CloudFlare Issues in NA
- Thread starter Jonathan
- Start date
I knew something like this would happen. This is one of the reasons why I won't use a CloudFlare.
We use them for "non-critical" services which won't negatively effect customers if down. Helpdesk and such we don't, for reasons exactly like this. I routed us around Cloudflare about 5 mins after discovering this.
Surprisingly I've not seen a huge influx of tickets from customers sites that use CF being down either, which is odd.
Looks like they just gave the all-clear: https://twitter.com/CloudFlareSys/status/517706217775312896
Nice 30 minutes of downtime for folks in NA.
Nice 30 minutes of downtime for folks in NA.
There's no real 100% uptime for any service. Saying you wouldn't use it because of a certain event is a pretty rash thing to say in my opinion. The entire fact that they're able to get everything fixed within 30 minutes I'd say is why you should use them 
They took care of it all in a pretty fast/quick manner!
They took care of it all in a pretty fast/quick manner! 
Dylan
Active Member
Post-mortem's up here: https://blog.cloudflare.com/route-leak-incident-on-october-2-2014/
tl;dr It was a route leak by a Latin American ISP and wasn't CloudFlare's fault.
tl;dr It was a route leak by a Latin American ISP and wasn't CloudFlare's fault.
drmike
100% Tier-1 Gogent
How many people use just Cloudflare's DNS? Tons. This surely put them offline too. Total people impacted is much larger than the filter use only crowd.
Too many people use Cloudflare, just like too many people use random other huge businesses.
The BGP route issue is ancient and idiotic. Better policing needs to be done to prevent such accidental sort of ability to advertise bogus routes. Nothing stopping someones for intentionally advertising some bad routes and taking out swath of major services and in process flooding another network / provider. What year is this?
Too many people use Cloudflare, just like too many people use random other huge businesses.
The BGP route issue is ancient and idiotic. Better policing needs to be done to prevent such accidental sort of ability to advertise bogus routes. Nothing stopping someones for intentionally advertising some bad routes and taking out swath of major services and in process flooding another network / provider. What year is this?
DomainBop
Dormant VPSB Pathogen
The fact that their systems represent a single point of failure is the primary reason why I wouldn't use them for DNS. This isn't the first time they've had an outage that put customers' websites offline.There's no real 100% uptime for any service. Saying you wouldn't use it because of a certain event is a pretty rash thing to say in my opinion. The entire fact that they're able to get everything fixed within 30 minutes I'd say is why you should use them
tl;dr no single point of failure in my DNS = no unreachable websites if a DNS server (or two) goes down.
DomainTools' DailyChanges shows 515K sites using them for primary DNS. http://www.dailychanges.com/cloudflare.com/
BrianHarrison
Member
I wonder what exactly happened at that Colombian ISP -- fat fingered an outbound prefix filter edit? Did they announce a bunch of other erroneous prefixes as well or specifically just Cloudflare prefixes?
drmike
100% Tier-1 Gogent
We shall never know... People are always claiming admin bloopers to avoid liability. Tech continues to be the bastard anarchists playground with barely a bottom beat for bad behavior.
There should be strict network checks in place to prevent such. I'd wager to say there are and someone is misconfigured / running stupid / crappy upstream accepting the insanity.
Like anything else, once clowns see the ability to do such, copycats ensue. There have been too many similar events to this in past 18 months....
There should be strict network checks in place to prevent such. I'd wager to say there are and someone is misconfigured / running stupid / crappy upstream accepting the insanity.
Like anything else, once clowns see the ability to do such, copycats ensue. There have been too many similar events to this in past 18 months....
Jasson.Pass
New Member
This is why I will not use CF or a free service. I've stuck more to paid CDNs and proxy services as better service. When something happens to free users people generally care less.
Dylan
Active Member
There's Incapsula, but I wouldn't consider them as good overall. They also have pretty low bandwidth limits.
Last edited by a moderator: