Category Archives: Networking

Roku Streambar Can’t Access Internet

My brother has a Roku Streambar but had difficulty getting it to work reliably. The network connection test reported that both the Wired link and the Internet link were working correctly. However, most of the streaming services wouldn’t start.

As this was tricky to figure out, I’m recording the solution here for the benefit of anyone else with the same problem. (There are quite a few posts on Roku-related forums with similar sounding symptoms.)

The Solution

An old Zyxel D1000 DSL router (supplied by Eir) had been repurposed to use as a Wi-Fi access point in one of my brother’s sheds. This was linked to the main house network via one of its LAN ports. Its built-in DHCP server had been disabled, so its only purpose was to provide Wi-Fi access.

It turns out that this Zyxel model has separate DHCP servers for IPv4 and IPv6 traffic. The IPv4 DHCP server had been successfully disabled, but the IPv6 server, which is configured on a separate page, was still enabled. In addition, IPv6 RA (Router Advertisement) was also still enabled. This meant the Zyxel router was periodically advertising itself as a good place for IPv6 clients to direct traffic. Since the router was no longer directly wired to the Internet, this didn’t work very well.

The solution was to disable both IPv6 DHCP server and IPv6 RA (Router Advertisements) on the Zyxel, and then restart the Roku.

After doing so, the Roku could connect reliably to the Internet once again and streaming services worked as expected. The Zyxel’s IPv6 configuration page looked like this after disabling the relevant IPv6 options:

(It’s also wise to disable the UPnP support on the previous tab, just to ensure it doesn’t confuse any UPnP-aware devices on the same LAN.)

Troubleshooting Approach

If you’re interested in the approach used to diagnose this issue, read on.

My brother’s home networking setup uses a Vodafone 500 Mbps FTTH connection. The Vodafone router provides Wi-Fi access in the main house and is also the main gateway to the Internet. There are four auxiliary Wi-Fi access points located in outhouses and sheds. All of these are wired back to the main router using direct Ethernet links, and all the access points use the same SSID. They all have static IP addresses on the 192.168.1.x network.

The Vodafone router is configured as the main DHCP server for the LAN and provides dynamic IP addresses to the other network devices (PCs, laptops, phones, tablets, Sonos speakers, Smart TVs, Roku Streambar).

The Roku was connected to the network using Wi-Fi; this is the only option for the Streambar out of the box as it does not include an onboard Ethernet port. Initially, I suspected an issue with the Wi-Fi connection due to the Roku’s location. The Wi-Fi connectivity check worked okay, but it seemed prudent to eliminate it.

We added a cheap USB Ethernet port from Amazon and ran a fresh Ethernet cable from the Roku to the nearest network switch. The Roku’s connection test confirmed that this had improved throughput, but it didn’t make any difference to the streaming apps — they still couldn’t connect.

After trying several things, including a full reset of the Roku, I decided to bring it back to my house to continue trouble-shooting. To my surprise, it worked perfectly when connected to my own network. I was able to update the Roku firmware to the latest version and also update the various apps. I ran it for a couple of days to make sure there were no intermittant issues, and it was flawless.

However, when I brought it back to my brother’s house, we were no further on — it still failed to connect.

Network Debugging

This time, I had come armed with my main networking debug tool: a cheap Netgear GS105E managed switch. For around €25, this compact device offers five Gigabit Ethernet ports that are individually configurable. One of the ports can be assigned as a Mirror port, which is ideal for monitoring traffic between two Ethernet devices.

This switch is small enough to fit in my networking toolkit, and I keep it permanently configured so that Port 5 automatically mirrors all the traffic in and out of Port 1. I connect the device being debugged to Port 1, with Port 2 connected to the rest of the network and Port 5 to my Windows laptop. Wireshark running on my laptop can then capture all network traffic in both directions.

(If this approach wasn’t used, Wireshark could see broadcast packets from the device, but most other traffic would be invisible as the network switch or router the device is connected to would transmit the packet directly to the Internet router, bypassing the port Wireshark is connected to.)

You can also use this setup to, for example, monitor all Wi-Fi traffic coming via an access point to the rest of the LAN, or all traffic between LAN devices and the main Internet router – it’s merely a question of where you insert the switch into the network.

For best results, it is a good idea to turn off IPv4 and IPv6 network options on the laptop’s Ethernet adapter; this cuts down on the amount of traffic caused by Windows on the laptop trying to check what is out there.

Analysing The Network Traffic

After inserting the Netgear switch between the Roku and the main LAN, I carried out a simple test: asking the Roku to check for a firmware update. This was consistently failing to connect, and I figured it would generate very little network traffic making it easy to analyse.

Initially, I accidentally created a network loop by forgetting to turn off Wi-fi on my laptop. This caused traffic from the laptop’s Ethernet adapter in promiscuous mode to be broadcast on the Wi-Fi link (I may have enabled routing on my laptop at some point in the past). Over the course of 15 seconds or so, I amassed nearly 1,000,000 packets of network traffic – quite impressive, even if almost all of them were duplicates!

Once I figured that out, and disabled the Wi-Fi temporarily, things settled down and I was able to get a more useful trace. You can download it here if interested:

Initially, I filtered by the Roku’s IP address (192.168.1.34) in order to get rid of unrelated broadcast traffic and what looked like inter-switch advertisement packets. At a first glance, I could see that DNS lookups were failing in what appeared to be an odd way:

The Roku was sending a DNS query for lagrange.sw.roku.com and it appeared the Internet gateway was responding with an appropriate response. However, when that response was delivered to the Roku, it replied with the ICMP error Destination unreachable.

I carefully checked the UDP port numbers on the original request and response packets and they matched correctly, so it seemed odd that the Roku wouldn’t accept something it had asked for a mere six milliseconds earlier!

I did some similar tests without success, and was unable to figure it out. Eventually, as it was getting late, I packed up my gear and headed home — fortunately taking with me a copy of the Wireshark trace so I could analyze it later.

Once home, I took another look. This time, I filtered on the hardware MAC address of the Roku, rather than the IP address:

Aha! The Roku was sending out two DNS queries — one from its IPv6 address, to a Zyxel device, and one from its IPv4 address, to the main Internet router. The Zyxel replied first, giving the IP address 207.69.188.186 as the IP address associated with lagrange.sw.roku.com. As the DNS enquiry had now been satisfied, it no longer needed to wait around for the result of the parallel IPv4 DNS lookup. Hence, the ‘Port unreachable’ error when that result arrived.

Further tests showed that the Zyxel was returning this IP address for any DNS lookup.

What was this Zyxel device? A quick cross-check of its MAC address against the various Wi-Fi access points on the LAN showed that it was in fact an older ADSL D1000 router supplied by Eir, the national Irish phone company & Internet provider. This had provided slow Internet access prior to the long-awaited upgrade to fiber and was now being used to provide Wi-Fi coverage in one of the sheds.

I connected to the Zyxel’s web interface and sure enough, it still had its IPv6 subsystem enabled. I disabled the IPv6 DHCP server expecting that would resolve the issue. However, it did not! It was only after I also disabled the IPv6 RA (Router Advertisement) feature and restarted the Roku that everything finally returned to normal. Finally, it could run streaming applications once more.

Making Sense Of Nonsense

Why did the Internet connection test succeed on the Roku when almost all other Internet access was failing? While I can’t say for sure, I suspect the Roku does an initial connection probe when it starts up. At this point, it has obtained an IPv4 address from the Internet router using DHCP but the Zyxel router has not yet broadcast a Router Advertisement (RA’s are broadcast approximately every 200 seconds).

So, the Roku can connect to its target server on the Internet to verify connectivity without issue, and it then caches the DNS entry it looked up. It re-uses this IP address for further connectivity tests without needing to do another DNS lookup, and as it is an IPv4 address, it uses the IPv4 gateway (the main Internet router) to connect to it.

Within a minute or two of startup, the Roku will have received an IPv6 RA from the Zyxel and it then uses this path for further DNS lookups, in addition to the IPv4 path to the Internet router. As the Zyxel always replies first (within a milisecond or so), that reply beats the one coming from the real Internet. As its reply appears legitimate, the Roku then attempts to connect to 207.69.188.186 and times out when it doesn’t receive the expected response.

So what is this IP address 207.69.188.186? It doesn’t have any connection to the real IP address associated with lagrange.sw.roku.com.

It seems that when the Zyxel has no Internet connection, it serves up this IP address by default as the response for all UDP DNS queries. This has been previously discussed by other Zyxel users, and appears to be an odd quirk of their firmware.

(After some Googling, I discovered that this IP address also appears in example network traces in some of their documentation.)

I was sure I’d heard this IP address before. After checking some old records, I realised it had turned up while I was diagnosing a network connectivity issue with Sky TV for my sister. Her house also had an old Eir D1000 router on the LAN providing Wi-Fi access. I had disabled DHCP access on that router, but had missed the IPv6 configuration. Eventually, a year or two ago, that unit had been replaced by a TP-Link dedicated Wi-Fi device and all the connectivity issues with her Sky TV box had gone away, though I hadn’t made the connection at the time.

So, mystery solved!

In summary, if you arrived here because you were wondering why 207.69.188.186 has appeared on your network traces, track down any Zyxel home routers and reconfigure them or replace them with something more modern.

Bonus Russian Explanation!

The blog post mentioned a couple of paragraphs earlier contains a link to a Russian Zyxel Knowledge Base article that goes into a lot more detail about what is happening here. That page has been offline for more than a decade, but happily archive.org kept a copy. For your convenience it is reproduced here, translated to English courtesy of Google.

(From https://web.archive.org/web/20101127161654/http://zyxel.ru/content/support/knowledgebase/KB-1228)

DNS query problem in P-660R EE

Question:
When using the P-660R EE modem, the following problem arose:

“When accessing any name, DNS starts returning only www.kimo.com.tw. The modem responds in this way to any request to any server. What is the problem and how can I solve it?”
Answer:
First of all, I would like to explain where the need for the address www.kimo.com.tw came from. This is not a hidden Trojan, but a mechanism necessary for implementing the “zero configuration” function.

Here’s how it works:

1. When you try to connect to, say, www.zyxel.ru, the PC sends a DNS query to the modem.

2. If the modem was previously reset to factory configuration, it launches the ” vc-hunting ” mechanism – it goes through the list of VPI, VCI and Internet provider encapsulations built into it until it establishes a logical connection.
At this time, www.zyxel.ru is not yet available.

3. At the same time, the modem responds from a fake IP address, as if from “207.69.188.186” (“www.kimo.com.tw”).

4. The PC tries to get an IP address by sending an HTTP request to the modem.

5. The modem, having received this IP address, responds with a corresponding HTML page with a message about the current status of the null configuration process.

This entire process is used only to display the execution of the webredirect function , while there is no real connection to the Internet, i.e. with www.zyxel.ru.If you do not want to use this mechanism, use a new firmware that has the ability to disable it.

Disabling is done via the command line, by establishing a telnet connection to the modem, in menu 24.8, with the following commands:

1. “wan atm vc dis ” (checking the current status of VC hunt and webredirect)
2. “wan atm vc webredir 1/0(1=disable;0=enable) “
3. “wan atm vc save ” (saving the configuration in non-volatile memory)

Also, don’t forget that the PC has a cache and after you disable the webredirect function, it may still be erroneously routed to “www.kimo.com.tw” for some time until the cache is cleared.

The firmware in which you can disable the webredirection function is attached to this article – http://zyxel.ru/content/support/knowledgebase/KB-1228/340UH3C0_20051101.zip
Applies to products:P-660REEP-660R EE (Annex A)

Default route keeps vanishing on Windows 10

A number of my PCs have a persistent problem with the default route disappearing when the system is restarted. Since I use Remote Desktop to control most of these machines remotely, it’s rather annoying; if the PC reboots, I no longer have remote access.

I hoped it would correct itself when I upgraded to Windows 10, but it’s still happening. In fact, it’s much worse — Win10 feels it has carte blanche to reboot to install upgrades without asking my permission first and when it does, I have to visit the PC to reset the default route, or find someone to do it for me.

This all started a year or two ago, with a particular Windows 7 update (I’m not sure which one). The only common factor is that all the affected PCs use static IP addresses with a manually configured default route. It doesn’t occur when DHCP is used. Most of them also have multiple network adapters.

While I have a workaround using a startup script to manually re-add the missing route, it’s awkward to run this with the elevated command privileges needed to change the default route.

Google suggested various solutions, including:

  • Editing the network adapter and switching it to DHCP, exiting, then going back in and switching it to static again. This needs to be done twice to work.
  • Resetting the TCP/IP stack (by running netsh int reset from an elevated command prompt). This is quite drastic.

I tried both of these but neither fixed it for me.

Today, I found something that *did* work. I’m recording it here in case it helps someone else.

  • Run RegEdit and navigate to Computer\HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
  • Go through each of the interface GUIDs in turn.
  • One of them will have an IPAddress field matching your main network interface. On this one, confirm that there is a REG_MULTI_SZ field called DefaultGateway containing a single text line with the IP address of your default route. If it’s not there, create it. Similarly, there should be a DefaultGatewayMetric field, also REG_MULTI_SZ, containing the single string ‘0’.
  • On all the other interface GUIDs, delete any DefaultGateway and DefaultGatewayMetric fields entirely.

After completing these steps, restart your PC. The correct default route should now be configured.

Windows 7 filesharing limit

I have a Sonos music system at home, and it’s great — I use it to make music stored on my Windows 7 Media Center system accessible throughout the house, among other things.

One of the nice things about Sonos is that it’s really easy to setup. I just point its music library at a network Share on my Media Center system and it automatically keeps everything indexed and up to date. Every now and again, however, I go to play a music track and I’m told it can’t find it. Specifically, it can’t access the file using the network share path, even though the file is there and I can play it fine locally on Media Center.

Recently, I finally figured out what was going on – a simple but not-very-well-publicised limitation built into Windows 7 Home Premium which restricts the resources used to manage network file shares. If you have a number of PCs in your house, as I do, all accessing shares on a particular PC, you can run out of resources. When this happens, any further attempts to access the share will fail. Not good!

Happily, there is a straightforward fix – Alan Lamielle describes it on his blog.

The short version is to find this registry key on the Windows 7 machine:

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\LargeSystemCache

and change the following registry key from ‘1’ to ’3′:

HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\Size

Then restart the ‘Server’ service (or restart Windows itself if you prefer) and everything will be back to normal again.

Since making this change, I haven’t had a single recurrance of the problem – happy days!

Syncing sent mail between iPhone and Outlook

I use Outlook 2003 for most of my mail. However, since buying an iPhone last year, I’ve gradually been replying to more and more messages by phone. The convenience of being able to send a quick reply Right Now is great; it’s one less email to deal with when I get back to my desk, and a good use of what would otherwise be dead time.

This creates a problem though: I use POP3 mail with Outlook so it doesn’t see messages sent from my iPhone. If I want to check back on a reply weeks or months later, it can be difficult to locate.

To fix this, I have my iPhone configured to automatically BCC me on any messages or replies I send. This works but the BCC’d messages arrive in my Inbox as new messages which I then need to consciously ignore. They’re also more difficult to find later on since I need to search my entire Inbox instead of just checking my Sent Items.

Today, I finally implemented a really simple, obvious solution I should have come up with months ago: using Outlook’s Rules to automatically move such messages to the Sent Items folder. The trick is to use an obscure Rules feature that lets you check for specific keywords in the message header.

Outlook Rules editor

If you open any message sent from the iPhone in Outlook, and choose View Menu -> Options, you will see the full mail header. iPhone messages always have an X-Mailer header line reading “iPhone Mail (xxxx)”. Outlook can use this to identify iPhone messages automatically and move them to Sent Items.

I don’t want to move messages I receive from other iPhone users though, just messages sent from my iPhone. I also don’t want to move messages sent to me – I often send myself iPhone messages to remind me to do things, or to quickly move photos from my phone to my desktop without having to sync. Outlook can handle both of these conditions by simply checking the To: and From: fields of the message.

Putting it altogether, I created a new Outlook Rule like this. (The steps are for Outlook 2003, but Outlook 2007/2010 should be similar):

  1. Select Rules and Alerts on the Outlook Tools menu
  2. Click to create a New Rule; start from a Blank rule, not a pre-defined template
  3. Turn on these conditions: From people or distribution list, and With specific words in the message header
  4. In the rule description below, edit the People or distribution list to include the address(es) you send iPhone mail from. Also edit the Specific words list to include the phrase iPhone Mail.
  5. Click Next and choose the actions Move it to a specific folder and optionally Flag it with a colored flag. (I move messages to my Sent Items folder, and flag them green to make them stand out, but you could create a folder specifically for iPhone messages if you prefer.)
  6. Click Next, then choose Except if sent only to me from the list of exceptions. This ensures that messages I forward to myself don’t get moved to Sent Items.
  7. Click Next once more to finish creating the rule, give it a sensible rule name (I used iPhone Messages) and then, if you like, run it immediately on the contents of your Inbox. This tidied up all the existing messages I’ve sent from my iPhone over the past year.

Only takes a minute to set up, and now my Inbox feels like it’s back under control again. Better, I can now easily find messages I sent on my iPhone while searching on my desktop.

(Yes, switching from POP3 to IMAP would let me do all this seamlessly, in principle, but there’s something about the simplicity of POP3 that I continue to like.)

Monitoring network downtime with PRTG

I’ve been using MRTG for a while to monitor assorted servers, routers, and switches I manage at The Windmill. It’s free, works pretty well, and is quite configurable. The graphs it produces are plain but functional, and they do the job.

Recently, I needed a tool to monitor my home network, primarily because the Cisco 3925 router provided by my Internet supplier, UPC, has had a nasty tendency to lockup every week or so. Now, UPC’s 120 Mb/s Internet service is fantastic value, and performs exceptionally well, but having it randomly interrupted like this is really, really annoying — especially when the router is buried in a small cupboard at the back of our attic, where all the TV wiring is concentrated.

I also have a wireless access point (an old reconditioned Eircom Netopia 2247) which periodically hangs, though on a different schedule to the Cisco. So, I figured it was time to start monitoring both devices to see exactly when they go offline, in the hope that I might be able to correlate it with other network activity.

While MRTG can do this, it’s not the most user friendly of systems to configure. Since I crave nothing more than an easy life, I decided to look around for alternatives.

This brought me to PRTG, a commercial monitoring tool from Paessler that covers some of the same ground. It’s free for up to 10 monitoring points, runs under Windows, and has a nice web-based GUI that makes it easy to configure or review logs from anywhere on my LAN. So, I decided to give it a try.

I’ve been using PRTG for about two months now, and it’s working very well. There are a huge number of built-in sensors: everything from basic PING tests, SNMP polling of routers & switches to Windows system metrics (for any machine on the LAN) to remote website HTTP monitoring. With the 10 free sensors included in the evaluation copy, I was able to add rules for three websites I manage, my Wifi and Internet routers, a separate VPN router I use to access client networks, and also a few of my local machines:

PRTG lets you create sensor dependency trees: for example, I monitor the uptime of this website (www.snoopdos.com) but the monitoring rule says not to try and monitor it if the UPC Cisco router is down, OR if Google’s main DNS server at 8.8.8.8 can’t be reached. This ensures I don’t get an onslaught of website failures in the log just because my Internet connection was interrupted.

PRTG also lets you raise alerts whenever a sensor goes on or offline, or crosses a threshold. For example, if the disk space on C:\ on my main Media Center TV system drops below 1 GB, I can easily have PRTG alert me, either by email or SMS.

I’ve barely scratched the surface of what’s possible so far, but it’s a very capable system. When Paessler emailed me today with an offer to upgrade my free 10-sensor license to 30 sensors in return for some blog coverage, it wasn’t a difficult decision. While I only blog about products I actually like and use, PRTG now falls squarely into that camp. Give it a try and see what you think for yourself.

Why choose Snoopdos?

Like most engineers, technology is my comfort zone. It’s easy to forget that running a successful business needs a sprinkling of sales & marketing, and even (gasp) self-promotion. So for a change, I thought I’d talk a little about Snoopdos itself and why you might want to consider us for your next project.

Wairere Falls, Waikato, New ZealandThere are many reasons for choosing Snoopdos. Our team of experts combines highly communicative people with varied skills in a wide range of sectors which means we have a wealth of knowledge and creativity to offer you. We have collaborated internationally with great success. Our scope spans all kinds of projects for companies of all sizes. We can devise a program with which to achieve your goals. Take your business to the next level with our help!

We offer indepth consultancy services. Typically, we first evaluate your current set up. We do a general evaluation and quickly pinpoint what needs to change and how exactly to do so. We consider what positive ideas are already in place and design ways to make them even more powerful. There is no set program, since all companies differ, so we customize everything down to the details.

Whether you are an artistic start-up company or a big telecommunications operation, whether you have the most basic of sites or a large powerful one like O2 we can show you how to get more out of your online presence.

Don’t underestimate the power of an effective website. An excellent website will not only provide great promotion and attract more clients to your services and products; done right, it can also open another stream of income for you as you select appropriate advertisements and links to display. Take your company international with the reach of an amazing site. We can get you there!

One of our core skills is software development. If your website or indeed other project requires bespoke development, we can deliver. Our team is extremely professional, able to work to deadlines and your specific requirements.

Please fell free to contact us at your earliest convenience so that we can schedule an initial meeting. We can discuss your needs and together decide on the best plan of action. We look forward to helping you accomplish your professional goals. Thank you for considering Snoopdos!

OpenSocial: now facebook is for everyone

Marc Andreessen’s always-interesting blog today talks about OpenSocial, a new standard spear-headed by Google which aims to provide a common API for embedding new web content and apps across all the main social network sites.

This is very similar to the Facebook Platform API launched a few months ago to critical acclaim, but with the significant difference that OpenSocial is an open standard which pretty much everyone else except Facebook is jumping on the bandwagon to support.

Marc’s blog does a much better job of describing the benefits than I can. In a nutshell, though, it means that if you run a website that offers a useful service, you can now easily allow it to be embedded in any of the main social networking sites (LinkedIn, Friendster, Ning, etc.) by just adding some basic HTML & Javascript support.

This should be fun…

(The official Google launch is tomorrow, at which point http://code.google.com/apis/opensocial should become operational.)

Seam Carving & Tiny First Person Shooters

My friend James was impressed by the Tilt-shift photography I mentioned in the previous post, and sent me some related material.

Seam carving is an image resizing technique which works by identifying horizontal and vertical seams with low information content and then removing them, rather than simply removing pixels according to a fixed scaling algorithm.

This means that the proportions of important items within the picture are maintained. The same technique can be adapted to increase the size of an image (especially in a single dimension) without making it look skewed. And more intriguingly, by first marking parts of the image as “low value”, you can seamlessly erase elements of a picture automatically — no Photoshop expertise required.

This YouTube video does a good job of describing it:

Not content with this, James also pointed me towards .kkrieger, a simple 3D shoot-em-up with an impressive twist: the executable size is less than 100 KB. (Yes, that’s Kilobytes). The program would have easily fitted onto a standard 170 KB floppy disk from the Commdore 64 era 25 years ago!

Despite this, the game has pretty decent graphics and sound, not dissimilar to Doom, as this screenshot shows:

Screenshot from .kkrieger

The amazingly small file size is achieved by generating all textures algorithmically at runtime. This leads to long, though not excessive load times.

To download the game or read more about it, visit the main .kkrieger website.

Flatrate 3G access from Vodafone

ENN reports that Vodafone Ireland have announced a flatrate 3G access package from 1 July.

For around €50 per month, users can enjoy up to 1 Mbps downstream Internet access while on the move, subject to a monthly cap of 5 GB of data.

This sounds like a pretty good deal, though I’m dubious as to how close to 1 Mbps your average mobile user can expect; I’d expect speeds closer to 128 Kbps. You only need to have a conversation with someone on a car phone to realise how hard the mobile network works just to keep a connection up at all.

However, I’m more interested in its potential for fixed base users, such as those in areas too remote to have traditional broadband available. Until now, the only solution for such users has been satellite, which is both expensive and awkward.

Vodafone have > 99% coverage around the country, so there is an excellent chance that almost every household will be within range of a mobile signal. It’s not clear whether Vodafone need to upgrade the transmitters on each mast to support 3G access, or whether this can be accomplished by a software upgrade. If the latter, then this may finally be a cost-effective way for small businesses in remote regions to get decent Internet access.

(Keep in mind also that a fixed antenna should be capable of much better datarates than a purely mobile solution. And if the introductory price is €50 per month, prices can only get cheaper over time.)

DDoS against UltraDNS

The Washington Post has an interesting article about a Distributed Denial of Service (DDoS) attack against UltraDNS, a provider of domain name services.

It’s a chilling read. If you’ve wondered why recently, some popular websites appear to be mysteriously offline, this may provide some of the answers.

The most unsettling bit is that there doesn’t seem to be any obvious way to defend against this sort of attack.