Re: [dns-wg] K-root DNS Service Incident

Hi Nico, On 15/11/30 13:36 , Nico CARTRON wrote:

Hello Romeo,

On 30 November 2015 at 12:05:03, Romeo Zwart (romeo.zwart@ripe.net <mailto:romeo.zwart@ripe.net>) wrote:

...

Dear colleagues,

Between about 07:00 and 09:15 UTC today multiple root operators including K-root were receiving an unusually large amount of query packets. This was impacting the overall performance of K-root DNS services, as can be seen for example in DNSMON (with apologies for the unpleasant URL below):

https://atlas.ripe.net/dnsmon/group/k-root?dnsmon.session.color_range_pls=0-30-30-70-100&dnsmon.session.exclude-errors=true&dnsmon.type=server-probes&dnsmon.zone=k-root&dnsmon.startTime=1448835600&dnsmon.endTime=1448877600&dnsmon.ipVersion=both&dnsmon.server=193.0.14.129

After initial investigation, the RIPE NCC took counter-measures during the incident. The results of these measures are partially visible in DNSMON. The full effect of the mitigations implemented roughly coincided with the end of the event.

We will investigate the events and the effectiveness of our response further and report about this in the near future.

Thanks for the heads-up - would be interesting to know which countermeasures you implemented?

That will be part of the follow up message. To the appropriate level of detail of course. Kind regards, Romeo

Cheers,

—

Nico