I hear criminals are infecting thousands of computers in order to launch distributed denial of service attacks and slow down to the point of unusability even sites with a lot of bandwidth.

My question is whether the following would work against a small-scale ddos attack:

Say a very large number of friends offered their computers as web servers duplicating the same html content, and say a central server were available that did nothing but generate links to working web servers among these, much like p2p filesharing but with html pages being shared and this happening transparently to the visitor (ie the visitor sees normal text and images in their browser), and if N web servers took part in this at a given time where N is large, like 1,000,000, how large would N have to be in order to prevent a significant slow-down when attacked by ddos from M other computers each with the same average bandwidth as any of the web servers?

PS. Please don't say that attacker ip's can be blocked, I just want to know how much more collective bandwidth the web servers must have relative to the attackers for ddos attacks to have no significant effect. Note the web servers can all play the role of the initial server too, that server is only an entry point you go to once and it serves no content.

It would take them only a very short time to find your central server. Then they attack it, bring it down, and then there is not list of links. Essentially your central server is just acting as a DNS.

Why don't they do the same to the entry server of a p2p network? Surely Holywood and many others are losing billions to p2p filesharing, someone must have been pissed off enough to pay underground organisations to attack these p2p entry servers to extinction.

Even an existing p2p server can be used as the entry point. Perhaps transparently to the user if java accesses the p2p server.

By the way, the entry server is only required for discovering people, after that it's 1000000 servers against 1000 dos bots. The question remains, how many servers can each ddos bot slow down significantly?

what you are looking for is freenet I think.
http://freenetproject.org/

Thanks, I just wanted to know how much bandwidth ddos can consume compared to the bandwidth it is launched from, and therefore whether distributed web pages like freenet's have any chance against ddos if enough people take part in the effort. I'm not interested in the anonymity of it, just the robustness.

my understanding is if the tracker goes offline, those p2p peers already connected to each other can still send data to each other. The tracker is only required for the discovery of new peers.

Do you reckon an existing dns server can play the role of the tracker if helped by a secret server that keeps editing the dns record that maps the domain to an ip?

It takes too long for the new IPs to propagate through all the DNs. Then there is the issue with DNS caches, which can take a day or more to clear.

Set up your web server (or firewall) using tarpits:

HTTP DDoS Attack Mitigation Using Tarpitting
www.secureworks.com

Why is that a problem? When waves are propagating along a pond you observe an oscillating water level no matter where you are in the pond.

There are services like DynDNS that automatically update your dns record every time your dynamic ip changes, recommended for when you want to run a web site at your own computer. Haven't tried them, but are you saying that every time your ip changes your site will be inaccessible for a day or more to some people? Then that DynDNS service is almost a scam.

This seems very promising. Why doesn't every web server do it? Or maybe they only do it if attacked.

Ok, when you change your IP not just one server has to know about it, every DNS (that people that are trying to contact you are using) has to be informed of the change. There are a LOT of DNSs out there (maybe a million?). When you change your IP the service you are using has to send it up the chain until it hits a master DNS (wrong name but right idea, lack of caffeine), then it contacts all the other master DNS around the world, and then each master DNS begins sending it down the line(think of the food chain). While the master servers are talking to each other almost continuously, each of the lower levels generally do not. Depending on how things are configured it may be a day (or more) before a particular DNS gets updated to your change. Service like DynDNS are the only reason that these changes (for us little people) can get changed this fast. One used to have to jump through a ton of hoops (roughly a month) in order to get things changed(pre www).

From what I've gathered, there's a legal question about tarpits:

I am not a lawyer, so I can't advise you on the legal aspects of using a tarpit.

But here it is not the ordinary web, here all ip's have the same content so you don't mind if the ip you get is out of date. The bad guy is getting an out-of-date ip too, and can attack it, and repeat with the next ip after a while, and the next ip and so on. But how many ip's can he attack from the M computers he owns? We go back to the original question.

A day's time seems a fast change? There must be more to DynDNS than just getting your current external ip and writing it to a single dns server. Otherwise, a day's time would render it a scam.

From the DynDNS site: