Network Solutions under DoS attack
Click here to read more about SpamStopsHere, the e-mail security company that brings you this blog.
Monday afternoon, our many servers hosted at SoftLayer, one of the fastest growing data center companies in the U.S. started being unable to resolve names using Nework Solutions‘ nameservers at worldnic.com. In addition, our e-mail servers at SoftLayer were unable to connect to Network Solutions’ hosted e-mail services at netsolmail.com to deliver e-mail. SoftLayer claims that Network Solutions is undergoing a DoS attack.
In this type of attack, where DoS stands for Denial of Service, the attacker typically floods a public service with more traffic than the service can handle, making the service unavailable to any legitimate users.
A lot of old established companies have had their domain names registered with Network Solutions since Network Solutions was the only available domain name registrar. Some of these established companies have even started to rely on the DNS services provided by Network Solutions as part of their domain name registration service. In addition, Network Solutions started offering e-mail hosting, likely to compete with other domain name registrars that were offering similar services.
Unfortunately, according to SoftLayer’s technicians, Network Solutions has been undergoing a heavy Denial of Service attack which has made their e-mail and DNS services unavailable to large portions of the Internet. NetSol are apparently making demands on large data center providers, including SoftLayer, for help with isolating the source. “Currently the attacker is spoofing the source addresses making it quite difficult to track down. As such Network Solutions requested that we block all outbound traffic to their netblock until further notice. They have also blocked all of our IP space inbound to their network at their provider’s edge,” said E. Kujawski, a senior network engineer at SoftLayer, in their private user forum.
SpamStopsHere has routed all its SoftLayer traffic through another provider that is apparently not affected by this outage. We hope that Network Solutions resolves this issue, and my only complaint so far is that Network Solutions and SoftLayer have both been very private regarding the issue and an estimated time until it is resolved. “They have blocked a number of providers including a large subset of Cogent IPs which is causing havoc around the US currently,” added Kujawski. However, I have unable to confirm this via any other sources. The oncoming shift at the network operations center for Network Solutions had not yet been briefed on any problem and was unwilling to comment further.
UPDATE: On Friday, August 22, at 2:43AM Eastern, Bill Sehmel with SoftLayer wrote in the company’s private forum “This issue is fully resolved now.” Although the issue seemed to be mostly resolved between 3:00PM and 4:00PM Eastern on Thursday, August 21, we had not received an official update.
August 20th, 2008 at 1:34 pm
[…] http://www.spamstopshere.com/ […]
August 21st, 2008 at 11:32 am
I can verify that we are a Cogent transit customer who has been blocked. We cannot access NetSol WHOIS, most DNS servers, cannot email them. In addition, NetSol customers cannot email us — the blockage is bi-directional.
August 22nd, 2008 at 2:53 pm
We ran into the same problems as our hosting provider fell within the blocked ranges. I had to call NetSol and spend nearly an hour on the phone until they finally admitted that the problem was on their end. Their suggestion to us was to “simply change IP addresses”. What a joke. We are moving all our domain registrations to someone else out of spite.
August 26th, 2008 at 10:38 am
Cogents NOC reported that NetSol has NULL router an entire 16 bit address range. That’s unbelievable and unacceptable. You have to wonder what the future holds when a core service provider can block an entire subnet at their own discretion.
August 29th, 2008 at 11:31 am
Anybody hear anything from either party? I call both playing dumb, then again telling both I knew what was going on. I think this is more on NetSol than Cogent unless the attack was truly coming from those IP’s. I keep reading that they were spoofed, though. Maybe the DDOSer will start using bloks from Level3, Verizon, Sprint, Verio, etc to NetSol can block all of them.