We experience an increased query load on K-root, the root server operated by the RIPE NCC. See below some analysis and graphs showing the traffic on K-root and other root servers.
Since 28 June at approximately 17:00 (UTC), we observe an increased number of queries on K-root and other root servers. In Figure 1 below, you can see the number of queries per second seen at all K-root global nodes.
Figure 1: Number of queries per second seen at all K-root global nodes since yesterday
We see around 40,000 - 50,000 queries per second more than usual which is about four times the normal traffic load on the system.
You can see traffic shifting from AMS-IX (Amsterdam) to LINX (London) shortly before 20:00 hours UTC. We intiated this shift in order to gather data about the traffic source.
We are not yet sure what causes this increased query load, but we are in contact with ISPs that are carrying this traffic in order to investigate further. The root name server operators are coordinating observations and keeping a close eye on the developments. We update once we have more information.
Below you can see a series of DNSMON graphs that show how this incident affected the responsiveness of each of the root name servers.
Figure 2: IPv4 unanswered queries for domain 'root' from 60 probes (Average)
- Yellow = less than 66% of queries on average do not receive a response
- Orange = more than 66% and less than 90% of all queries do not receive a response
- Red = more than 90% of the queries do not receive a response
Figure 3: K-root server
- Horizontal = only single measurement nodes saw a problem
- Vertical = most of the measurement nodes saw a problem
It is important to note that these measurements show that the root zone is fully available even though some root name servers show degraded performance. We expect no noticeable degradation of any Internet services caused by this.