<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2657.73">
<TITLE>RE: Above.net problems ??</TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>> Is there any relationship between this "europeanwide" </FONT>
<BR><FONT SIZE=2>> above.net failure and the huge amount of</FONT>
<BR><FONT SIZE=2>> DNS requests to lockup.zonelabs.com which failed that every </FONT>
<BR><FONT SIZE=2>> ISP (at least in France) seem to</FONT>
<BR><FONT SIZE=2>> have encountered last night ?</FONT>
<BR><FONT SIZE=2>> The zonelabs.com zone is hosted on Above.net NS servers. </FONT>
</P>
<P><FONT SIZE=2>The Netherlands were hit as well. We saw a massive flood of queries for lockup.zonelabs.com, too. It performed a nice DoS on our client name servers.... :-(</FONT></P>
<P><FONT SIZE=2>You'd think that an unresponsive nameserver would be flagged dead, and such information be cached. Does anyone know whether that's actually done in Bind 8.3.4? Or perhaps not by default?</FONT></P>
<P><FONT SIZE=2>Cheers,</FONT>
</P>
<P><FONT SIZE=2>Arjan H</FONT>
</P>
<BR>
<P><FONT SIZE=2>Not even a clue-by-four would work with this clown.</FONT>
<BR><FONT SIZE=2>________________________________</FONT>
<BR><FONT SIZE=2>dr. Arjan Hulsebos</FONT>
<BR><FONT SIZE=2>Security Engineer</FONT>
<BR><FONT SIZE=2>Essent Kabelcom, @Home Benelux department</FONT>
<BR><FONT SIZE=2>1042 AX Amsterdam</FONT>
<BR><FONT SIZE=2>Email: arjanh@corp.home.nl</FONT>
<BR><FONT SIZE=2>Tel: +31 20 88 55 407</FONT>
<BR><FONT SIZE=2>Mob: +31 6 21 548 777</FONT>
</P>
</BODY>
</HTML>