[dns-wg] K-root DNS Service Incident

Hi Nico,

On 15/11/30 13:36 , Nico CARTRON wrote:
> Hello Romeo,
> 
> On 30 November 2015 at 12:05:03, Romeo Zwart (romeo.zwart at ripe.net
> <mailto:romeo.zwart at ripe.net>) wrote:
> 
>> Dear colleagues, 
>>
>> Between about 07:00 and 09:15 UTC today multiple root operators 
>> including K-root were receiving an unusually large amount of query 
>> packets. This was impacting the overall performance of K-root DNS 
>> services, as can be seen for example in DNSMON (with apologies for the 
>> unpleasant URL below): 
>>
>> https://atlas.ripe.net/dnsmon/group/k-root?dnsmon.session.color_range_pls=0-30-30-70-100&dnsmon.session.exclude-errors=true&dnsmon.type=server-probes&dnsmon.zone=k-root&dnsmon.startTime=1448835600&dnsmon.endTime=1448877600&dnsmon.ipVersion=both&dnsmon.server=193.0.14.129 
>>
>> After initial investigation, the RIPE NCC took counter-measures during 
>> the incident. The results of these measures are partially visible in 
>> DNSMON. The full effect of the mitigations implemented roughly coincided 
>> with the end of the event. 
>>
>> We will investigate the events and the effectiveness of our response 
>> further and report about this in the near future. 
> 
> Thanks for  the heads-up - would be interesting to know which
> countermeasures you implemented?

That will be part of the follow up message. To the appropriate level of
detail of course.

Kind regards,
Romeo

> 
> Cheers,
> 
> — 
> 
> Nico
>