noticeboard.ru.ac.za

At approximately 11PM last night, the University's two DNS servers came under a sustained denial of service attack. The DNS servers are responsible for translating computer names into IP addresses, and without them, it becomes difficult or impossible to access network resources.

The servers responsible also provide DHCP responses, and are thus responsible for allocating IP addresses to computers on the local network. It is possible that this resulted in some desktop PCs and phones being unable to obtain an IP address.

The source of the denial of service was isolated at about 9.15AM this morning, and thus things are slowly starting to recover. People who's PC or telephone is not working should first attempt to reboot them.

For interest, at the peak of this attack the two DNS servers were seeing a combined total of 1Gbps of DNS traffic, or approximately 25,000 requests per second. The attack was originated internally, from a computer that was most likely compromised. Thus the scope of the attack was limited only by the speed of the port that the computer in question was connected to.