Problems / Security, medium

A 50,000 req/s flood

At 10 s a volumetric DDoS of 50,000 req/s hits a system with nothing in front of the load balancer.

Solve it in the labTake it as a mock interview

Unlock it once for 15 credits; everything inside it is free (runs, changes, Submit, results, hints). Sign in with Google to start; new accounts get free credits.

Your goals

Success ≥ 98% for real users, block ≥ 95% of the attack.

Test cases

Like a coding problem, a solution has to pass every case, not just the one it was built for. Submit in the lab runs all 4; 1 of them are hidden until then.

  1. As given. The problem’s own traffic, scheduled failures and seed.
  2. A slow dependency. The main data store or model answers twice as slowly for part of the run.
  3. A server dies. One replica of the service with the most replicas is killed for part of the run.

The traffic

1,500 requests a second for 30 seconds: 90% reads, 10% writes.

The system

What each component does in this design, and what calls it. The simulator mimics each one from these settings.

ComponentIts job hereSettings
Load balancerLoad balancerTraffic enters here.Calls API.Layer 4 balancers route by IP and port; layer 7 balancers read HTTP and can route by path or header.–
APIApp serviceLoad balancer forwards to it.Calls Postgres.Little's law: throughput ≈ concurrency ÷ latency. 200 slots at 50 ms serve about 4,000 req/s.4 replicas × 200 slots · timeout 2.0 s
PostgresSQL databaseAPI calls it.Postgres runs one process per connection, which is why poolers like PgBouncer sit in front of busy databases.4 vCPU · 60 connections

More security problems