Last Month's Root-Server Attack Revisited Register (UK) (03/09/07) Goodin, Dan
as it appeared in the March 12, 2007 edition of ACM TechNews.
A factsheet released by ICANN shows that the Feb. 6 DDoS attack on six or more of the Internet's root servers only damaged two of the servers, both of which lacked a protective new load-balancing technology called Anycast. All of the other servers that were attacked had Anycast installed. ICANN's document states: "Anycast allows a number of servers in different places to act as if they are in the same place. So while there remains 13 locations on the network for root servers, the reality on the ground is that not only are there often dozens at one spot but dozens of servers in other locations that can also deal with requests." The Feb. 6 attack was a two-pronged assault, with the first assault lasting 2.5 hours and the second lasting five hours. Hundreds of zombies were responsible for the attacks, and while it is impossible to determine the geographic location of the attackers, experts believe they came from Korea or another location in the Asia Pacific region. The G-root (run by the U.S. Department of Defense and located in Ohio) and the L-root (run by ICANN and located in California) were damaged in the attack. Three other servers have yet to implement Anycast, but it is expected that they will now do so. Click Here to View Full Article
