Memory leak cause of Comcast DNS problems

Mon Apr 18 17:13:49 UTC 2005

Several of the servers that were down are not BIND, at least these:

prospero:~/Desktop/fpdns-0.9.1 dgold$ ./fpdns.pl 68.87.66.196
fingerprint (68.87.66.196, 68.87.66.196): Cisco CNR

I ran fpdns against them between outages. They now respond differently.

prospero:~/Desktop/fpdns-0.9.1 dgold$ ./fpdns.pl 68.87.66.196
fingerprint (68.87.66.196, 68.87.66.196):
q0r?1,IQUERY,0,0,1,1,0,0,REFUSED,0,0,0,0

These are the Comcast "national" DNS servers. (I am using plural, because
there are several reverse DNS entries for this IP address -
ns.cmc.co.denver.comcast.net and ns.inflow.pa.bo.comcast.net)

I wouldn't rush to blame BIND for this. For purposes of investigation, does
anyone have DNS servers from those periods of downtime other than the ones
above? Comcast is quite a patchwork, that's to the incomplete integrations
of MediaOne, AT&T Broadband, etc.

It would be interesting to see data on other DNS servers during the downtime
periods. Many folks on various forums were suggesting the use of ns1. And
ns2.level3. Of course, logic suggests that the vast majority of folks,
having no Internet access, could not have read the advice.

----

There have been three explanations given for the outage -

1) Upgrade issues
2) Memory leak/software issue
3) DDoS

There is also the possibility of some combination of the above. There are a
number of possible permutations.

- Dan

On 4/17/05 2:18 PM, "Steven M. Bellovin" <smb at cs.columbia.edu> wrote:

> 
> In message <20050417.100203.11740.378954 at webmail23.lax.untd.com>, "Fergie
> (Paul
>  Ferguson)" writes:
>> 
>> 
>> Not to my knowledge, or at least, none that has been
>> publicly acknowledged.
>> 
>>> From a Washington Post article yesterday (posted via Yahoo!
>> News), Comcast said that the problem manifested itself when
>> they were in the process of upgrading their DNS servers:
>> 
>> 
http://story.news.yahoo.com/news?tmpl=story&ncid=1212&e=3&u=/washpost/2005041>>
6
>> /tc_washpost/a56223_2005apr15&sid=96168964
>> 
> 
> 
> At least in my neighborhood, Comcast appears to be running BIND 9.2.4rc6
> 
> --Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb
> 
> 

-- 
Daniel Golding
Network and Telecommunications Strategies
Burton Group