North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: official ISC statement concerning nonimpact on f-root from sqlworm

  • From: Sean Donelan
  • Date: Mon Jan 27 01:57:29 2003

On Mon, 27 Jan 2003, Paul Vixie wrote:
> i'd like to know who it is that couldn't reach 5 of the 13 servers, so if
> anyone on [email protected] has heard that, please tell me what you heard and who you
> heard it from so i can get to the bottom of it.

This appears to be the earliest "source" of the quote.

http://forums.military.com/1/OpenTopic?a=tpc&s=78919038&f=409192893&m=4551982416

F-Secure has also been also been widely quoted with the same statistic.

Since several root servers disabled ICMP after the last attack, I think
they mis-read the ping loss as servers being down.  5 root servers never
respond to ICMP.


I did DNS queries of all of the root servers several times throughout the
event.  Other than G, I was eventually able to get responses from all of
them.  Sometimes it took several seconds to get a response.  Folks have
reported they were able to reach servers through particular networks, but
not through other networks.  For example, a person sent me data showing
they could reach G through MFN, although I couldn't reach it through
several other networks.  I don't have a network connection on MFN.