Subject: RE: DNS Server DoS Attacks

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 25 Nov 2002 09:58:16 -0800

> I'm having a little trouble with this logic.  You made two 
> speculations,
> with no evidence, and now you wish to shift the burden of proof for
> those speculations to someone else?

It depends what you consider the hypothesis to be. The one I thought
we were considering was the statements made by the measurement sites.

I was pointing out that they can be contaminated by a number of sources.
That is why I said that "There may also have been measurement
problems..."

If I had intended to claim that the effects hypothesised definitively 
happened I would have said "There were also". 

Try reading before you flame.

The measurements from the measurement sites plus your own observations
show a discrepancy. The measurement sites I saw had something like 7
sites
offline. You say you have data showing responses from 10 of the servers.

Thus there is a discrepancy of 4 servers to be accounted for and an 
indication that the effect was dependent on the observation point.

The precise cause of the result is irrelevant, the only conclusions we 
can draw are that the measurements from the sites were not sound and
that we should build measurement systems that are not subject to the 
possible sources of contamination described.

		Phill

---

From: "John S. Quarterman" <[email-masked]>
Date: Mon, 25 Nov 2002 12:48:25 -0600

Jon Postel used to have a rule that no one should post to namedroppers
more than once a day.  The wisdom of that rule has become evident in
this thread.  This will be my last post on this subject today.

> indication that the effect was dependent on the observation point.

As I said, I have regular responses during that period from 10 DNS root
servers and regular pings with no responses for the other 3.
I think 10 + 3 = 13 total root DNS servers.

The data I am referring to was publicly visible at the time via
 http://average.matrix.net/dns-root/

That data for each DNS root server was collected from half a dozen
different observation points, not one.

It's hard to tell what you mean by "the measurement sites".
I'd be happy hold a conversation about them, but that's not
possible without any specifics.

> possible sources of contamination described.

Indeed, we took such considerations into account when we constructed
our services.  I don't know about "the sites".

> 		Phill

-jsq

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>