The web ‘s root servers weren’t the goal of a distributed denial of service (DDoS) attack in December which for a brief time took out four of the 13 columns of the international network.

That is according to two security researchers who’ll present their findings on Friday at a summit in Argentina. Rather, they reason the likely goal of the huge assault was two apparently unknown domain names filed in China.

Duane Wessels and Matt Weinberg work for Verisign, the US firm that runs two root servers as DNS specialists and in addition approves developments to the web root zone. Wessels and Weinberg carried out an extensive investigation into the myriad of crap traffic that a lot of root servers received on 30 November and 1. A duplicate of their display [PPTX] is now accessible online.

The two make several decisions. First that a comparatively new system for fighting DDoS attacks – answer rate limiting (RRL) – proved successful, cutting back the volume of traffic by 60 per cent.

The researchers identify that it proved to be a special attack (as against a random malfunction) with order and control directions being identified, and the assault happened through a botnet that used the well known “BillGates” malware.

That does not mean the theory of a new ISIS DDoS use is incorrect. It is simply as unlikely as the preexisting scenario where there are several botnets around the world used to execute such assaults.

Stopping the assaulting specialist hindrance that is necessary: DNS specialists developed a filter and reviewed the assault traffic. When the root server operators installed it and concurred, the attack traffic was killed stone dead.

While the researchers note that killing off the strike and hitting the Enter key immediately was quite filling, they warn that having a system which requires skilled evaluation and manual installation is far from perfect. Such an approach does bring with it the danger of unintentional effects

A better alternative – as ever – is for all ISPs to implement existing best practices (like the BCP 38 standard) and so restrict the capacity to spoof attacks.