look after one of our main production sites including firewalls, load-balancers, a web farm and back end clustered database, and we have been happy to trust them with critical hardware replacements on a number of occasions. Furthermore, Woody Ferrell has personally gone out of his way to assist us with customer inquiries regarding the hosting arrangement.

Vadim Kagan – Project Coordinator
Serverside Group – We take payment cards personally.

Serverside Graphics, Inc. http://www.serversidegroup.com/
37 West 20th Street  Suite 809  New York  NY 10011  USA
T  +1 646 652 7014  M  +1 646 753 1577  F  +1 212 627 2019  Skype  vadimkaganssg  Email  vadim.kagan@serversidegroup.com

Colocation and Power

I have been consulting organizations on co-location for almost 9 years now. Mostly in North America and primarily in the U.S. market. With Peer 1, we currently have (17) datacenters and I have consulted and placed clients in all of them. Typically early on in the discussions, the topic of power comes up and it is always a challenge for clients to calculate their power requirements based on the type and size of equipment they are going to be utilizing. Obviously, if a client is bringing hardware in from another facility they can measure their draw in the existing cabinet. But what about the ones ordering new equipment for the first time or coming into co-location from a managed hosting environment? The two most common requests for power is 110v and 208v. There’s a big difference in the two and not understanding the difference can be the difference of a few to several thousand dollars per month. Think of it this way- 110v is single-phase power and 208v is two-phase power. For example, a 20amp circuit at 110v is 20amps. A 20amp circuit at 208v is 40amps. At $25/amp for a circuit you could be paying $1,000 a month for one power circuit to power your blades, SAN, etc. As far as servers go, a standard 1U server averages around 2 amps per machine. If we are talking about a 1U server with a single processor pushing less than 1Mbps of bandwidth. The power requirements will go up with machines with more than one processor or pushing more than 1Mbps of bandwidth. Most servers require 110v of power, however the newer blade-type servers will require 220v of power.Most datacenters in the U.S. provide 20 amps of 110v power in each 42U Full Cabinet. Most new clients do not realize that if you are provided a 20 amp circuit in your cabinet you only have 18 amps usable power. Standard U.S. electrical codes restrict breakers to accept more than 20 amps and will typically trip when enough heat is generated on the breaker and that usually happens between 18-20 amps. I always recommend to clients that have mission critical requirements and are pushing near 18 amps to utilize an additional 20 amp circuit in their cabinet. With dual-power supplied servers today, it is also a great fit to have redundant power for the entire cabinet so if you do loose a power supply or trip your breaker you will still have power but unless you shut a machine or two down you are likely to have the same problem with the second 20 amp circuit. This type of configuration is referred to as “A” and “B” power whearas “A” is the primary feed and “B” is a secondary feed coming from a separate UPS for redundancy.  I always recommend using a power monitoring PDU ( power distribution unit) to monitor power usage and allow the flexibility to remotley shut down devices as needed. For more information about power usage or questions about co-location or hosting, please contact me at gferrell@peer1.com or 917-710-5226.

New York and Los Angeles Client Comments

Teko Management has been a customer of mine for over 5 years and had some nice things to say about my team and Peer-1 recently.

“Peer1 has been a dream to work with.  From excellent facilities, data
center management, top notch utilities, to expedient and efficient
technical support, remote-hands, and customer service.  We always feel like we are given priority on any matter.  Services such as cooling, power and network transport are rock solid.  Our rep, Woody, is a pleasure to work with and always gets stuff done for us.  Overall it is hard to go wrong with Peer1.”

Nathan Shafer
Tekco Management Group, LLC

NextPlay.com and Peer-1’s CDN

NextPlay ( www.nextplay.com ) is an online basketball showcase that serves the high school and college basketball community.  It’s a service that allows a basketball coach, player, or fan to register and have access to film footage of games and players. Coaches can use the films for recruiting for that extra edge in the recruiting process. Players can use Nextplay for creating a profile to allow coaches to view their strengths as a player and a student. Fans have access to their favorite high school or college games. “With an ever expanding online library of thousands of high school and college games, coaches, players, and fans can watch full games and create highlight reels from their games right online. Users can then share their highlight reels through various mediums, including blogs and social networks”, says Chris Petrillo of NextPlay. Users can then share their highlight reels through various mediums, including blogs and social networks and NextPlay’s customer base continues to grow substantially as a result of its innovative services. Peer-1 New York provides the infrastructure that allows NextPlay to focus on innovation. “Integral to NextPlay’s growth, has been Peer1’s Content Delivery Network. Peer-1’s CDN provides immediate scalable infrastructure for online delivery of very large video files at every increasing peak traffic levels”, says Chris. As a leading IT Infrastructure company, Peer-1 has provided NextPlay with hosting, co-location, content delivery, and transit services mostly in the Peer-1 Network New York Datacenter. We assisted Chris and NextPlay with a plan to migrate from a hosting environment directly to a co-location facility with minimal downtime and our CDN is providing NextPlay a solution to meet the demands of their success. 

Peer 1’s CDN service is very simple to set up. Just provide a hostname and IP Address and we will forward you access to the control panel to enable or disable nodes. Simply create a cname or alias to direct end-users to Peer 1’s CDN instead of the origin server and all subsequent requests will be served by the cache. “We got OSDir setup with Peer1’s CDN today & I’m really pleased with the performance gains I’m seeing while just surfing the site. So far I can’t recommend these guys enough.  The customer service while getting this going was outstanding”, says Steve Mallet of (the) Inevitable Corp. on his blog. If you would like to test our CDN please contact Woody Ferrell at gferrell@peer1.com

Port Monitoring

A client of mine recently asked me this question; “Am I responsible for all traffic originating out of my server, even if my server was compromised”? This is not an unusual question, especially for a server running Linux and not protected by a firewall. It is very important to run an Firewall or lease a Network Firewall from your provider, or at least some version of a software firewall. Once a server is compromised, it is inevitable that the port traffic will increase due to a rootkit or some other form of illegal activity originating from a hacker. A rootkit can go undetected running a variety of programs on your server using bandwidth that you pay for and perhaps running undetected for months. One way to detect a compromised server is to monitor port traffic using a tool like MRTG (multi router traffic grabber) or use a provider tool like a Port Monitoring service. An MRTG will give you online reports and analysis that makes it easy to notice an increase in your port traffic or unusual traffic patterns. Port Monitoring will notify you once your bandwidth is increased based on a thresh hold that you set. PEER 1’s  Port Monitor service lets you take direct control of your network costs and avoid unwanted surprises. Using PEER 1’s monitoring tools, you can define your minimum and maximum thresholds for bandwidth and packets per second (PPS) usage, and receive email alerts or mobile alerts to let you know when you’ve reached a specific threshold. In addition, PEER 1’s Port Monitor service will automatically alert you of any changes in your port’s link status. If your port goes down for any reason, you will be the first to know. Now you can protect yourself from ballooning bandwidth costs related to aggravating viruses, DDoS attacks and spamming – all that can create massive spikes in traffic in a very short period of time. On January 25th, 2003 a variant of the infamous SQL Slammer Worm did just that. The virus infected 75,000 Internet hosts within the first 10 minutes of its release, causing a denial of service for some while dramatically slowing down overall Internet traffic for everyone. The rapid infection ate up bandwidth resources with a vengeance, and caused backbone congestion and instability with a number of Tier 2 providers (source: Wikipedia). Fortunately, Peer 1 Network New York employed a number of tools that detected the extreme event as it was occurring and advised 100 hosting clients that day that their SQL machines had been compromised. As a result, they avoided the devastation experienced by other hosts, along with the massive bills. Although PEER 1 was able to see this event, there are many more situations that can only be detected by using our Bandwidth and PPS Monitor service with your pre-defined thresholds.You can also protect your revenue stream by ensuring you are alerted of a sudden dip in traffic on your port due to a server crash, hardware failure or web site configuration issues. A threshold set for a minimum amount of expected traffic lets you monitor unforeseen issues as they may arise. For more information about Port Monitoring or Peer-1 Network New York please contact Woody Ferrell at gferrell@peer1.com or 917-710-5226.