nanog mailing list archives
Re: official ISC statement concerning nonimpact on f-root from sql worm
From: Sean Donelan <sean () donelan com>
Date: Mon, 27 Jan 2003 01:54:48 -0500 (EST)
On Mon, 27 Jan 2003, Paul Vixie wrote:
i'd like to know who it is that couldn't reach 5 of the 13 servers, so if anyone on nanog@ has heard that, please tell me what you heard and who you heard it from so i can get to the bottom of it.
This appears to be the earliest "source" of the quote. http://forums.military.com/1/OpenTopic?a=tpc&s=78919038&f=409192893&m=4551982416 F-Secure has also been also been widely quoted with the same statistic. Since several root servers disabled ICMP after the last attack, I think they mis-read the ping loss as servers being down. 5 root servers never respond to ICMP. I did DNS queries of all of the root servers several times throughout the event. Other than G, I was eventually able to get responses from all of them. Sometimes it took several seconds to get a response. Folks have reported they were able to reach servers through particular networks, but not through other networks. For example, a person sent me data showing they could reach G through MFN, although I couldn't reach it through several other networks. I don't have a network connection on MFN.
Current thread:
- official ISC statement concerning nonimpact on f-root from sql worm Paul Vixie (Jan 26)
- Re: official ISC statement concerning nonimpact on f-root from sql worm Sean Donelan (Jan 26)
- Impact of MS SQL Worm on DNS Root Name Service on 25.1.2003 Daniel Karrenberg (Jan 26)