On 30 November 2015 at 12:05:03, Romeo Zwart (romeo.zwart@ripe.net) wrote:
Dear colleagues,
Between about 07:00 and 09:15 UTC today multiple root operators
including K-root were receiving an unusually large amount of query
packets. This was impacting the overall performance of K-root DNS
services, as can be seen for example in DNSMON (with apologies for the
unpleasant URL below):
https://atlas.ripe.net/dnsmon/group/k-root?dnsmon.session.color_range_pls=0-30-30-70-100&dnsmon.session.exclude-errors=true&dnsmon.type=server-probes&dnsmon.zone=k-root&dnsmon.startTime=1448835600&dnsmon.endTime=1448877600&dnsmon.ipVersion=both&dnsmon.server=193.0.14.129
After initial investigation, the RIPE NCC took counter-measures during
the incident. The results of these measures are partially visible in
DNSMON. The full effect of the mitigations implemented roughly coincided
with the end of the event.
We will investigate the events and the effectiveness of our response
further and report about this in the near future.
Thanks for the heads-up - would be interesting to know which countermeasures you implemented?
Cheers,
—
Nico