4 ms·
am i correct in interpreting this as almost equivalent to a DDoS attack on DNS providers?
by htrp 5y ago
am i correct in interpreting this as almost equivalent to a DDoS attack on DNS providers?
- universenz 5y agoFurther to this, doesn't Chrome and Safari quietly auto-ping/reload pages that "fail to connect" if they're left open in a tab or browser?
- yawaworht1978 5y agoHow often do the apps try to reconnect? Does anyone know?
- vakabus 5y agoI've launched Wireshark monitoring DNS traffic of roughly 5 phones. I've collected 19.8k DNS packets so far. Out of that, 5.1k packets are flagged with REFUSED or SERVFAIL. If I am not mistaken, it means that 51% of DNS requests fail. Looking at queries for graph.instagram.com, it looks like there are roughly 20 attempts in a sequence before it gives up. All in all, this could probably explain doubling of the DNS traffic. But the sample is rather small, so take it with a grain of salt.
- dotancohen 5y ago5.1 / 19.8 is much closer to a quarter than to half. But your point is still just as poignant at ~25% as it is at 51%.
- profile53 5y agoI think those are DNS round trips. So 1 packet to request and 1 to respond. E.g. 9.9k total requests of which 5.1k fail.
- samhw 5y agoEquivalent how? In volume? In intention?
- colpabar 5y agoSort of, yeah. Typically a DDoS attack is done on purpose, this is a side effect of so many clients utilizing retry strategies for failed requests. But in both cases, a lot of requests are being made, which is how a DDoS attack works.
- thepasswordis 5y agoYes. It's basically turned every device, especially mobile devices with the app running in the background, into botnet clients which are continually hitting their DNS servers. I don't know what facebook's DNS cache expiration interval was, but assume it's 1 day. Now multiply the load on the DNS that those facebook users put by whatever polling interval the apps use. And then remember what percentage of internet traffic (requests, not bandwidth) facebook, whatsapp, and instagram make up. It's kindof beautiful.
- reaperducer 5y agoIt's basically turned every device, especially mobile devices with the app running in the background, into botnet clients which are continually hitting their DNS servers Anecdotally, it also seems to be draining the batteries of those devices with all of those extra queries. At least that seems to be what's happening on my wife's phone.
- notyourday 5y ago... and the facebook SDK. Every single app that has facebook SDK is blowing up now.
- wozer 5y agoNow I'm a bit worried. Could this bring down the whole internet for a while?
- gpvos 5y agoI read it brought down the Vodafone network in Czechia, one of the major providers there.
- _jstreet 5y agoI'm fairly certain that my ISP was affected by this causing an outage of all internet traffic for my network. So it seems possible, although I imagine using an alternate DNS provider should work ok (if they're not overrun by extra traffic)? Unfortunately I'm not sure what the default DNS on the modem points to..