Internet's root servers take hit in DDoS attack

Got to wonder, what where the two names they've attacked so far?

Agree with Vixie

Been operating a network for 17 years and we have egress filtered from day one. Make laws to hold the creators of shite like windows responsible, let them reap what they sow.

Add more root servers

I figure that they can put out a regulation where if you want to run a TLD, you also have to host a root server (and have it verifiable through DNSsec that you haven't tampered with the root zone file). I figure that if you want a piece of the internet, you should be required to also support the rest of it.

Its not like the root zone is really all that expensive to host anyway. Its a simple 1.1 MB file and it only sees a few queries anyway (the zone only contains NS records for the various TLDs out there, and each has a TTL of either 24 or 144 hours) so any client DNS server would only create, at most, 1.1 MB worth of queries every 1-6 days (And that's assuming that that DNS server is trying to find names in every single TLD out there). And the fact that they are distributed would only reduce that load even further.

It bothers me that so much of the Internet's basic infrastructure is hosted in a single country that hasn't really shown that its should be trusted with such things. Every country hosting a root DNS server would then add a bit of accountability to world governments.

In my opinion, we should really move to a distributed DNS type system where a DNS server operator can host the zone files for as much of the internet as they want with each zone being distributed in a signed torrent/diff-file like system. Changes would would be signed by the Authority for each particular TLD (and the root would be authorized by ICANN). Such a system wouldn't need that much engineering to put together. It'd take a while to get it full implemented, but the benefits would be more than worth it.

A copy of all zone records would be less than 100 GB (Just guessing based off of an estimate that an NS record and an A record for each domain would be about 128 Bytes and .com has 122 Million such domain pairs for 14.5 GB for .com and assuming that .com takes up less than 10% of all domains). Even if all 1172 domains were the size of .com, that'd only be 16.6 TB of DNS data total, so with current storage technology, a DNS server hosting every single 2nd level DNS record in the world for only a few thousand dollars in the worst case.

Enforce filtering

Isn't it about time Egress filtering was enforced. Surely it is possible to set a reasonable deadline and once that has passed enforce restrictions on those who haven't. Without a big stick providers won't do it - look at ipv6 adoption it's still impossible to get a lot of providers to provide it as they don't see any positive impact on their profits. I guess google could do it as they have with other things by simply stating that they will lower the page rank of any page from a network identified as allowing spoofed traffic.

When

World war 3 kicks off, the internet will need to be taken down or at least "handled",

They can't have the people on the ground exchanging information and certainly not anything factual or real-time.

There will probably be some level of residual "Internet" service as that will help the planning, if you know what people are concerned about you can tailor events to suit.

Nah, it's probably just a bug in Windows where the hosts file is being ignored.

Now everyone's machines are trying to resolve ad sites.

But I thought...

after watching the second Avengers movie that all Internet traffic was routed through a magical building in Oslo.... you mean to tell me that Scandinavia isn't the centre of the Internet?

Can we not send Tony Stark in to sort it all out?

Why do they need a reason for doing this other than the bragging rights of being able to say "I was the person that broken the Internet". Ok, they are probably / hopefully clever enough to not start telling people but if you were into this sort of thing wouldn't that be the ultimate prize?

Another possibility is that this is an attack by a nation state, probably the US, to test the resilience of the root servers / basic structure of the Internet. In the great scheme of things the attack was sort of pointless. The basic design of the DNS system is to be distributed and anyone attacking it will know that and would know that taking out a few root servers isn't going to have any effect. If you were a nation that wanted to find out how hard it was to take out the Internet though this is a very interesting experiment. You know how much traffic is needed and you know how well they can respond to the attack.