<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Hello Romeo,</div><p class="airmail_on">On 30 November 2015 at 12:05:03, Romeo Zwart (<a href="mailto:romeo.zwart@ripe.net">romeo.zwart@ripe.net</a>) wrote:</p> <div><blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><div><div></div><div>Dear colleagues,<span class="Apple-converted-space"> </span><br><br>Between about 07:00 and 09:15 UTC today multiple root operators<span class="Apple-converted-space"> </span><br>including K-root were receiving an unusually large amount of query<span class="Apple-converted-space"> </span><br>packets. This was impacting the overall performance of K-root DNS<span class="Apple-converted-space"> </span><br>services, as can be seen for example in DNSMON (with apologies for the<span class="Apple-converted-space"> </span><br>unpleasant URL below):<span class="Apple-converted-space"> </span><br><br>https://atlas.ripe.net/dnsmon/group/k-root?dnsmon.session.color_range_pls=0-30-30-70-100&dnsmon.session.exclude-errors=true&dnsmon.type=server-probes&dnsmon.zone=k-root&dnsmon.startTime=1448835600&dnsmon.endTime=1448877600&dnsmon.ipVersion=both&dnsmon.server=193.0.14.129<span class="Apple-converted-space"> </span><br><br>After initial investigation, the RIPE NCC took counter-measures during<span class="Apple-converted-space"> </span><br>the incident. The results of these measures are partially visible in<span class="Apple-converted-space"> </span><br>DNSMON. The full effect of the mitigations implemented roughly coincided<span class="Apple-converted-space"> </span><br>with the end of the event.<span class="Apple-converted-space"> </span><br><br>We will investigate the events and the effectiveness of our response<span class="Apple-converted-space"> </span><br>further and report about this in the near future.<span class="Apple-converted-space"> </span></div></div></span></blockquote></div><p>Thanks for the heads-up - would be interesting to know which countermeasures you implemented?</p><p>Cheers,</p><p>— </p><p>Nico</p></body></html>