4 ms·

Possibly testing or demonstrating a botnet. I doubt the goal was to actually bring down the DNS root servers. That's been tried before and it's never even made

Possibly testing or demonstrating a botnet. I doubt the goal was to actually bring down the DNS root servers. That's been tried before and it's never even made a blip - the system is massively over-provisioned, for good reason.

effie 11y ago
I wonder, what kind of machines are those? How many of those are currently operating, and where?
- robryk 11y ago
  Every (almost every?) letter is operated by a different organization, so I'd expect the setups to be different.
- Corrado 11y ago
  http://www.root-servers.org/ http://www.root-servers.org/ has the answers you seek. There are currently 13 root servers operated by 12 different entities (Verizon, NASAN, RIPE, ICANN, etc.) and most locations have multiple sites (physical instances).
  - effie 11y ago
    Thanks.
- ytjohn 11y ago
  When things first started, a root server might have actually been something sitting under Jon Postel's desk, or in the back room of a University. But these days, root "servers" are geographically load balanced clusters of machines. Think of something like the Akamai CDN, but instead of http(s), this CDN serves up mostly UDP/53 and TCP/53 traffic. The IP for a root server is AnyCast, and the root server operators will balance traffic between sites by adjusting BGP. Most have built their own custom UDP load balancers at each site and behind those load balancers are several hundred physical servers to respond to the incoming queries. Zone updates are pushed to each site from the back office, so each physical server should have a complete copy of the the "." zone. A root server operator, operating 1 of the world's 13 largest public udp system, is often under attack, either directly or (as mentioned above), used as part of a reflector attack against someone else. Generally speaking, these systems are over provisioned enough so that a direct attack has minimal impact. But reflector attacks are the main concern. Either way, when an attack starts, the operator has to find something unique in the query itself (as eliminating source addresses in a dddos is nigh impossible), create a filtering rule, and push that to all of their load balancers. Disclaimer: I used to work for a root server org.

effie 11y ago

I wonder, what kind of machines are those? How many of those are currently operating, and where?

robryk 11y ago
Every (almost every?) letter is operated by a different organization, so I'd expect the setups to be different.
Corrado 11y ago
http://www.root-servers.org/ http://www.root-servers.org/ has the answers you seek. There are currently 13 root servers operated by 12 different entities (Verizon, NASAN, RIPE, ICANN, etc.) and most locations have multiple sites (physical instances).
- effie 11y ago
  Thanks.
ytjohn 11y ago
When things first started, a root server might have actually been something sitting under Jon Postel's desk, or in the back room of a University. But these days, root "servers" are geographically load balanced clusters of machines. Think of something like the Akamai CDN, but instead of http(s), this CDN serves up mostly UDP/53 and TCP/53 traffic. The IP for a root server is AnyCast, and the root server operators will balance traffic between sites by adjusting BGP. Most have built their own custom UDP load balancers at each site and behind those load balancers are several hundred physical servers to respond to the incoming queries. Zone updates are pushed to each site from the back office, so each physical server should have a complete copy of the the "." zone. A root server operator, operating 1 of the world's 13 largest public udp system, is often under attack, either directly or (as mentioned above), used as part of a reflector attack against someone else. Generally speaking, these systems are over provisioned enough so that a direct attack has minimal impact. But reflector attacks are the main concern. Either way, when an attack starts, the operator has to find something unique in the query itself (as eliminating source addresses in a dddos is nigh impossible), create a filtering rule, and push that to all of their load balancers. Disclaimer: I used to work for a root server org.