http://www.theguardian.com/technology/2015/jan/23/what-happens-when-most-of-china-visits-your-website-it-dies-a-horrible-death

What happens when most of China visits your website? It dies a horrible death

Chief engineer of small software firm in Greensboro North Carolina woke up to find his company was receiving 13,000 requests a second

A domain name system error directed all the internet traffic from China - 13,000 requests per second - to one small firm in North Carolina, US. Photograph: Gideon Mendel/Corbis

Alex HernFriday 23 January 2015 12.50GMT

What happens if a significant proportion of all the web traffic in China gets directed to one server? Perhaps unsurprisingly, the answer is that server dies a rapid death.

Craig Hockenberry, the senior software engineer for developers Iconfactory, in the small university town of Greensboro, North Carolina, learned that the hard way. On Tuesday, he woke up to discover that the main server for his company was receiving around 13,000 requests per second, about a third of Googles global search traffic and all the traffic was coming from IP addresses located in China.

There was also a lot of requests that looked like they were intended for CDNs, YouTube, Facebook, Twitter and other places that were not the Iconfactory, Hockenberry said. Clearly there was some kind problem with traffic being routed to the wrong place. The most likely candidate would, of course, be DNS.

DNS (Domain Name System) is the system which translates web addresses, such as google.com, into an IP address, such as 74.125.224.72/. A network requires the latter to actually access a website, but if the look-up system gets confused, it can give the wrong IP address which appears to be what happened in the Iconfactorys case. Except that rather than one DNS server messing up, it was the server for the whole of China.

Hockenberry reports that in the end, he was forced to block all traffic coming from China in order to keep the site up and running. Im a big believer in the power of an open and freely accessible internet: I dont take blocking traffic from innocent people lightly. But in this case, its the only thing that worked.

If you get a DDOS like what Ive described above, this should be the first thing you do.

He believes his site isnt the only one to be hit. Other site owners are seeing similar behaviour starting in early January. I took some comfort in knowing that we werent alone But at the end of the day, every machine in China has the potential to be a part of a massive DDOS attack on innocent sites. As my colleague Sean quipped, They have weaponised their entire population.

From the point of view of a Chinese netizen, the DNS error which took down the Iconfactorys server was an hours-long outage. The Register reports that a similar error left users unable to visit websites or use social media and instant messaging services as a result.

Many experts see the DNS infrastructure as a vital weak point of the internet. The EFF warns that when it is compromised or censored, users will have difficulty accessing certain sites and domains, unless, in some instances, they can use alternate DNS servers and proxies.

In early 2014, Facebooks URL was taken over by the Syrian Electronic Army after they attacked the DNS servers and redirected lookups to their own address.