Arbor Networks: Security to the Core

We got curious to see if there was an effect from the Internet scale DNS patching going on. Our Internet statistics system suggests … no.

Internet-wide DNS traffic, 1 week

Those spikes? We are pretty sure those are massive DNS attacks.

In short, we’re not seeing a significant change in DNS traffic from before the patching to after the patching (ie as resolvers reprime their caches post restart).

UPDATE July 15 I should note where this data comes from. We’re working with more than 60 tier-1 backbone ISPs who are active participants in sharing aggregate, flow-level summaries of traffic around the world to build Internet-wide visibility into attacks and backbone traffic. This traffic is all inter-domain traffic, crossing ISP peering points. Many thanks to the engineering team who put this view together.

Related articles by Zemanta

• DNS Hole Doesn’t Go Unnoticed
• Explainer: The glitch
• Patch domain name servers now, says DNS inventor

This entry was posted on Monday, July 14th, 2008 at 3:59 pm and is filed under Arbor Networks, Critical Infrastructure, Interesting Research, Policy, Vulnerabilities. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.