Rackspace restored after DDOS takes out DNS

[Aerosol]

Rackspace says it has recovered from a nasty distributed denial of service attack that it says may have seen “a portion of legitimate traffic to our DNS infrastructure … inadvertently blocked.”

The trouble started just before lunchtime on Monday, US central time, and persisted until 11 hours later.

Over on the company's Google+ page Rackspace warned of “intermittent periods of latency, packet loss, or connectivity failures when attempting to reach rackspace.com or subdomains within rackspace.com.”

The company's status report later confirmed it had “... identified a UDP DDoS attack targeting the DNS servers in our IAD, ORD, and LON data centers [North Virigina, Chicago and London]. As a result of this issue, authoritative DNS resolution for any new request to the DNS servers began to fail in the affected data centers. In order to stabilize the issue, our teams placed the impacted DNS infrastructure behind mitigation services. This service is designed to protect our infrastructure, however, due to the nature of the event, a portion of legitimate traffic to our DNS infrastructure may be inadvertently blocked. Our teams are actively working to mitigate the attack and provide service stability.”

Rackspace is now confident things are back in order, as it has blacklisted DNS servers that were “sending both legitimate and DDoS traffic to Rackspace”. Users may not be entirely out of the woods, as its most recent update says “If you continue to experience adverse impact, please reach out to your support teams and provide trace route information for further investigations.”

A full root cause analysis of the incident is under way.

Source

[Pacalici]

S-a resimtit sanatos. Foarte mult in Europa si pe coasta de est. RDS ca de obicei a avut primu parte de erorile de conexiune cu cei de la Rackspace.

[quantum]

S-a resimtit sanatos. Foarte mult in Europa si pe coasta de est. RDS ca de obicei a avut primu parte de erorile de conexiune cu cei de la Rackspace.

Se vede ca habar nu ai cum functioneze un server de dns cache. Iti dau un exemplu.

Iti cumperi un domeni de pacalici.com si setezi

eu.habar.nu.am.cum.functioneaza.dns.pacalici.com --> 1.2.3.4.

Serverele de dns cache poate au setat un cache mic sau un cache mare de ex 1 saptamana.

Spune-mi cum iti convine tie mai bine ca serverele de dns sa iti rezolve intrarea ta de dns eu.habar.nu.am.cum.functioneaza.dns.pacalici.com in cateva minute sau 1 saptamana ?

Daca nu iti convine cache-ul mic de la google sau rds atunci cauta-ti alte servere care au cache de 1 saptmana si o sa astepti 1 saptamana pana ce o modificare de dns se va propaga si la tine.

S-a resimtit la rds si alti provideri care au setat un ttl mic in dns cache, la cei care au setat de ex 24h pentru a face refresh la cache nu s-a resimtit.

Apropo prefer providerii care au dns cache cu un timp cat mai scurt. In caz de o modificare in setarile din domeniul meu prefer sa se vada instant si nu dupa 1 saptamana.

Edited December 24, 2014 by quantum

[Pacalici]

Multam de explicatii. N-am zis ca am habar. Makes more sense now.