Monday, March 2, 2026
[Incident Report #027][DNS] Name Server Attack
What Happened?
From around 0000 to 0400EST last night, our name servers were
hit with a large amount of traffic originating from a data center
in the Netherlands. The traffic was spread across multiple IPv6
subnets and volume was high enough the it saturated the virtual
bridges that our name servers are operating behind. This is the
third attack of this kind that our network seen in the past two weeks.
What damages Resulted?
During the attack, we saw the following issues:
- Accounting service lost contact with both NS1 and NS2
- Shell access was slow or non-responsive
- Legitimate name lookups were being dropped or timed out
- The NMS lost SNMP contact entirely with NS1
- High CPU load on Nardoragon router
What are we doing to deal with this?
Going forward, the following steps will be taken to try and maintain
the usability of our name servers during similar attacks:
- Deploy a separate virtual bridge and network interface for management
- Tightening per subnet rate limits and mask sizing
- Banning AS numbers that partake in attacks like this
- Increasing virtual bridge bandwidth to allow for more throughput
- Redirecting recurring problematic subnets and AS ranges to null
Tuesday, February 24, 2026
Control of the LIR Subnets Assumed
As of this morning, FurrIX has assumed control of what was MFN’s
subnets. WHOIS and operational information has been updated, but
name server zones for PTR will have to be updated as time permits.
We are also in the process of redoing our agreement with MFN to
ensure that they can transition to a nested environment and stay
operational as a community web and game server host.
As part of the network changeovers, FurrIX is looking to renumber
and reconfigure the network as well as creating full documentation
of how each router, subnet and member connection is configured and
maintained.
We will release more information as plans finalize.
Sunday, February 22, 2026
Releasing Domains and Ongoing Amplification Attacks
FurrIX has chosen not to renew the domains ‘birb.rest’ and ‘avali.rest’ for cost reasons.
These domains are not a core part of our network stack and were only used for personal
splash pages and a handful of user subdomains that have not seen lookups in some time.
This should not affect our operations, or that our members, in any meaningful way.
We are also dealing with a DNS amplification attack that is abusing ANY queries and will be
temporarily dropping any IP address that cross over 40 request per second until the incoming
traffic targeting the domains starts to ease up. This has been going on for several hours and
we are working to limit the amount of traffic crossing or originating from our network.
Saturday, January 17, 2026
NMP is Up!
Our Network Management Policy is live in its first version. It will be revised over
the next few weeks as we start gearing up more towards the network and
exchange provider role.
Agreement with Marbled Fennec Networks
With FurrIX being spun off from MFN and into its own project, theres a loose agreement in
place that benefits both projects and allows them to coexist on the same physical servers
and routers. Mostly in who manages what being clearly defined now.
Marbled Fennec Networks:
- Provides the two name servers
- Maintains the IP allocations and leases them directly to FurrIX
- Maintains the game servers, email and support systems
- Provides support for their single user tunnels, managed by FurrIX
- Maintains the web host
- No longer touches or operates the routing or network VMs
- Maintains and provides physical infrastructure for both projects
- Provides financial backing for FurrIX until Jan 20th, 2028
FurrIX, a Furry Virtual Internet Exchange:
- Directly leases the /44 and /48 IPv6 allocations without cost from Marbled Fennec Networks
- Maintains, designs and operates the network that forms the virtual internet exchange
- Provides and configures networking service(s) for Marbled Fennec Networks without cost
- Maintains the two name servers
- Maintains and Provides IP transit and tunneling services
- Focuses solely on being a network service provider
Transitional Items of Interest:
- Ty Dwagon becomes the owner and operator of Marbled Fennec Networks
- Adrian/Skylar becomes the owner and operator of FurrIX
- The two projects provide one another with services that the other needs to function
without cost and expectation
This agreement is in place to the benefit of both projects and the spinoff of FurrIX was done to
allow the virtual internet exchange to govern itself and expand at its own pace without approval
or interference from Marbled Fennec Networks, as long as network services are provided to
MFN on an as needed and requested basis.