IDN query trends seen at JP and Root. Kazunori Fujiwara, JPRS 2016/4/3, IEPG meeting

Transcription

1 IDN query trends seen at JP and Root Kazunori Fujiwara, JPRS 2016/4/3, IEPG meeting

2 Is IDN use increasing? It is said that IDN is important for non- English speakers IDN implementations are deployed Most of web browsers have implemented Many TLDs support IDN registrations We need to know the effect of IDN As a first step, an evaluation of IDN query trends is easy and may be useful 2

3 DNS-OARC s Root Datasets "A Day in the Life of the Internet" (DITL) is a largescale data collection project undertaken by CAIDA and DNS-OARC every year since hours packet capture at root DNS servers and other DNS servers Source IP addresses of i.root-servers.net data are anonymized Year Start(UTC) End Analyzed data from 2011 Apr Apr a,c,d,e,f,h,j,k,l,m (10/13) 2012 Apr Apr a,c,e,f,h,j,k,l,m (9/13) 2013 May May a,c,d,e,f,h,j,k,l,m (10/13) 2014 Apr Apr a,c,e,f,h,j,k,m (8/13) 3

4 JP datasets.jp has 1,417,317 registered domain names on March 1, 2016 JP DNS servers serve approx. 1.6 billion queries per day Two datasets Packet captures of all JP DNS servers, around the same time as DNS- OARC s DITL event (and more) since 2009 Query logs of 2 (A and G) JP DNS servers, every day, for 13 years Name Operator Location Address (IPv4:7, IPv6:6, total 13) Capture A.DNS.JP JPRS JP* , 2001:dc4::1 Pcap/Log B.DNS.JP JPNIC JP* , 2001:dc2::1 Pcap C.DNS.JP JPRS Worldwide , 2001:502:ad09::5 Pcap D.DNS.JP IIJ JP*2, US* , 2001:240::53 Pcap E.DNS.JP WIDE JP*1, US*1, FR* , 2001:200:c000::35 Pcap F.DNS.JP NII JP* , 2001:2f8:0:100::153 Pcap G.DNS.JP JPRS JP* Pcap/Log 4

5 Evaluation indexes Number of registered IDN domain names (JP) Query ratio of IDN (JP, Root) Ratio of IP addresses that sent IDN queries (JP, Root) 5

6 2001/3/1 2002/3/1 2003/3/1 2004/3/1 2005/3/1 2006/3/1 2007/3/1 2008/3/1 2009/3/1 2010/3/1 2011/3/1 2012/3/1 2013/3/1 2014/3/1 2015/3/1 Number of registered JP 1,600,000 1,400,000 1,200,000 1,000, , , , ,000 0 domain names Total IDN Registration Number of JP domain names are increasing gradually 6

7 2001/3/1 2002/3/1 2003/3/1 2004/3/1 2005/3/1 2006/3/1 2007/3/1 2008/3/1 2009/3/1 2010/3/1 2011/3/1 2012/3/1 2013/3/1 2014/3/1 2015/3/1 Number of IDN registrations in JP 160, , , ,000 80,000 60,000 40,000 20,000 0 Number of IDN registration in JP is not increasing now 7

8 Query ratio of IDN at JP DNS(all, 48h) 0.30% Query ratio of third level or below IDN Query ratio of non-existing IDN 0.25% Query ratio of existing IDN 0.20% 0.15% 0.10% 0.05% 0.00% Queries that contain xn label is now about 0.25% IDN queries seems to be increasing a little Non-existing IDN queries are small at JP 8

9 3.5% 3.0% 2.5% 2.0% 1.5% 1.0% 0.5% 0.0% IP address ratio that sent IDN queries to JP DNS servers (all, 48h) 4.0% Existing IDN Non-existing IDN Third level or below IDN Any IDN Now, 3 % of IP addresses send IDN queries at JP Ratio of IP addresses that send IDN queries may increasing (It is not clear) 9

10 Long term trends of IDN queries at part of JP DNS servers (A, G, daily) 4.0% Ratio of Ipaddr that send IDN queries within 24 hours 3.5% Ratio of IDN queries 3.0% 2.5% 2.0% 1.5% 1.0% 0.5% 0.0% The graph shows increasing tendency, however, irregular data is larger. Recently, IDN queries are 0.2% and 2.5% of IP addresses send IDN queries 10

11 Long term trends of IDN queries seen at part of JP DNS servers (A, G, monthly) 2.5% Ratio of IPaddr that send IDN related Ratio of IDN queries 2.0% 1.5% 1.0% 0.5% 0.0% Ratio of IP addresses that sent IDN queries may increasing, 2% (It is not clear) Ratio of IDN queries may be increasing (very small, 0.2% now) 11

12 Long term trends of IDN ratio, monthly 16% Ratio of IDN Registration 14% Ratio of IPaddr that send IDN 12% Ratio of IPaddr that send IDN related Ratio of IDN queries 10% 8% 6% 4% 2% 0% Ratio of IDN queries may be increasing (very small ratio 0.2%) Ratio of IP addresses that sent IDN query may be increasing 12

13 Number of IDN queries at Root Existing IDN TLD queries (48hours) Nonexisting IDN TLD queries IDN SLD queries Third level or below IDN queries 60,000,000 50,000,000 40,000,000 30,000,000 20,000,000 10,000,000 0 Number of IDN queries seems to be increasing 13

14 Query ratio of IDN at Root (48h) 0.12% Existing IDN TLD Non-existing IDN TLD Second level IDN Third level or below IDN 0.10% 0.08% 0.06% 0.04% 0.02% 0.00% Ratio of IDN queries seems to be increasing. Non-existing IDN TLD is high ratio. 14

15 Number of IP addresses that sent IDN at Root (48h) 160, , , ,000 80,000 60,000 40,000 20,000 0 Existing TLD Non-existing TLD IDN SLDs Third level or below 2006/1/ /1/9 2008/3/ /3/ /4/ /4/ /4/ /5/ /4/ /4/13 Number of IP addresses that sent IDN seems to be increasing 15

16 Ratio of IP addresses that sent 3.0% 2.5% IDN seen at Root (48h) 2006/1/ /1/9 2008/3/ /3/ /4/ /4/ /4/ /5/ /4/ /4/13 2.0% 1.5% 1.0% 0.5% 0.0% IPaddr ratio of existing IDN TLDs IPaddr ratio of nonexisting IDN TLDs IPaddr ratio of any IDN Ratio of IP addresses that sent IDN seems to be increasing and now 1.5% or 2.5% 16

17 IDN query ratio from each country seen at Root (48h) 0.20% RU DE AU CA 00ALL US ES FR 0.18% 0.16% NL JP AR GB BR IN CN IT 0.14% 0.12% 0.10% 0.08% 0.06% 0.04% 0.02% 0.00% Determined by Maxmind GeoLite2 free country database Countries whose number of IP address is larger than 100,000 only. IDN query ratio from Russian IP addresses may be increasing. Other countries, IDN query ratio is little 17

18 Query source IP address ratio that sent IDN queries from each country seen at 18.0% 16.0% 14.0% 12.0% 10.0% 8.0% 6.0% 4.0% 2.0% 0.0% Root (48h) RU 00ALL JP US GB BR CA NL CN ES AU IN FR IT AR DE Determined by Maxmind GeoLite2 free country database Countries whose number of IP addresses is larger than 100,000 only. IDN use in Russia seems to be high. (I don t know) Other countries, IDN usage ratio is small 18

19 Ratio of IP addresses that send queries to each TLD (2015 data) 80% 70% 60% 50% 40% 30% 20% 10% 0% Top TLDs are com, net, (ru), org, arpa,. ALL RU From Russian IP address, No. 35 TLD is IDN. 15.7% of Russian IP addresses send xn--p1ai рф (It is the top IDN TLD.) 15.7% of Russian IP addresses sent xn--p1ai (.рф, Russian TLD) queries. Some new gtlds are used more often than IDN TLDs From all IP addresses, No. 211 TLD is IDN. 1.4% of IP addresses send xn--p1ai (рф). 39.7% of them are Russian IP addresses. TLD rank Top 210 Well used new gtlds are here club, xyz, link 19

20 Findings Query ratio of IDN is very low now 0.2% at JP and 0.1% at Root DNSSEC is higher than IDN: 5% is DS at JP However, the query ratio seems to be increasing Ratio of IP addresses that sent IDN queries is still low. 2.5%~3% at JP and 2% at Root DNSSEC is higher than IDN 8.7% of IP addresses send <dom>.jp DS queries 5~10% of IP addresses send root DNSKEY queries However, ratio of IP addresses that send IDN queries seems to be increasing 15.7% of Russian address sent Russian IDN TLD queries. IDN TLD.рф seems to be well used in Russia An increasing trend is observed about IDN However, it is uncertain. Needs further analysis Deployment status: IPv6 >> DNSSEC > new gtld, IDN? 20

21 Acknowledgements DNS-OARC as the data source of Root dataset 21