During the evening of Monday, 21 October 2002, 13 vital pieces of
Internet infrastructure suffered an hour-long attack that almost brought
them to their virtual knees.
The domain name system, or DNS, allows users to type mnemonic names (such
as “www.extremetech.com”) instead of cryptic IP addresses (such as
18.104.22.168). It’s structured as a distributed database. Each level of
the name — from the “.com” backward to the “www” — may be determined by
a different server in a different part of the world.
The 13 DNS “root servers” lie at the top of the hierarchy, and are the
first stop when your ISP’s equipment looks up the name preceding the
“.com” for you. For example, your ISP might go to the root servers to
find the address of the name server responsible for the domain
“extremetech.com”. It then goes to that name server to find out
the address of the host “www” within the domain “extremetech.com”. Your
ISP saves, or caches, the addresses associated with names that were
recently looked up, so you might not even notice a brief outage in the
root servers. But if those servers were to stop running for more than a
short while, the Internet would grind nearly to a halt.
Washington Post article gives a general description of the attacks.
Other sources say that the attack consisted of ICMP packets — the kind
used by the “ping” network utility. (An attack that overwhelms a machine
with such packets is called a ping flood). However, the article
does not mention whether the root server operators were able to identify
the Trojan horse or worm that infected and controlled the attacking machines.