[outages] EasyDNS issues?
Lyle Giese
lyle at lcrcomputer.net
Sat Oct 27 10:05:13 EDT 2012
On 10/27/12 08:43, Jeremy Chadwick wrote:
> I know EasyDNS is anycasted, so some of this troubleshooting work
> doesn't narrow things down, but something is indeed going on.
>
> Issue started roughly 2012/10/27 at 06:25 Pacific.
>
> I'm guessing a DoS attack but that's speculative.
>
>
> $ dig ns dslreports.com.
>
> ;; QUESTION SECTION:
> ;dslreports.com. IN NS
>
> ;; ANSWER SECTION:
> dslreports.com. 1200 IN NS dns3.easydns.org.
> dslreports.com. 1200 IN NS dns2.easydns.net.
> dslreports.com. 1200 IN NS dns1.easydns.com.
>
> ;; ADDITIONAL SECTION:
> dns1.easydns.com. 7321 IN A 64.68.192.210
> dns1.easydns.com. 172734 IN AAAA 2001:1838:f001::10
> dns2.easydns.net. 157640 IN A 72.52.2.1
> dns3.easydns.org. 468 IN A 64.68.195.10
> dns3.easydns.org. 72510 IN AAAA 2620:49:a::10
>
>
> $ dig @ns1.easydns.com a www.dslreports.com.
>
> ;; connection timed out; no servers could be reached
>
> $ host ns1.easydns.com
> ns1.easydns.com has address 64.68.192.210
>
>
> $ dig @dns2.easydns.net a www.dslreports.com.
>
> ;; QUESTION SECTION:
> ;www.dslreports.com. IN A
>
> ;; ANSWER SECTION:
> www.dslreports.com. 1200 IN A 209.123.109.175
>
> $ host dns2.easydns.net
> dns2.easydns.net has address 72.52.2.1
>
>
> $ dig @dns3.easydns.org a www.dslreports.com.
>
> ; <<>> DiG 9.8.3-P4 <<>> @dns3.easydns.org a www.dslreports.com.
> ; (2 servers found)
> ;; global options: +cmd
> ;; connection timed out; no servers could be reached
>
> $ host dns3.easydns.org
> dns3.easydns.org has address 64.68.195.10
> dns3.easydns.org has IPv6 address 2620:49:a::10
>
> $ mtr 64.68.192.210
> Packets Pings
> Host Loss% Snt Rcv Last Avg Best Wrst
> 1. gw.home.lan 0.0% 18 18 0.3 0.3 0.3 0.4
> 2. c-67-180-84-1.hsd1.ca.comcast.net 0.0% 18 18 25.4 24.4 12.7 31.2
> 3. te-0-0-0-12-ur05.santaclara.ca.sfba.comcast 0.0% 18 18 10.8 10.6 8.8 25.5
> 4. te-1-1-0-2-ar01.sfsutro.ca.sfba.comcast.net 0.0% 17 17 21.4 16.7 12.7 22.3
> 5. he-1-7-0-0-cr01.sanjose.ca.ibone.comcast.ne 0.0% 17 17 23.8 19.9 13.9 24.7
> 6. pos-0-12-0-0-cr01.denver.co.ibone.comcast.n 0.0% 17 17 53.9 56.0 53.7 57.7
> 7. 68.86.89.41 0.0% 17 17 88.5 84.0 78.2 90.8
> 8. be-10-pe03.350ecermak.il.ibone.comcast.net 0.0% 17 17 80.2 80.2 77.8 93.7
> 9. 173.167.57.126 0.0% 17 17 82.4 80.7 79.1 84.0
> 10. ae1-50g.cr2.ord1.us.nlayer.net 0.0% 17 17 79.5 80.7 77.8 112.0
> 11. as23352.ae6-102.cr2.ord1.us.nlayer.net 0.0% 17 17 78.6 79.3 77.9 81.8
> 12. 44.po1.ar2.ord1.us.scnet.net 0.0% 17 17 84.1 82.6 77.8 121.6
> 13. ge0-50.aggr4302.ord2.us.scnet.net 68.8% 17 5 80.7 80.5 79.5 81.6
> 14. dns1.easydns.com 76.5% 17 4 77.8 78.6 77.8 79.7
>
>
> $ mtr 64.68.195.10
>
> Packets Pings
> Host Loss% Snt Rcv Last Avg Best Wrst
> 1. gw.home.lan 0.0% 22 22 0.3 0.3 0.2 0.4
> 2. c-67-180-84-1.hsd1.ca.comcast.net 0.0% 22 22 27.7 23.0 11.4 40.6
> 3. te-0-0-0-12-ur05.santaclara.ca.sfba.comcast 0.0% 22 22 9.4 9.9 8.5 10.7
> 4. 69.139.198.174 0.0% 22 22 15.4 16.6 11.5 22.6
> 5. he-1-8-0-0-cr01.sanjose.ca.ibone.comcast.ne 0.0% 22 22 22.4 19.5 13.1 39.1
> 6. pos-0-3-0-0-pe01.11greatoaks.ca.ibone.comca 0.0% 22 22 16.2 17.8 15.0 20.1
> 7. 208.178.58.13 0.0% 22 22 23.2 19.7 14.2 27.5
> 8. ae9-40G.scr4.SNV2.gblx.net 4.5% 22 21 28.7 26.0 15.8 64.1
> 9. po3-20G.ar5.DCA3.gblx.net 0.0% 21 21 82.2 87.4 81.5 150.8
> 10. packet-clearing-house.gigabitethernet9-3.ar 47.6% 21 11 89.5 91.1 89.1 99.3
> 11. 64.68.195.10 95.0% 21 1 261.8 261.8 261.8 261.8
>
From my DNS server logs, they are the subject of a DNS amplification
attack.
Oct 27 08:54:02 linux named[18188]: limit REFUSED responses to 72.52.2.0/24
Oct 27 08:55:07 linux named[18188]: stop limiting error responses to
72.52.2.0/24
Oct 27 08:56:02 linux named[18188]: limit REFUSED responses to 72.52.2.0/24
Oct 27 08:57:02 linux named[18188]: stop limiting error responses to
72.52.2.0/24
Oct 27 08:58:02 linux named[18188]: limit REFUSED responses to 72.52.2.0/24
Oct 27 08:59:02 linux named[18188]: stop limiting error responses to
72.52.2.0/24
Oct 27 09:00:02 linux named[18188]: limit REFUSED responses to 72.52.2.0/24
Timestamps are CDT. My DNS servers have been an 'innocent victim' for
about three weeks now and I installed the rate limit patches this
morning to bind 9.8.4 from http://www.redbarn.org/ratelimits
Lyle Giese
LCR Computer Services, Inc.
More information about the Outages
mailing list