1

Would such huge DDoS attack can cause any economical damage? How severe this DDoS attack would be, if all 13 Root DNS servers got successfully DDoSed/flooded and taken out? Would any websites even load, even if it would happen??

How much data would be needed to make such big DDoS attack? How large this DDoS attack would be in its peak?

closed as too broad by PwdRsch, Marcus Müller, Xander, Steve, CaffeineAddiction Feb 21 '17 at 20:32

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Each DNS "root server" is actually a network of hundreds of servers, isn't it? There's no single server to take down, is there? – PoloHoleSet Feb 21 '17 at 19:07
  • 3
    Literally every of the five sentences in your question ends with a question mark. It's good that you're curious, but one at a time please. – J.A.K. Feb 21 '17 at 19:10
0

It probably wouldn't be as horrible as you'd think.

First of all, the Domain Name System is a critical part of the Internet and DNS root servers are at the top of the hierarchy as they fulfill requests for the root zone. So, if you want to determine the IP address for a domain name (e.g. security.stackexchange.com) your very first step would be asking a root server for the authoritative name server of the .com TLD. Then you would go further down the hierarchy until you have resolved the name to an IP address.

In theory this means that without root servers, domain name resolution would fail globally, making major parts of the Internet unavailable -- but:

  • There is lots of caching and redundancy. A root server outage wouldn't be immediately result in servers becoming unavailable as your operating system as well as intermediate DNS servers all maintain their own caches, so they don't have to repeatedly issue the same requests. It would take some time until these entries expire and the queries actually fail. Caching is also the reason why the root servers actually only receive a moderate amount of requests.

  • Network administrators (and ISPs) can take easy countermeasures by maintaining their own copy of the root zone file, which then wouldn't be updated but could substitute the purpose of the root servers during an outage without noticeable impact on their users.

Also, the root server infrastructure is very robust, as concluded after the DDoS incident in 2015 (although the attack could have been made much worse using amplification techniques). While "13 root servers" doesn't sound like a lot, there are actually globally distributed server farms behind it (the root servers use Anycast routing):

In fact, each “server” actually consists of a server farm of many physical servers in multiple locations, for reliability. Server L, for example, is mirrored in 128 locations in 127 towns and cities (San Jose, California, hosts two instances) in 68 countries, from Argentina to Yemen. enter image description here

(Source)