[nsp-sec] FYI, DDoS against roots started 90 minutes ago, 4am UTC.

[宫一鸣]

On 05/07/2014 01:46 PM, Dominik Bay wrote:
> ----------- nsp-security Confidential --------
> 
> On 05/07/2014 07:40 AM, Bill Woodcock wrote:
>> Of note is that it’s very uniformly distributed across our sites, which means that the botnet must be very geographically distributed.  Not large, though…  Less than 50gbps in total.  Just unusually widely distributed.
> 
> Confirmed for our L-Root servers in Duesseldorf, DE and Dortmund, DE. We
> see on both a 100% increase, but we don't serve much traffic anyway, so
> it's luckily not harming us.
> 
> -dominik
> 
> 
> 
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
> 
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security counter-measures.
> _______________________________________________
> 

The L-root stat page shows no spike on "DNS queries by QTYPE"

http://hedgehog.dns.icann.org/hedgehog/hedgehog.html

the weekly graphic looks pretty normal on a daily base for the past few
days..

Regards

Yiming