#servfail — Public Fediverse posts on home.social

goetz @[email protected] · 2026-08-12 · 18:16 UTC

#servfail renewal ✅
@dns

#servfail

goetz @[email protected] · 2026-08-12 · 18:16 UTC

#servfail renewal ✅
@dns

#servfail

goetz @[email protected] · 2026-08-12 · 18:16 UTC

#servfail renewal ✅
@dns

#servfail

goetz @[email protected] · 2026-08-12 · 18:16 UTC

#servfail renewal ✅
@dns

#servfail

dmiException 💽 @[email protected] · 2026-07-04 · 11:46 UTC

so i look into why my logs are so enormous. i shouldn’t have left them as verbose for 1.5 months but they also shouldn’t have grown to EIGHT GIGABYTES. and most of my recent log lines are something like

Jul 04 13:36:22 msg="Limit of simultaneous TCP connections reached - raise max-tcp-connections" prio="Warning"

this, but 15 times a second… Which usually means that we’re under attack. but it’s a very lousy attack, i can’t even see it on the graph, so they’re only really causing some disruption to TCP connections, not UDP. and most of DNS is UDP, that’s why I’m only noticing right now.

anyways. ss -tulnap | grep 53 shows a lot of connections with addresses that begin with 2a03:2880. | wc -l says 273, from maybe 5-6 different hosts. and, my dear comrades, can you guess who owns 2a03:2880::/32?

inet6num:       2a03:2880::/40
netname:        PRN
country:        US
admin-c:        RD4299-RIPE
tech-c:         RD4299-RIPE
status:         ASSIGNED
mnt-by:         fb-neteng
mnt-by:         facebook-neteng
created:        2020-03-11T00:33:38Z
last-modified:  2020-03-11T00:33:38Z
source:         RIPE

that’s right! facebook! and after a preliminary check, we’ve seen this same exact thing on at least one other #SERVFAIL nameserver

in “completely unrelated news”: i “slipped” in my kitchen and executed ip6tables -I INPUT -s 2a03:2880::/32 -j DROP as root on sakamoto i’m so sorry (not sorry). and through the power of ip6tables… suddenly my TCP limits aren’t reached anymore. CURIOUS

if you didn’t have enough reasons to hate meta: FUCK META :boost_ok:

#servfail

dmiException 💽 @[email protected] · 2026-07-04 · 11:46 UTC

so i look into why my logs are so enormous. i shouldn’t have left them as verbose for 1.5 months but they also shouldn’t have grown to EIGHT GIGABYTES. and most of my recent log lines are something like

Jul 04 13:36:22 msg="Limit of simultaneous TCP connections reached - raise max-tcp-connections" prio="Warning"

this, but 15 times a second… Which usually means that we’re under attack. but it’s a very lousy attack, i can’t even see it on the graph, so they’re only really causing some disruption to TCP connections, not UDP. and most of DNS is UDP, that’s why I’m only noticing right now.

anyways. ss -tulnap | grep 53 shows a lot of connections with addresses that begin with 2a03:2880. | wc -l says 273, from maybe 5-6 different hosts. and, my dear comrades, can you guess who owns 2a03:2880::/32?

inet6num:       2a03:2880::/40
netname:        PRN
country:        US
admin-c:        RD4299-RIPE
tech-c:         RD4299-RIPE
status:         ASSIGNED
mnt-by:         fb-neteng
mnt-by:         facebook-neteng
created:        2020-03-11T00:33:38Z
last-modified:  2020-03-11T00:33:38Z
source:         RIPE

that’s right! facebook! and after a preliminary check, we’ve seen this same exact thing on at least one other #SERVFAIL nameserver

in “completely unrelated news”: i “slipped” in my kitchen and executed ip6tables -I INPUT -s 2a03:2880::/32 -j DROP as root on sakamoto i’m so sorry (not sorry). and through the power of ip6tables… suddenly my TCP limits aren’t reached anymore. CURIOUS

if you didn’t have enough reasons to hate meta: FUCK META :boost_ok:

#servfail

dmiException 💽 @[email protected] · 2026-07-04 · 11:46 UTC

so i look into why my logs are so enormous. i shouldn’t have left them as verbose for 1.5 months but they also shouldn’t have grown to EIGHT GIGABYTES. and most of my recent log lines are something like

Jul 04 13:36:22 msg="Limit of simultaneous TCP connections reached - raise max-tcp-connections" prio="Warning"

this, but 15 times a second… Which usually means that we’re under attack. but it’s a very lousy attack, i can’t even see it on the graph, so they’re only really causing some disruption to TCP connections, not UDP. and most of DNS is UDP, that’s why I’m only noticing right now.

anyways. ss -tulnap | grep 53 shows a lot of connections with addresses that begin with 2a03:2880. | wc -l says 273, from maybe 5-6 different hosts. and, my dear comrades, can you guess who owns 2a03:2880::/32?

inet6num:       2a03:2880::/40
netname:        PRN
country:        US
admin-c:        RD4299-RIPE
tech-c:         RD4299-RIPE
status:         ASSIGNED
mnt-by:         fb-neteng
mnt-by:         facebook-neteng
created:        2020-03-11T00:33:38Z
last-modified:  2020-03-11T00:33:38Z
source:         RIPE

that’s right! facebook! and after a preliminary check, we’ve seen this same exact thing on at least one other #SERVFAIL nameserver

in “completely unrelated news”: i “slipped” in my kitchen and executed ip6tables -I INPUT -s 2a03:2880::/32 -j DROP as root on sakamoto i’m so sorry (not sorry). and through the power of ip6tables… suddenly my TCP limits aren’t reached anymore. CURIOUS

if you didn’t have enough reasons to hate meta: FUCK META :boost_ok:

#servfail

dmiException 💽 @[email protected] · 2026-07-04 · 11:46 UTC

so i look into why my logs are so enormous. i shouldn’t have left them as verbose for 1.5 months but they also shouldn’t have grown to EIGHT GIGABYTES. and most of my recent log lines are something like

Jul 04 13:36:22 msg="Limit of simultaneous TCP connections reached - raise max-tcp-connections" prio="Warning"

this, but 15 times a second… Which usually means that we’re under attack. but it’s a very lousy attack, i can’t even see it on the graph, so they’re only really causing some disruption to TCP connections, not UDP. and most of DNS is UDP, that’s why I’m only noticing right now.

anyways. ss -tulnap | grep 53 shows a lot of connections with addresses that begin with 2a03:2880. | wc -l says 273, from maybe 5-6 different hosts. and, my dear comrades, can you guess who owns 2a03:2880::/32?

inet6num:       2a03:2880::/40
netname:        PRN
country:        US
admin-c:        RD4299-RIPE
tech-c:         RD4299-RIPE
status:         ASSIGNED
mnt-by:         fb-neteng
mnt-by:         facebook-neteng
created:        2020-03-11T00:33:38Z
last-modified:  2020-03-11T00:33:38Z
source:         RIPE

that’s right! facebook! and after a preliminary check, we’ve seen this same exact thing on at least one other #SERVFAIL nameserver

in “completely unrelated news”: i “slipped” in my kitchen and executed ip6tables -I INPUT -s 2a03:2880::/32 -j DROP as root on sakamoto i’m so sorry (not sorry). and through the power of ip6tables… suddenly my TCP limits aren’t reached anymore. CURIOUS

if you didn’t have enough reasons to hate meta: FUCK META :boost_ok:

#servfail

dmiException 💽 @[email protected] · 2026-07-04 · 11:46 UTC

so i look into why my logs are so enormous. i shouldn’t have left them as verbose for 1.5 months but they also shouldn’t have grown to EIGHT GIGABYTES. and most of my recent log lines are something like

Jul 04 13:36:22 msg="Limit of simultaneous TCP connections reached - raise max-tcp-connections" prio="Warning"

this, but 15 times a second… Which usually means that we’re under attack. but it’s a very lousy attack, i can’t even see it on the graph, so they’re only really causing some disruption to TCP connections, not UDP. and most of DNS is UDP, that’s why I’m only noticing right now.

anyways. ss -tulnap | grep 53 shows a lot of connections with addresses that begin with 2a03:2880. | wc -l says 273, from maybe 5-6 different hosts. and, my dear comrades, can you guess who owns 2a03:2880::/32?

inet6num:       2a03:2880::/40
netname:        PRN
country:        US
admin-c:        RD4299-RIPE
tech-c:         RD4299-RIPE
status:         ASSIGNED
mnt-by:         fb-neteng
mnt-by:         facebook-neteng
created:        2020-03-11T00:33:38Z
last-modified:  2020-03-11T00:33:38Z
source:         RIPE

that’s right! facebook! and after a preliminary check, we’ve seen this same exact thing on at least one other #SERVFAIL nameserver

in “completely unrelated news”: i “slipped” in my kitchen and executed ip6tables -I INPUT -s 2a03:2880::/32 -j DROP as root on sakamoto i’m so sorry (not sorry). and through the power of ip6tables… suddenly my TCP limits aren’t reached anymore. CURIOUS

if you didn’t have enough reasons to hate meta: FUCK META :boost_ok:

#servfail

dmiException 💽 @[email protected] · 2026-07-04 · 11:30 UTC

bash-5.3:/# du -sh /var/log/pdns.log 
8.3G	/var/log/pdns.log

it seems that i forgot to disable verbose logging… in may :neocat_googly_shocked: #SERVFAIL

#servfail

dmiException 💽 @[email protected] · 2026-07-04 · 11:30 UTC

bash-5.3:/# du -sh /var/log/pdns.log 
8.3G	/var/log/pdns.log

it seems that i forgot to disable verbose logging… in may :neocat_googly_shocked: #SERVFAIL

#servfail

dmiException 💽 @[email protected] · 2026-07-04 · 11:30 UTC

bash-5.3:/# du -sh /var/log/pdns.log 
8.3G	/var/log/pdns.log

it seems that i forgot to disable verbose logging… in may :neocat_googly_shocked: #SERVFAIL

#servfail

dmiException 💽 @[email protected] · 2026-07-04 · 11:30 UTC

bash-5.3:/# du -sh /var/log/pdns.log 
8.3G	/var/log/pdns.log

it seems that i forgot to disable verbose logging… in may :neocat_googly_shocked: #SERVFAIL

#servfail

dmiException 💽 @[email protected] · 2026-07-04 · 11:30 UTC

bash-5.3:/# du -sh /var/log/pdns.log 
8.3G	/var/log/pdns.log

it seems that i forgot to disable verbose logging… in may :neocat_googly_shocked: #SERVFAIL

#servfail

dmiException 💽 @[email protected] · 2026-07-02 · 21:40 UTC

debugging regressions is turbo annoying, but honestly… sometimes I take a step back, look at the whole setup, think about how literally everything here was made by us, from the ground up…

it’s cool. i like this, actually #SERVFAIL

(BGM for the correct vibe: https://sdomi.pl/tmp/sdomi’s%20mods/coretex_-_home.xm.zip )

#servfail

dmiException 💽 @[email protected] · 2026-07-02 · 21:40 UTC

debugging regressions is turbo annoying, but honestly… sometimes I take a step back, look at the whole setup, think about how literally everything here was made by us, from the ground up…

it’s cool. i like this, actually #SERVFAIL

(BGM for the correct vibe: https://sdomi.pl/tmp/sdomi’s%20mods/coretex_-_home.xm.zip )

#servfail

dmiException 💽 @[email protected] · 2026-07-02 · 21:40 UTC

debugging regressions is turbo annoying, but honestly… sometimes I take a step back, look at the whole setup, think about how literally everything here was made by us, from the ground up…

it’s cool. i like this, actually #SERVFAIL

(BGM for the correct vibe: https://sdomi.pl/tmp/sdomi’s%20mods/coretex_-_home.xm.zip )

#servfail

dmiException 💽 @[email protected] · 2026-07-02 · 21:40 UTC

debugging regressions is turbo annoying, but honestly… sometimes I take a step back, look at the whole setup, think about how literally everything here was made by us, from the ground up…

it’s cool. i like this, actually #SERVFAIL

(BGM for the correct vibe: https://sdomi.pl/tmp/sdomi’s%20mods/coretex_-_home.xm.zip )

#servfail

dmiException 💽 @[email protected] · 2026-07-02 · 21:40 UTC

debugging regressions is turbo annoying, but honestly… sometimes I take a step back, look at the whole setup, think about how literally everything here was made by us, from the ground up…

it’s cool. i like this, actually #SERVFAIL

(BGM for the correct vibe: https://sdomi.pl/tmp/sdomi’s%20mods/coretex_-_home.xm.zip )

#servfail

famfo :frogchamp: @[email protected] · 2026-06-15 · 22:53 UTC

@jana and I started to write some more sophisticated monitoring for #SERVFAIL: what if we bombarded our servers with requests to measure latency and dropped packets?

Some alerting is still to do but it's enough to produce some pretty graphs in the future :D

https://git.sakamoto.pl/servfail/dns-xping

#servfail

famfo :frogchamp: @[email protected] · 2026-06-15 · 22:53 UTC

@jana and I started to write some more sophisticated monitoring for #SERVFAIL: what if we bombarded our servers with requests to measure latency and dropped packets?

Some alerting is still to do but it's enough to produce some pretty graphs in the future :D

https://git.sakamoto.pl/servfail/dns-xping

#servfail

famfo :frogchamp: @[email protected] · 2026-06-15 · 22:53 UTC

@jana and I started to write some more sophisticated monitoring for #SERVFAIL: what if we bombarded our servers with requests to measure latency and dropped packets?

Some alerting is still to do but it's enough to produce some pretty graphs in the future :D

https://git.sakamoto.pl/servfail/dns-xping

#servfail

famfo :frogchamp: @[email protected] · 2026-06-15 · 22:53 UTC

@jana and I started to write some more sophisticated monitoring for #SERVFAIL: what if we bombarded our servers with requests to measure latency and dropped packets?

Some alerting is still to do but it's enough to produce some pretty graphs in the future :D

https://git.sakamoto.pl/servfail/dns-xping

#servfail

famfo :frogchamp: @[email protected] · 2026-06-15 · 22:53 UTC

@jana and I started to write some more sophisticated monitoring for #SERVFAIL: what if we bombarded our servers with requests to measure latency and dropped packets?

Some alerting is still to do but it's enough to produce some pretty graphs in the future :D

https://git.sakamoto.pl/servfail/dns-xping

#servfail

dmiException 💽 @[email protected] · 2026-06-15 · 09:56 UTC