DNS Measurements at the.cn TLD Servers

Transcription

1 2009 Sixth International Conference on Fuzzy Systems and Knowledge Discovery DNS Measurements at the.cn TLD Servers YUCHI Xuebiao China Internet Network Information Center, Graduate University of WANG Xin China Internet Network Information Center, LI Xiaodong China Internet Network Information Center, YAN Baoping Abstract The Domain Name System (DNS) is a fundamental Internet s infrastructure. There have been several studies on DNS measurements such as server workload and deployment characteristics. In this paper, based on the traffic collection spanning a two days period, we present a detailed study of the key characteristics of the.cn Top Level Domain (TLD) name servers which are located at eight different sites. Results demonstrate that properties of these geographically distributed servers vary a lot in terms of traffic load, client population as well as their temporal and spatial patterns. As the Country Code TLD (cctld) for China, only 9% of clients are from domestic, which contribute to nearly 50% of all queries received by these servers. Besides, the validity of queries is also evaluated, which turn out to be better than that of the root servers. 1. Introduction The Domain Name System (DNS) [11] is a fundamental Internet s infrastructure, providing mappings between domain names and Internet Protocol (IP) addresses of network locations which are critical to almost all Internet applications. The data for this mapping is stored in a treestructured distributed database where the DNS hierarchical name space is divided into zones authorized by different name servers. The.CN TLD has experienced a rapid growth in recent years which poses a great challenge to the reliability of.cn DNS service. At present, there are six.cn TLD servers managed by China Internet Network Information Center (CNNIC) [7]. By providing DNS service at the same IP address from multiple geographic or topological locations, anycast technique [3] has been deployed on four of these servers, namely, {b,c,d,e}.dns.cn, except a.dns.cn and ns.cernet.net. As illustrated in Table 1, these six TLD servers own fifteen instances dispersed at eight different sites of China, some of them abroad. There have been several studies devoted to measuring the properties of DNS servers in terms of availability, usage and deployment characteristics, especially for the root servers. Danzig et al. [8] presented an early comprehensive study of DNS traffic in the wide area. Using measurements at a root server, they discovered considerable misbehaving client resolvers and analyzed the characteristics of DNS traffic. Brownlee and Wessels et al. [4, 5, 14, 9, 15] take more recent measurements at the root servers and continue to find more information about DNS traffic. By studying DNS traffic at anycast instances for the C, F and K root servers, [10] analyzed how anycast service affects the worldwide population of Internet users and found significant differences in query distributions among these servers. In this paper, we take detailed measurements at the.cn TLD servers to seek a deep understanding about the.cn TLD s key characteristics, including load distributions, client populations as well as their temporal and spatial patterns. We also take an evaluation for the traffic validity of /09 $ IEEE DOI /FSKD

2 Table 1. Current instance distribution for each.cn TLD server TLD Sever # Instances Site & Location a.dns.cn 1, Beijing, China b.dns.cn 4 c.dns.cn 2 d.dns.cn 3 e.dns.cn 4, Beijing, China, Beijing, China,Seoul, South Korea, Frankfurt, Germany, Beijing, China, Beijing, China, Beijing, China, Guangzhou, China, Frankfurt, Germany, Beijing, China, Chengdu, China, Seoul, South Korea, Guangzhou, China ns.cernet.net 1, Beijing, China the.cn TLD servers. 2. Data Passive measurements are employed by making use of the query log files generated by ISC BIND [1]. Each record of the query log contains a timestamp, the client s source IP address, the source port number used by the client, the query name to be resolved, the query class and the query type, which looks like: 27-Nov :00: queries: info: client #43953: query: IN A - We note that instances belonging to different servers can appear at a same site, and DNS query logs generated by them are placed together without any consideration of partition issues, so the data is not somewhat practical for us to take a particular look at instances of any single name server. Instead, by clustering these instances by their sites, we examine each site s query logs separately. On this basis, we try to gain some knowledge about how the.cn TLD servers load is distributed among these sites and how the assignment of instances to these sites affects the servers overall deployment. 3. General Statistics We collect the full-payload DNS query logs generated by all servers for an 48 hours period from 00:00 Nov. 27 to 24:00 Nov , UTC+8. The volume of the data # Queries Rank by # Queries Figure 1. Number of queries vs. rank of client with the sources rank on the x-axis and the number of queries per source on the y-axis (both in log scales). is Giga Bytes, containing 2,548,244,349 queries from 1,824,307 unique source IP addresses, among which 10,045 are IPv6. The IPv6 clients population and traffic proportion are both small (0.55%, 0.34%, respectively), and there is a special IPv6 server responsible for responding all queries sent by them, therefore the traffic made by IPv6 clients is not considered in this paper. The average number of queries per source is about 1,400; however, the distribution is extremely skewed, as shown in Figure 1. While the 322 busiest sources issuing more than one million contribute about 1/3 to the overall queries (approximately 2.6 million queries per source on average), there are about 43% sources whose queries are below ten, only contributing a little more than 0.1% to the total traffic. There are twenty query types defined in [11]. Table 2 presents the ten most queried types in the data. Not surprisingly, the most common query type is A which is used to query an IPv4 address for a given hostname (about 2/3 of all). AAAA, IPv6 address query, is the next most queried type, followed by PTR, domain name pointer for IP address. In the following we will take a series of analysis to see how different the eight sites act and their correlations in terms of traffic distributions, client populations, domain coverage etc.. 4. Traffic Distributions 4.1. Load Distributions Traffic load can be measured in the volume of queries and client population. Table 3 gives some details of our data sets grouped by different sites, from which we can see large variability in their load distributions. As seen from Table 3, is the busiest site in both measurements. We think this is mainly due to the fact that 541

3 Table 2. Distribution of queries by query types QTYPE Count Percentage (%) A 1,723,298, AAAA 219,429, PTR 164,084, TXT 153,238, MX 147,894, NS 67,486, A6 27,740, ANY 19,236, CNAME 11,324, SOA 3,367, other 2,468, Table 3. Traffic load distribution for each site Size Clients Queries Site Server(s) (GB) (K) (M) a.dns.cn , {b, c, e}.dns.cn {b, c, d}.dns.cn e.dns.cn , {d, e}.dns.cn {b, e}.dns.cn {b, d}.dns.cn , ns.cernet.net is the only site where the name server a.dns.cn located. But this is not adaptive for, which is the only site for ns.cernet.net. In fact, load at tshinghua is the lowest among these eight sites, serving only a handful of clients. This underutilization implies that there might be some configuration problem at this name server. Besides, two other sites and also have their client populations exceed one million. However, number of queries for is relatively smaller than the other two, we note that this site has only one server, namely, e.dns.cn, which is dispersed at four different sites. Note that while the client population of is not the least, its queries scale is exceptional small. Apparently, as a site located in a neighboring country to China, it can t attract much traffic from either domestic China or overseas Site-Level Diurnal Pattern Figure 2 shows the time distribution of DNS querying traffic to all sites. Although their query rates vary a lot, we can find a similar diurnal patterns at most sites: rising in the morning and falling towards midnight. Assuming DNS Number of queries / 10 min x / UTC+8 Time (Hour) Figure 2. Number of queries per 10 minutes during 48-hour observation period at each site. queries are primarily generated by humans instead of machines, we can guess that most traffic are generated by domestic users, or at least, the users following domestic diurnal pattern, which has been confirmed in Section 5. However, traffic at doesn t decline so much in the wee hours just as what the others do, even exceeding to be the highest one during those hours. Similar scene can be found at, even if its traffic is very low. Note that both and are located abroad, we can infer that a considerable proportion of their traffic is from clients who are not following the common diurnal pattern, in other words, they are likely to be located outside China. 5. Geographical Distribution We use geolocation software to map the client IP addresses to their geographic locations (country and continent). The GeoIP databases employed here are from Max- Mind 1, which claims its accuracy rates to be 99.8% at the country level worldwide. Distributions of client population by continents for each site is shown in the left plot of Figure 3; the right one shows the distribution of their corresponding queries. The rightmost column of each plot is the total distribution summing up site-level quantities. From the left plot, we notice that clients of most sites are distributed worldwide. To our surprise, the client population of China is not the largest at most sites. Instead, a large majority of the clients are coming from Europe and North America. The rightmost column shows that the clients from China only contribute up to 9% of the population. Although the proportion of the client population of China is low, queries generated by clients from China are the most which is up to 50%. This can coincide with the extremely skewed distribution observed in Section 3. The

4 fraction of client population (%) total fraction of client queries (%) total NorthAmerica LatinAmerica Europe Oceania Africa AsiaOther China Figure 3. Continental distribution of each site s clients: population (left) and queries (right). Sites Clients Figure 5. Distribution of queries for the top 34,656 heaviest clients. Each stripe presents the portion of one client s queries at one site. 6. Client Coverage Number of queries / min 7 x domestic overseas / UTC+8 Time (Hour) Figure 4. Diurnal patterns of queries from domestic and overseas. The less fluctuating curve indicates heterogeneity among clients. percentages of clients form Europe and North America are still high, contributing to as much as 40% of the total traffic. There are also some exceptions among these sites. Nearly all queries received by and are originated from overseas, which can validate our inference in Section 4.2. The circumstance for is just the opposite, where nearly 86% of clients are from domestic, contributing to over 99% of total queries it received. From above we can learn that name server s placement can do great impact on its clients geographical distribution. By dividing DNS queries into two categories: queries from domestic and overseas, we show the temporal curves for traffic of these two kinds that our servers received in Figure 4, from which we can obtain obvious diurnal patterns for both of them, especially for the domestic one. In this section, we study the loyalty of clients which can be loosely defined as their preference when issuing query to sites. Since there is no obvious division of client population among these sites with 77% of them having sent their queries to more than one site, here we assume a client belongs to a site if it sends most of its queries to this site. By arranging clients into different sets according to their belongingness, Figure 5 depicts the proportions of queries received by different sites for each of the heavy clients, the 34,656 clients whose number of queries exceed 5,000 observed in the 48 hours. Each proportion is presented by a stripe whose color is proportional to the magnitude of the proportion. We can see that these heavy clients have their own preference for certain sites, over a half of them have the same preference for. Since Figure 3 has told us that nearly all DNS queries received by this site are from overseas, thus seems to be the most favorable site for clients from overseas. From the Hinton diagram [12] depicted in Figure 6 where the darker the block is, the more intensive the clients activities are, we can see that queries made by clients belonging to are the most of all. Besides, queries for sites and are very similar, indicating that there must be a large portion of clients who have preference for both of them, switching their queries between each other. However, is very distant to foreign clients, nearly no queries sent by foreign clients are received by this site. By checking up the top 10 busiest clients in GeoIP database, queries from each of whom all exceed 10 million, we find that all these 10 clients are from China Mainland owned by 10 different organizations. Besides, all of them are DNS cache servers belonging to some major ISPs. For example, by querying the PTR record of , we find its hostname is ns1.cn.net. Normally, major ISPs have more end users and IP addresses, so their DNS cache servers usually tend to be much busier. 543

5 Sites Rank of domain names by their number of queries x 10 4 Figure 6. Hinton diagram for the distribution of clients queries for each site. Figure 8. Distribution of queries for the popular domain names (queries > 5,000). Each stripe denotes the proportion of queries for one name at one site. percentage (%) 100.org.cn com.cn.cn.net.cn names population number of queries number of domains Figure 7. Number and queries percentage of different domain. 7. Domain Name Coverage Besides.cn, the.cn TLD zones also contain 41 SLDs (Second Level Domains) including seven generic SLDs (such as.com.cn) and other 34 regional SLDs corresponding to different provinces (such as.bj.cn). After aggregating names according to their domains, we find that.cn is the biggest domain, both in population and querying activities. The second largest one is the generic SLD.com.cn. Figure 7 shows the cumulative distribution of domains in both two scales. We note the three biggest domains,.cn,.com.cn and.net.cn, make up for 81.7% of over 30 million unique names observed in our two days data. Queries for these three domains are also the heaviest, accounting for 88.1% of all. Similar to Figure 5, Figure 8 depicts the distribution of queries at different sites for the popular names (the 37,378 names which are queried over 5,000 times). Both loads for and are so small that few popular names can be seen at these sites. For each of the other sites, percentages of queries for these names are usually the same, which implies that these popular names have less preference for particular sites than clients do, in other words, they have global or overall popularities. However, the situation for is a little different. Stripes for are sparse, and most of them are especially heavy. As most of clients and queries for are overseas, we can learn that clients from overseas have their own interests in certain names. 8. Invalid Queries Not all queries received by DNS server are valid. Previous research [14, 6] has shown that most invalid queries can be classified into nine categories. By checking up the queries within the data collection, six of them are identified, namely, 1. unused query class,a query not of the standard five classes [2]; 2. A-for-A, an A query where the query name is already an IP address; 3. non-printable characters, a query for a name with characters that are not alphanumeric or dash; 4. queries with, to show the wide use of the invalid symbol; 5. RFC 1918 PTR, a PTR query for an IP address from private address space [13]; 6. invalid TLD, a query for a name with a TLD that is not.cn. Queries that do not fall into any of these six categories are considered to be valid here. Most recent study [6] has shown that over 98% of queries received by the root servers are invalid. However, proportions of invalid queries here are not as outstanding as the root s, only contributing to 1.5% of total queries. Details are given in Table 4, from which we can see that invalid TLD is the major source of invalid for both of the.cn and the root servers. Moreover, this percentage for the.cn TLD servers is not so high as the root servers. Obviously, for all the queries of invalid TLD received by the root servers, there are only a few of them referred to the.cn TLD servers 544

6 Table 4. Taxonomy of invalid queries (in %). Category.CN Root unused query class A-for-A non-printable char queries with RFC 1918 PTR invalid TLD Besides, we find that there are 241,611,108 queries (9.51%) from 401,933 sources (22.15%) having the recursion desired (RD) bit set. In fact, the.cn TLD name servers have recursion disabled, therefore these queries cannot be resolved at all. This percentage is also higher than that of the root (2.22%). Note that the RD bit is usually set by stub resolvers, indicating there might be a larger percentage of stub resolvers managed by incompetent system administrators [14]. 9. Conclusions In this paper, we presented measurements of the.cn TLD name servers based on queries collected during a 48-hour period. By studying key characteristics of these servers which are geographically distributed, our results demonstrated a variety of properties of them. According to our analysis, properties of servers located at different sites vary a lot in many ways, such as traffic load, client population as well as their temporal and spatial patterns. We can see that these differences can be greatly affected by their geographical locations as well as number of servers. Besides, as servers for a TLD, their validity of queries turns out to be better than that of the root servers. We conjecture this is due to the fact that cctlds are in the fewer spotlights than the root. The.CN TLD has experienced an explosive growth in recent years, in order to keep on providing DNS services with high quality, perhaps some new sites might be added to optimize the current placement of the.cn TLD servers. Much more insights can be expected from DNS querying logs. For example, characterizing detailed profiles of clients such as their ISP and organization information, as well as some more fine-grained geographical information especially for domestic clients, would enable us a deeper understanding of the usage properties of the.cn TLD. Moreover, evolution patterns would be nicely seen from measurements spanning a longer period. 10. Acknowledgments This work was supported by the Knowledge Innovation Program of the Chinese Academy of Sciences (O ). References [1] ISC BIND. [2] D. E. 3rd, E. Brunner-Williams, and B. Manning. Domain name system IANA considerations(rfc 2929) [3] J. Abley. Hierarchical anycast for global service distribution. ISC technical note, , [4] N. Brownlee, K. Claffy, and E. Nemeth. DNS measurements at a root server. In Proceedings of the IEEE Globecom 01, pages , [5] N. Brownlee, K. Claffy, and E. Nemeth. DNS Root/gTLD performance measurements. In Proceedings of Passive and Active Measurement workshop (PAM), [6] S. Castro, D. Wessels, M. Fomenkov, and K. Claffy. A day at the root of the internet. In ACM SIGCOMM Computer Communication Review, October [7] CNNIC web site. [8] P. B. Danzig, K. Obraczka, and A. Kumar. An analysis of wide-area name server traffic: A study of the internet domain name system. In Proceedings of ACM SIGCOMM, pages , August [9] D.Wessels, M. Fomenkov, N. Brownlee, and K. Claffy. Measurements and laboratory simulations of the upper dns hierarchy. In Proceedings of Passive and Active Measurement workshop (PAM), [10] Z. Liu, B. Huffaker, N. Brownlee, and K. Claffy. Two days in the life of the dns anycast root servers. In Proceedings of Passive and Active Measurement workshop (PAM), [11] P. Mockapetris. Domain Names: Implementation and specification. Internet Request for Comments (RFC 1035), November [12] I. T. Nabney. Netlab: Algorithms for Pattern Recognition. Springer, Berlin, [13] Y. Rekhter, B. Moskowitz, D. Karrenber, G. J. de Groot, and E. Lear. Address allocation for private internets(rfc 1918). February [14] D. Wessels and M. Fomenkov. Wow, thats a lot of packets. In Proceedings of Passive and Active Measurement workshop (PAM), [15] D. Wessels and M. Fomenkov. Is your caching resolver polluting the internet? In Proceedings of the ACM SIGCOMM workshop on Network troubleshooting, page 271C276,