Hacker News new | past | comments | ask | show | jobs | submit login

Surely there are a number of resolvers who have a cold cache.

But yes, even taking down every root server (temporarily) has a limited effect.




We're not talking about taking down the root servers, we're talking about the root servers mitigating the attack by dropping requests for that specific .com domain name.

That would have no effect on any recursive resolver that had the .com nameservers cached, which is substantially all of them because it happens as soon as they resolve any other .com domain name. That happens immediately and continuously even for small nameservers.

You would have a window of under a second once every TTL (currently 48 hours for gtld-servers.net, the nameservers for .com) between when the cached entry expires and when the next request for some other .com domain name comes in and refreshes it with a request to the root servers that they'd actually answer.


> dropping requests for that specific .com domain name

To do that, you have to accept client traffic, and parse the request. The only thing you "drop" is sending the response. It is not a very efficient mitigation mechanism, the DNS server would still become unavailable under pressure. It also hurts the victim, which is senseless.


DNS has a design flaw where the responses are often much larger than the requests, so dropping the response could reduce bandwidth use by a factor of ten or more.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: