[dns-operations] sudden influx of com. IN A queries to the roots

[Mehmet Akcin]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stefan,

L-Root has been receiving what seems like a storm of A queries for a .com domain name from multiple hosts which also seems like mostly from same region/country.

L-Root operations team is closely monitoring the situation. We've also contacted with the ISPs NOC/Abuse desks informing them what's going on.

If you have any questions, please don't hesitate to contact us.

Mehmet Akcin 
mehmet at icann.org
DNS Operations Manager
ICANN
 
Web: http://dns.icann.org
7/24 NOC: +1.424.217.1313
Mobile: +1.424.298.1903
Twitter: ICANNDNSops

PGP: 7CB1 A922 FD2A 81C4 0737  DF4B E75D DD05 B923 4274

On Jun 29, 2011, at 1:02 AM, Stefan Schmidt wrote:

> Dear list,
> 
> a few hours ago i stumbled upon a sudden influx of what seems to be
> quite some IN A queries for some .com queries to the roots in various
> root-servers.org statistics pages, namely l, k, h and m.
> l.root's DSC [1] shows a sudden influx of roughly 40kqps since around
> 16-17:00 UTC that looks to be mostly for IN A [2] returning NOERROR
> [3] and directed to .com or below [4].
> h.root [5] and m.root [6] also shows additional pps coming in and
> k.root [7] even has the curve on the rise which might suggest it being
> related to clients waking up in europe and interestingly enough only
> the LINX instance is seeing it.
> Any root operators who might care to elaborate?
> 
> Stefan
> 
> [1] http://dns.icann.org/cgi-bin/dsc-grapher.pl?window=86400&plot=qtype_vs_all_tld&server=L-root
> [2] http://zaphods.net/dsc-qtype.png # made a copy in case [1] gets overloaded.
> [3] http://zaphods.net/dsc-rcode.png
> [4] http://zaphods.net/dsc-tlds.png
> [5] http://h.root-servers.org/
> [6] http://m.root-servers.org/
> [7] http://k.root-servers.org/
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
> dns-jobs mailing list
> https://lists.dns-oarc.net/mailman/listinfo/dns-jobs



-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.12 (Darwin)

iQIbBAEBAgAGBQJOCuNBAAoJEOdd3QW5I0J0FKIP+L8a5GpttJbTpq9I5cGFezmW
zBXXaOfRLKQo7FB9l039WMZMxnBhVaBO7tafJvZhxuT/XzBCDI29WKLG+mmyLqEB
HepRyy+i+O2zUKZOaY3I9SJy6xVvAVVf9BSvubosXTHfmr/luQ1ZruBkTMAD8caO
WJnfhIXdC7QsKb84A8XTgH1B+ldRNotFhkpUR8A5NDZYKEOYE8aKHrB5uY3/G4wM
l1EJGnY8TQ+W/7X0XvBPx+fEXUOaxmXgRYDgiJ4daAHb8bydQJconKLa27wb+ZHp
lHPuOsWL55zW0lXvO3smzvThUOw6O1FRc/5LkQlXbQF/iwX67EBn1nykyr91WR1m
0M0wuZ/5A/JN+Q53VUsY+DSslGAKTfcWaPp6qkxkFSgFs2dIE5Zi8WYTdkqpyXsp
GebUvSzDOCea64jkHwCQgJpzfNPAXCGSgshaXdjqkEdo8yb3soJA+HcXEOQpZ23F
IqwT90ABsBvtNBuyWRseRjx+4CF8eg10mBkx/3CvCuzaTVXQIcBib9e1pZoTvx7P
Qx6TOx/YDK4Gytff8Oi1SJOs0sEHEJfGD5vhIJaTdNNxjq1ywkkDywFvFv6x/YxM
uvk6h7v7R1huIaTO3eCqgm7dkGyG5EdKICM+VUT7j70zF0QymhUErAumqj1O5+Ih
boloh0b1HEgTMOlIKL0=
=PRYI
-----END PGP SIGNATURE-----