71–80 of 97 posts
Earlier quoted context omitted.
I wonder, what kind of machines are those? How many of those are currently operating, and where?
http://www.root-servers.org/ has the answers you seek. There are currently 13 root servers operated by 12 different entities (Verizon, NASAN, RIPE, ICANN, etc.) and most locations have multiple sites (physical instances).
Earlier quoted context omitted.
It was presumably done over UDP where it's trivial to fake source IP. What's the minimum size of a valid UDP-based DNS request? Let's guesstimate 25 bytes. Then 50M/s * 25 bytes = 1.25 GB/s. Or 10 Gbit/s. Is that really so impressive these days?
Is it really that trivial to fake source IP? I think pretty much any ISP wouldn't let such packets through (or am I missing something?), and you are also easier to find then (well, if you are not careful that is).
Earlier quoted context omitted.
It's a 12 byte header + the query section, which is 4 bytes + the qname, a sequence of labels. Each label is a length octet + the ascii encoded characters of the label. A query for "us" would be 12 + 4 (02 75 73 00) + 4 = 20 bytes, plus the IP header (20 bytes) + the UDP header (8 bytes), so 48 bytes. https://www.ietf.org/rfc/rfc768.txt https://www.ietf.org/rfc/rfc791.txt https://www.ietf.org/rfc/rfc1035.txt
Thanks :). So ~20 Gbit/s. (Also: I want your username.)
[1]: http://www.techworld.com/news/security/worlds-largest-ddos-a...
Earlier quoted context omitted.
The root servers get large traffic spikes quite routinely, this event was simply an order of magnitude or more larger than any previous events (AFAIK). Also, it actually managed to DoS a few instances, by way of saturating their throughput--though as the notice mentions, the overall DNS wasn't significantly affected aside from a few queries having to be retried.
You can clearly see the spike in this graph[0] (scale it down to Dec to see more detail). These graphs[1] show that it was limited to IPv4. [0] http://a.root-servers.org/metrics.html [1] http://k.root-servers.org/statistics/ROOT/monthly/
Looking at IPv4 Sources, the spike is mind boggling.
Is there significance to NTP requests in relationship to DDOS?
However, this isn't what happened on Monday. It seems like one attacker with a lot of systems used those systems to query someone's domain name whilst spoofing many IP addresses at once. This in turn overwhelmed many of the root servers, and possibly several authoritive DNS servers in the process. Sounds like a botnet owner was showing off how much power they have.
Earlier quoted context omitted.
If this was a botnot, any one ISP is only seeing a tiny fraction of the load. Even if it were from a single source, it also isn't that hard to find an ISP that doesn't care. (They cost slightly more, but if you're a bad actor, presumably it is worth it.) Edit: "I think pretty much any ISP wouldn't let such packets through" If you google "BCP38", you will find well over a decade of network operators discussing specifi…
After you have been a target of ~50 Gbps NTP reflection attacks that nearly destroyed our company, it's hard to be impartial in these discussions.
Earlier quoted context omitted.
Thanks :). So ~20 Gbit/s. (Also: I want your username.)
You're definitely asking the right question, and IMO the answer is "sortof." It's not that impressive in the grand scheme of DDoS, given major attacks will sustain 100 gigabit traffic[1] sometimes for days on end. But 20gbit/s would likely be enough to take down a small & unprepared business. [1]: http://www.techworld.com/news/security/worlds-largest-ddos-a...
Earlier quoted context omitted.
Or to ensure that the content is not tampered.
Nobody would tamper with this content.