It is not DDoS that makes Twitter fail but its poor infrastructure

Analysts at Arbor Networks say that last week's distributed denial-of-service attack on Twitter was a relatively small operation although it garnered lots of headlines. The attack paled in comparison to big DDoS attacks that occur every day.

Last week, Arbor's ATLAS 2.0 Internet monitoring system, which is a collaborative effort that culls data from more than 100 ISPs, including British Telecom, Australian provider Netgen Networks and Indian provider Tata Communications, estimated that DDoS traffic directed at Twitter was not in the multi-gigabit range that characterizes most large attacks, Arbor chief scientist Craig Labovitz says. Although he couldn't give specific data on just how large the Twitter attack last week was, Labovitz says that the attack was not as massive as media reports might suggest.

Besides, Labovitz notes that while Twitter was being attacked last week, an Asian ISP came under siege from a large DDoS attack that generated more than 30Gbps of DDoS traffic. According to Labovitz, such punishing attacks are commonly deployed against e-commerce sites, as well as sites that specialize in pornography and online gambling.

In addition, Labovitz says that Twitter will have to look hard at upgrading its ability to fend off more sophisticated attacks if it wants to maintain its uptime. In particular, he notes that even before being knocked offline by a relatively small DDoS attack, the microblogging site continuously experienced difficulties in keeping its site running smoothly during heavy usage hours.

"From everything I've read and observed about Twitter, it's come from nowhere and it looks like it's struggling with its growth," he says. "This DDoS attack and the continued Twitter growth has provided them with a need for upgrading their infrastructure."

Recently, Arbor upgraded its ATLAS system to monitor and collect real-time data for global Internet traffic, routing and application performance. Previously, the system had been used mostly to collect data on security-related traffic such as DDoS attack traffic.