Re: SCO: ISPs are blocking our site Blake Stowell

From: Joe Dunning (joe_at_blahblah.invalid)
Date: 02/02/04 

Date: Mon, 02 Feb 2004 18:37:51 GMT

On Mon, 02 Feb 2004 14:05:00 GMT, Bill Vermillion <bv@wjv.comREMOVE> wrote:
>In article <SDmTb.207681$xy6.1063854@attbi_s02>,
>Joe Dunning <joedunning1234_removethis@hotmail.com> wrote:
>>On Mon, 02 Feb 2004 06:55:29 GMT, Scott Burns <scott@mirrabooka.com> wrote:
>>>Daeron wrote:
>>>
>>>>Feb 01 2004
>>>>
>>>>"There are Internet service providers around the world who are
>>>>blocking access to SCO," company spokesman Blake Stowell said, adding
>>>>it was because they believe they can limit exposure to the virus that
>>>>way.
>>>
>>>It seems that the way they protected themselves was to remove the DNS
>>>entry for www.sco.com - it is unresolvable but sco.com is still there.
>>> I don't think ISPs had anything to do with it.
>
>>The one analysis that I read showed the the virus only attempted to
>>resolve www.sco.com -- it did not do a DDoS. So, removing www.sco.com
>>will actually result in more load, not less, because the ISPs'
>>nameservers won't be able to cache the data for www.sco.com
>
>There have been many articles on this on the NANOG list in the last
>day. But when you say that it will give a higher load because the
>domain is not there, that should not be. What will happen would be
>like this:
>
>*** ns1.xxxxxx.net can't find www.sco.com: Non-existent host/domain
>Server: ns1.xxxxxx.net
>Address: xx.xxx.xxx.11
>
>[That's a nameserver I maintain and no reason to publish it to the
>world - but a rewrite of the file to use the provider on this DSL
>gives this]
>
>*** ns1.sprintlink.net can't find www.sco.com: Non-existent host/domain
>Server: ns1.sprintlink.net
>Address: 204.117.214.10

Yes, but each time you do this, I think your ISP's nameserver contacts
SCO's nameservers to try to resolve www.sco.com. On the other hand, if,
www.sco.com resolved to 127.0.0.1 with a TTL of 3600, the ISP's
nameserver would perform the lookup only once per hour.

>
>So the lookup stops right there. [I used nslookup and not dig just
>for the more compact output for this post].

I'm not sure what you mean by "the lookup stops right there". Your
machine is asking your ISP's nameserver to resolve www.sco.com and your
ISP's nameserver is returning the information that it does not exist,
however, in order to do this, your ISP's nameserver has to contact one
of SCO's nameservers each time.

Relevant Pages

  • Re: Linux wont find websites
    ... > forever to load. ... I run Red Hat Enterprise Linux 3 ES, including a nameserver ... Traceroute under linux ... I know nothing about Slackware 10, and have never run Fedora, ...
    (comp.os.linux.misc)
  • Re: Determine Causes of Slowdown
    ... Now check for name lookups or net bandwidth congestion, ... nameserver gets overloaded at times -- usually end of business ... For example I had name lookup failures (web pages fail to load, ...
    (comp.os.linux.networking)
  • Re: resolver problem
    ... If this isn't a Linux distro of some sort, ... nameserver 1.2.3.4 ... domain name of wherever you are, and if you try to resolve "machine", ... your DNS machine, talk to your sysadmin and find out. ...
    (comp.os.linux.networking)
  • Re: resolver problem
    ... If this isn't a Linux distro of some sort, ... nameserver 1.2.3.4 ... domain name of wherever you are, and if you try to resolve "machine", ... your DNS machine, talk to your sysadmin and find out. ...
    (comp.os.linux.misc)
  • Re: Re.: Modem Problem.
    ... hostname into /etc/hosts. ... starting when the systems tries to boot. ... If your system can not resolve the FULL hostname from the /etc/hosts file, ... The nameserver has to be reachable NOW ...
    (comp.os.linux.misc)