North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Akamai DNS Issue?

  • From: Joe Abley
  • Date: Wed Jun 16 10:01:33 2004 
On 15 Jun 2004, at 21:28, Stewart, William C (Bill), RTSLS wrote:
Daniel Golding suggested that the problem was that many folks are sharing Akamai's magic DNS algorithms.
This doesn't appear to be a problem with magic algorithms - it appears that they're sharing the _servers_,
and that the reported attack on the servers means that it doesn't matter how magic the algorithms are.
Good luck to them on developing a longer-term workaround for the next attack.
Workarounds and defences already exist, and have been in use for a long time.

The chance of catastrophic, systematic operator error (e.g. rdist gone wild, RIF-frenzied, root-wielding, caffeine-crazed sysadmins run amok) problems can be avoided by including nameservers managed by different organisations in the NS set.

Distributed (and non-distributed) denial of service attacks can be mitigated using dispersed anycast nameserver deployment.

Network partition/isolation events (e.g. under sea cable failures which isolate an economy) can be mitigated by strategic location of (anycast instances of) locally-relevant nameservers.

Operational routing and instrumentation challenges with managing a dispersed anycast deployment can be mitigated by including non-anycast nameservers in the NS set alongside the anycast nameservers.

Failures due to ancillary equipment failure can be avoided by eliminating single points of failure (e.g. wide geographic disperson of nameservers into topologically-distant infrastructure).

Failures due to political interference can be avoided by deploying nameservers in complementary regions of governance.

Failures or vulnerabilities in individual DNS implementations can be mitigated by ensuring that not all nameservers in the NS set run the same DNS software (or similar software, developed from a common code base).

Failures or vulnerabilities in ancillary software (routers, switches, operating systems, etc) can be mitigated by ensuring that different nameservers rely on different brands of routers, switches and operating systems.

Failures in master servers can be mitigated by having several of them; simultaneous failure of all master servers can be managed to some degree using appropriate SOA timers, so that slave servers provide coverage while master servers are brought back into service.

Different styles of attack can be mitigated by different DNS hosting strategies. A robustly-hosted zone will have an NS set that exhibits several or all of these approaches (and others too).

The hosting of the root zone provides guidance, here.


Joe