[dns-wg] K-root DNS Service Incident

Hello Romeo,
On 30 November 2015 at 12:05:03, Romeo Zwart (romeo.zwart at ripe.net) wrote:

Dear colleagues, 

Between about 07:00 and 09:15 UTC today multiple root operators 
including K-root were receiving an unusually large amount of query 
packets. This was impacting the overall performance of K-root DNS 
services, as can be seen for example in DNSMON (with apologies for the 
unpleasant URL below): 

https://atlas.ripe.net/dnsmon/group/k-root?dnsmon.session.color_range_pls=0-30-30-70-100&dnsmon.session.exclude-errors=true&dnsmon.type=server-probes&dnsmon.zone=k-root&dnsmon.startTime=1448835600&dnsmon.endTime=1448877600&dnsmon.ipVersion=both&dnsmon.server=193.0.14.129 

After initial investigation, the RIPE NCC took counter-measures during 
the incident. The results of these measures are partially visible in 
DNSMON. The full effect of the mitigations implemented roughly coincided 
with the end of the event. 

We will investigate the events and the effectiveness of our response 
further and report about this in the near future. 
Thanks for  the heads-up - would be interesting to know which countermeasures you implemented?

Cheers,

— 

Nico
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/dns-wg/attachments/20151130/fc5aa10e/attachment.html>