A Distributed Denial of Service (DDoS) attack appeared to target at least five of the thirteen root name servers early Tuesday morning, according to the RIPE NCC's preliminary analysis. The attacks caused two of the root name servers to stop responding to up to 90% of queries. However, the other root name servers, including the RIPE NCC managed K-root, kept the Internet working during this time.
The Internet relies on thirteen root name servers deployed globally to manage traffic between computers connected to the Internet. They are referred to by letters of the alphabet running from A to M. Together the root name servers help to translate human readable names (like www.ripe.net) to network addresses which are used to route Internet traffic all over the world. To ensure stability, no one organisation controls the thirteen root name servers. In addition, each root name server can run across hundreds of machines worldwide, ensuring further resilience of the root name server system. It is a tribute to the robust nature of this system that Tuesday's DDoS attack passed largely unnoticed by the average computer user while experts worked to process the flood of data generated by the attack.
Following earlier DDoS attacks on root name servers in October 2002, the RIPE NCC has improved the reliability of the root name server system by installing mirror instances of the K-root server. RIPE NCC engineers have deployed mirror instances of the K-root server in 17 locations worldwide.
"I am glad that we have invested in distributing the K-root name server to locations all over the world," said Daniel Karrenberg, Chief Scientist at the RIPE NCC. "This makes the service we provide more resilient against this sort of attack. The good thing about yesterday's attack is that it got noticed only because of our public monitoring and not because Internet users felt any of it."
The RIPE NCC's DNS Monitoring Services provides a comprehensive, objective and up-to-date overview on the quality of service of the root name servers.
Useful background can be found in the briefings below, which were written by the RIPE NCC's Chief Scientist, Daniel Karrenberg:
DNS Root Name Servers Explained For Non-Experts
http://www.isoc.org/briefings/019/
DNS Root Name Server Frequently Asked Questions
http://www.isoc.org/briefings/020/
The Internet Domain Name System Explained for Non-Experts
http://www.isoc.org/briefings/016/index.shtml
These external links will open in a new browser window
]]>This brings the total number of K-root instances available over IPv6 to seven, including the two global nodes already available over IPv6 in Amsterdam and Miami.
The RIPE NCC plans to roll-out IPv6 at all K-root nodes where we have IPv6 connectivity with our peers. If you are interested in peering with us at any location, please e-mail k-peering _at_ ripe _dot_ net.
On 4 February 2008 the IANA added IPv6 glue to the DNS root zone.
This is a first quick look at measurement data for K-root, k.root-servers.net. It is based on data taken with the DNS Statistics Collector (DSC) tool, which we highly recommend.
K-root serves on IPv6 from two of its global instances:
The bulk of the IPv6 queries are served by the AMS-IX instance. We expect though, that as the number of IPv6 peerings at the NAP of the Americas grows, that ratio will change.
The publication of the IPv6 glue in the root zone is reflected by the steep increase in the number of queries. Queries received before that time most likely resulted from monitoring efforts such as DNSMON, since they exhibit no diurnal pattern. Please note that this graphs starts at 1 February because prior to that our DSC set-up was not collecting this data.
This DNS Monitoring (DNSMON) graph shows round-trip times from some 30 probes to the IPv6 service address of K:
The increase in load over IPv6 has caused no change in service quality.
When you interpret the IPv6 DNSMON data, please note that DNSMON does not measure the servers themselves, but the quality of the IPv6 service at the probe locations. This includes the networks between our probes and the target servers.Please also note that there are currently fewer IPv6 probes than IPv4 probes.
Clients that are not speaking EDNS will not receive a full set of glue resource records (RRs) in response to the DNS priming query. This may cause them to query for the missing glue, and there were concerns that deficient DNS implementations would cause excessive load on root servers. For more details, see: http://www.icann.org/committees/security/sac018.pdf
k.root-servers.net is configured to include all A (IPv4) glue RRs and two AAAA (IPv6) glue RRs in responses to non-EDNS speakers at this time. So one would expect an increase of queries for AAAA glue. However, the number of AAAA queries to k.root-servers.net shows no significant change after 4 February, meaning that this potential problem has not materialised:
Some root name servers are now configured in a way that does not include glue for k.root-servers.net in responses to non-EDNS speakers. Some DNS implementations might not use root name servers for which they have not received glue in the original response to the priming query. When looking at the total number of queries received at K-root we can see a slight drop in both peak and average load after 4 February:
Absolute number of queries to all instances of K-root per query type
The change is certainly not big enough to have any operational impact. Indeed, it is not clear whether it is a significant change at all, in the sense that other factors may contribute to it. The only certain way to find out would be to change the configuration of those servers omitting glue for K-root and observe the subsequent load on K-root.
A few experts were also concerned that the omission of some glue from responses to priming queries would cause defective DNS software to retry the query using TCP. The following graph shows clearly that this has not been the case, and that the number of TCP connections to all instances of k.root-servers.net did not increase.
Absolute number of TCP connections to all instances of K
Please note that this graphs starts at 1 February because prior to that our DSC set-up was not collecting this data.
k.root-servers.net receives significantly more queries over IPv6 now that its IPv6 address has been published in the DNS root zone. Currently about 0.8% of all queries arrive over IPv6. The inclusion of IPv6 addresses for six root name servers into the DNS root zone went smoothly and as expected, and there are no operational problems or concerns.
]]>The RIPE NCC has been supporting the efforts of ICANN for signing the root and as the operator of K-root is participating in a coordinated, staged deployment plan with all other root server operators. Together with other root operators the RIPE NCC participates in coordinated data collection and analysis to monitor the effects of the deployment of DURZ.
In addition, the RIPE NCC has been monitoring and analysing the impact of signing the root. "In preparation for the deployment of the signed root, we looked at all components of the K-root system," noted Andrei Robachevsky, Chief Technical Officer, RIPE NCC. "Together with NLnet Labs we conducted extensive load and TCP tests. Our monitoring system was upgraded as well as the infrastructure in several locations to ensure that all nodes are well provisioned for serving the DURZ."
The RIPE NCC has also provided a range of tools, such as a DNS reply size tool, to help the Internet community prepare for the signing of the root. The reply size test tool, launched late in 2009, enabled users to test if their resolvers were likely to encounter any difficulties resolving names when the root zone is signed with DNSSEC. In January 2010, the RIPE NCC presented the first results and analysis from the DNS reply size testing.
"The idea is to provide a quick and easy to use tool that will enable people to pre-empt potential problems and to identify the correct solution," said Robachevsky. "We've also conducted a range of measurements including packet capture traces of K-root and priming queries. The goal of our effort in this area is to provide the tools and measurements that can best help the RIPE community prepare for the signing of the root zone."
The RIPE NCC plans to collect data continuously, and perform analysis at regular intervals. These results will be available to the community via RIPE Labs as well as the RIPE NCC website and the K-root home page. The primary focus of these efforts is to help the RIPE NCC and the operator community detect and solve any significant issues before 1 July 2010, after which ICANN is scheduled to sign the root zone with real keys.
The reply size tool, results and analysis is available from RIPE Labs, a website dedicated to innovative tools, measurements and analysis. This website also features a range of recent articles dealing with Internet number resource measurements, related to IPv4 and IPv6 allocation rates, and DNS developments such as the signing of the root zone.
More information about the RIPE NCC's activities as the operator of the K-root server is available at:
http://k.root-servers.org/
Founded in 1992, the RIPE NCC is an independent, not-for-profit membership organisation that supports the infrastructure of the Internet. The most prominent activity of the RIPE NCC is to act as a Regional Internet Registry (RIR) providing global Internet resources and related services to a current membership base of around 6,500 members in over 75 countries.
These members consist mainly of Internet Service Providers (ISPs), telecommunication organisations and large corporations located in Europe, the Middle East and parts of Central Asia.
As one of the world's five RIRs, the RIPE NCC performs a range of critical functions including:
The RIPE NCC also provides a range of technical and coordination services for the Internet community. These services include the operation of K-root (one of the 13 root name servers), the Deployment of Internet Security Infrastructure (DISI) and DNS Monitoring (DNSMON). As a result of its established position in the Internet industry, the RIPE NCC has played an important role in the World Summit on the Information Society (WSIS), the Internet Governance Forum (IGF), European Union (EU) workshops and government briefings on key issues in the current Internet landscape.
For media enquiries please contact:
Lucie Smith/ Gabriela Warren at Racepoint Group UK
Tel: +44 208 752 3200
Email: ripencc _at_ racepointgroup _dot_ com
The K-root server is one of the 13 DNS root servers that resolve lookups for domain names all over the world and form a critical part of the global Internet infrastructure. The K-root service is provided by a set of distributed mirror instances using IPv4 anycast. Each mirror instance announces the 193.0.14.0/24 network in AS25152. A K-root mirror instance consists of a cluster of server machines running the NSD name server software.
Using anycast makes the root server system more resilient to Denial of Service (DoS) attacks and improves the DNS response for local communities by providing shorter paths between clients and servers.
Information about this node and the general requirements and guidelines for expressions of interest for hosting a mirror instance of K-root can be found on the K-root website:
]]>Information about this node and the general requirements and guidelines for expressions of interest for hosting a mirror instance of K-root can be found on the K-root website:
]]>The K-root server is one of the 13 Internet root name servers that resolve lookups for domain names all over the world and form a critical part of the global Internet infrastructure. The Domain Name System (DNS) is a service used to translate between host names and Internet Protocol (IP) addresses by virtually all Internetworking software, including e-mail and web browsers.
Following Distributed Denial of Service (DDoS) attacks on root servers in October 2002, the RIPE NCC has worked to improve the reliability of the root server system by installing mirror instances of K-root server.
The K-root server incorporates IP anycast technology. It uses routing topology to send Internet traffic to the nearest or best destination. This leads to better distribution of services and improves response times for End Users.
The RIPE NCC has operated the K-root server since 1997, when we installed the first instance at the London Internet Exchange (LINX) in London, UK. Since early 2003, our engineers have deployed mirror instances of the K-root server in Abu Dhabi, Amsterdam, Athens, Brisbane, Budapest, Doha, Frankfurt, Geneva, Helsinki, Milan, Poznan, Reykjavik, Tokyo and Miami.
You can find more information on the K-root website:
]]>The K-root server is one of the 13 DNS (Domain Name System) root servers that resolve lookups for domain names all over the world and form a critical part of the global Internet infrastructure. DNS is a service used to translate between host names and IP addresses. It is used by virtually all internetworking software, including e-mail and web browsers.
The K-root service is provided by a set of distributed mirror instances using IPv4 anycast. Each mirror instance announces the 193.0.14.0/24 network in AS25152. A K-root mirror instance consists of a cluster of server machines running the NSD name server software.
Using anycast makes the root server system more resilient to Denial of Service (DoS) attacks and improves the DNS response for local communities by providing shorter paths between clients and servers. Prior to this local deployment, Qtel Internet subscribers encountered average delay times of 200ms. The introduction of this instance of K-root should see delays drop to around 15ms, a 90% reduction.
The RIPE NCC has operated the K-root server since 1997 when the first server was installed at the London Internet Exchange (LINX) in London, UK. RIPE NCC technicians have deployed instances of the K-root server, hosted at the LINX, at the AMS-IX in Amsterdam, the DE-CIX, Frankfurt and the AIX, Athens. There are plans to have up to 10 instances of the K-root server deployed by the end of 2004.
Information about this node and the general requirements and guidelines for expressions of interest for hosting a mirror instance of K-root can be found on the K-root website
]]>
The K-root server is one of the 13 Internet root name servers that resolve lookups for domain names all over the world and form a critical part of the global Internet infrastructure. The Domain Name System (DNS) is a service used to translate between host names and Internet Protocol (IP) addresses by virtually all Internetworking software, including e-mail and web browsers.
The K-root service is provided by a set of distributed mirror instances using IPv4 anycast. Each mirror instance announces the 193.0.14.0/24 network in AS25152. A K-root mirror instance consists of a cluster of server machines running the NSD name server software.
The RIPE NCC has operated the K-root server since 1997 when the first server was installed at the London Internet Exchange (LINX) in London, UK. Since early 2003, RIPE NCC technicians have deployed mirror instances of the K-root server in Amsterdam, Frankfurt, Athens, Doha, Milan and Reykjavik. There are plans to have up to ten instances of the K-root server deployed by the end of 2004.
More information on the Finnish Internet exchange is available at:
http://www.ficix.fi/
Information about this node and the general requirements and guidelines for expressions of interest for hosting a mirror instance of K-root can be found on the K-root website
]]>The K-root server is one of the 13 DNS root servers that resolve lookups for domain names all over the world and form a critical part of the global Internet infrastructure. The K-root server has been operated by the RIPE NCC since 1997 when the first server was installed at the London Internet Exchange (LINX) in London, UK.
Deployment of anycast instances of the K-root server further improves the distribution of this crucial service in various Internet regions and its resilience against Distributed Denial of Service (DDoS) attacks. As K-root is one of the 13 root servers, this also means improvement for the whole Root Server System.
RIPE NCC technicians were among the pioneers of the anycast concept for root servers and have deployed instances of the K-root server, hosted at the LINX, at the AMS-IX in Amsterdam and at the DE-CIX, Frankfurt. They are planning to have up to 10 instances of the K-root server deployed by the end of 2004.
“We operate K-root as a service to the Internet at large on behalf of our 3,500 members, across more than 100 countries, to whom we provide Internet resources and co-ordination services,” stated Axel Pawlik, Managing Director of the RIPE NCC. “As a membership association we are directly responsible for fulfilling the needs of our members. Our members are committed to providing reliable DNS service because their businesses depend on it.”
Anycast allows exact copies of the server, including the name and IP address, to be deployed in different locations. These copies are deployed in collaboration with local partners but are under sole management and administrative control of the RIPE NCC. Using anycast makes the root server system more difficult to attack and improves the DNS response for local communities by providing shorter paths between clients and servers.
“Our strategy is to deploy servers at multiple locations where there is a lot of Internet connectivity. We do that in close co-operation with ISPs who are also our members,” said Andrei Robachevsky, Chief Technology Officer at the RIPE NCC. “However, by taking full operational responsibility for the servers themselves, the RIPE NCC can build a very strong service that is resilient to disasters and attack.”
By locating the servers at Internet exchange points, they have the advantage of being as hardened as the infrastructure at these points themselves. “This is very economical because we do not need to spend extra money to harden these sites or to develop their connectivity,” noted Robachevsky. “Service quality and security is not always proportional to money spent.”
“We do not need fancy, hardened Network Operations Centres,” added Daniel Karrenberg, Chief Scientist of the RIPE NCC, who installed the first instance of k.root-servers.net at the London Internet Exchange (LINX) back in 1997. “Our engineering builds on diversity and distribution of functions. The servers will continue to run reliably for a very long time even if our Network Operations Centres should be down. We monitor the quality of the root name service from more than 50 locations worldwide, and we publish the results for everyone to see.”
These results are available through the RIPE NCC DNS Monitoring site. The site uses Test Traffic Measurements (TTM) network to provide an up-to-date service overview of certain DNS root and Top-Level Domain (TLD) name servers. The DNS Monitoring service is available at: http://dnsmon.ripe.net
“The strength of the Internet does not come from centralistic or hierarchical designs but from de-centralised and distributed design and engineering,” noted Karrenberg. “Operationally, the root servers are equal peers and client software can choose any one of them based on an estimate of which provides the best service to the client's location at the time.”
The strength of the root name server system lies in its diversity on all levels, a legacy of the late Jon Postel who oversaw its construction in the 1990s. “It is not a weakness but a strength of the system that servers are operated by a widely diverse group of organisations,” said Pawlik. “Measurements show that the current system is performing well,” he added. "It will be hard to introduce more central or hierarchical structures without substantially weakening the system as a whole.”
The RIPE Network Coordination Centre (RIPE NCC) is an independent, not-for-profit membership organisation that provides services to members in the RIPE NCC service region. The membership consists mainly of Internet Service Providers (ISPs), telecommunication organisations and large corporations.
The RIPE NCC also provides services for the benefit of the Internet community at large
including the development and maintenance of the RIPE Database, administrative support for the RIPE community and the development and co-ordination of member-supporting projects.
]]>
The K-root server is one of the 13 Internet root name servers that resolve lookups for domain names all over the world and form a critical part of the global Internet infrastructure. The Domain Name System (DNS) is a service used to translate between host names and Internet Protocol (IP)