AS number summary check
Prerequisites:
The AS number check has found the AS numbers for each nameserver.
Package:
Availability.
Executed on:
In-check compilation.
Check interval:
Every 4 hours.
Impact on Availability:
None.
Impact on Integrity:
None.
Purpose
Informational/indicational only.
When building a DNS infrastructure, it is good practice to distribute the DNS servers across at least two AS. Denial of Service attacks could potentially block access to an entire AS, bringing down the entire DNS infrastructure.
The Autonomous System Residence check compiles the AS number list from each nameserver, compares them and issues a warning if all the nameservers would reside within the same AS. However, the AS information alone is not a determining factor, which is why the AS residence check doesn’t affect the availability metrics.
Other factors such as peering will also affect the overall resilience to withstand and reroute traffic during a DDoS attack.
Use the AS peering information provided for your DNS servers to work out possible future actions.
Event severities and messages
INFO
The name servers appears to be split between multiple AS.
To have the DNS infrastructure split between at least two different AS makes it more resilient to overloading attacks.
WARNING
This may affect the DNS infrastructure’s resiliency when fending off overload attacks.
Solutions, tips & tricks
Some DNS service providers have all their DNS servers inside the same AS, which usually belongs to the service provider itself. Usually they have multiple peering partners making their network less vulnerable for large scale DDoS attacks.