|
Root Server Monitoring
Daniel Karrenberg
Effects of the flashworm can be clearly seen in our monitoring of DNS
root service. About 60 measuring points worldwide, but concentrated in
the RIPE region, send a DNS query to each of the 13 root servers once per
minute; every minute about 800 measurements are taken. These measurements
are in a pilot at the time of this writing. We expect to make them
available on the RIPE NCC web site before March 2003.
Figure 1
Figure 1 is a summary of all those measurements that went unanswered
during 25.01.2003. Once can clearly see the "flash" onset of the worm at
0530UTC. Until about 0640UTC two of the 13 root name servers show degraded
service across a significant number of measuring points with peaks of
around 16% of the queries unanswered. After 1400 all impact on root name
service has ceased.
Figure 2
Figure 2 zooms in and shows that two servers (B & G) were significantly
affected. The raggedness of the graphs suggests that the servers were
functioning but their connectivity was significantly reduced. This is also
what the zoomed views of the summary plots for both B (Figure 3) and G
(Figure 4) suggest:
Figure 3
Figure 4
Connectivity to B was restored by 0635 with some problems showing
again between 0720 and 0735. Connectivity to G was improving again around
0830 and restored by 1030.
Figure 5
Figure 5
is shown as an example of a server unaffected by the flash worm.
Back to the full report.
| 
