34 ms·

For me redirecting my DNS to Google public DNS 8.8.8.8 and 8.8.4.4 did the trick.

by altyus 10y ago

mbym 10y ago
Same story for me here today (reporting from Cork, Ireland)
- dankohn1 10y ago
  I'm a Verizon FIOS customer in NYC and was unable to reach nytimes.com and several other sites this morning. Switching my DNS to Google's (8.8.8.8 and 8.8.4.4) seemed to fix the problem, but I don't understand why yet.
bpicolo 10y ago
I was on Google dns until I joined my VPN a bit ago. The public DNS was failing to hit lots of things. (NY, USA)
dijit 10y ago
that's not going to help much if the authoritative name servers (which is what dyn is, btw) go down for more than a day. Max record cache time is 86400s (24h), so if the attackers can keep it down for 24h then google will have to have custom instructions in place (or cache more aggressively than the RFC allows)
- wongarsu 10y ago
  Since the attacked dyndns DNS servers are evidently anycast, the google server you are reaching might connect to a different dyndns server than you do. If google has luck to reach a less overloaded server, they might get an answer where you get none.
  - TurningCanadian 10y ago
    Side note: In addition, Google Public DNS engineers have proposed a technical solution called EDNS Client Subnet. This proposal allows resolvers to pass in part of the client's IP address (the first 24/64 bits or less for IPv4/IPv6 respectively) as the source IP in the DNS message, so that name servers can return optimized results based on the user's location rather than that of the resolver. To date, we have deployed an implementation of the proposal for many large CDNs (including Akamai) and Google properties. The majority of geo-sensitive domain names are already covered. from https://developers.google.com/speed/public-dns/faq https://developers.google.com/speed/public-dns/faq
- honkhonkpants 10y ago
  Is there any reason why Dyn has to be "down" from Google's perspective? Is it possible that the large DNS providers maintain private network between each other, such that DDoS attacks that are effective against the public are ineffective against the private network?
deleted 10y ago
[deleted]
aeharding 10y ago
Not only does it work (for now), many of the sites that are "down" are noticeably faster. :-)
- elwell 10y ago
  less users connected
j_s 10y ago
I added the following to my hosts file for today: #8:07 AM 10/21/2016 199.16.156.70 twitter.com 104.244.43.231 abs.twimg.com 104.244.43.231 pbs.twimg.com 192.30.253.113 github.com 151.101.24.133 assets-cdn.github.com after giving up on modifying DNS timeouts. https://blogs.technet.microsoft.com/stdqry/2011/12/14/dns-clients-and-timeouts-part-2/ https://blogs.technet.microsoft.com/stdqry/2011/12/14/dns-cl...

For me redirecting my DNS to Google public DNS 8.8.8.8 and 8.8.4.4 did the trick.

by altyus 10y ago

For me redirecting my DNS to Google public DNS 8.8.8.8 and 8.8.4.4 did the trick.

mbym 10y ago

Same story for me here today (reporting from Cork, Ireland)

dankohn1 10y ago
I'm a Verizon FIOS customer in NYC and was unable to reach nytimes.com and several other sites this morning. Switching my DNS to Google's (8.8.8.8 and 8.8.4.4) seemed to fix the problem, but I don't understand why yet.

bpicolo 10y ago

I was on Google dns until I joined my VPN a bit ago. The public DNS was failing to hit lots of things. (NY, USA)

dijit 10y ago

that's not going to help much if the authoritative name servers (which is what dyn is, btw) go down for more than a day. Max record cache time is 86400s (24h), so if the attackers can keep it down for 24h then google will have to have custom instructions in place (or cache more aggressively than the RFC allows)

wongarsu 10y ago
Since the attacked dyndns DNS servers are evidently anycast, the google server you are reaching might connect to a different dyndns server than you do. If google has luck to reach a less overloaded server, they might get an answer where you get none.
- TurningCanadian 10y ago
  Side note: In addition, Google Public DNS engineers have proposed a technical solution called EDNS Client Subnet. This proposal allows resolvers to pass in part of the client's IP address (the first 24/64 bits or less for IPv4/IPv6 respectively) as the source IP in the DNS message, so that name servers can return optimized results based on the user's location rather than that of the resolver. To date, we have deployed an implementation of the proposal for many large CDNs (including Akamai) and Google properties. The majority of geo-sensitive domain names are already covered. from https://developers.google.com/speed/public-dns/faq https://developers.google.com/speed/public-dns/faq
honkhonkpants 10y ago
Is there any reason why Dyn has to be "down" from Google's perspective? Is it possible that the large DNS providers maintain private network between each other, such that DDoS attacks that are effective against the public are ineffective against the private network?

deleted 10y ago

[deleted]

aeharding 10y ago

Not only does it work (for now), many of the sites that are "down" are noticeably faster. :-)

elwell 10y ago
less users connected

j_s 10y ago

I added the following to my hosts file for today: #8:07 AM 10/21/2016 199.16.156.70 twitter.com 104.244.43.231 abs.twimg.com 104.244.43.231 pbs.twimg.com 192.30.253.113 github.com 151.101.24.133 assets-cdn.github.com after giving up on modifying DNS timeouts. https://blogs.technet.microsoft.com/stdqry/2011/12/14/dns-clients-and-timeouts-part-2/ https://blogs.technet.microsoft.com/stdqry/2011/12/14/dns-cl...