From Dyn's statement,
http://hub.dyn.com/static/hub.dyn.com/dyn-blog/dyn-statement-on-10-21-2016-d... we have "After restoring service, Dyn experienced a second wave of attacks just before noon ET. This second wave was more global in nature (i.e. not limited to our East Coast POPs), but was mitigated in just over an hour; service was restored at approximately 1:00 pm ET." I can't reconcile this what I saw on our recursive name servers here in Norway, looking at the period when Dyn's name servers didn't answer at all. We saw the second wave start at around 15:56 UTC (which corresponds well with "just before noon ET") and end at around 20:00 UTC - so from our point of view, service was unavailable for around *four* hours. Steinar Haug, Nethelp consulting, sthaug@nethelp.no