Open Recursive Nameservers
|
|
|
- Gwen Atkins
- 5 years ago
- Views:
Transcription
1 P. van Abswoude P. Tavenier System and Network Engineering University of Amsterdam February 7, / 17
2 What we are going to tell... What is the problem? Introduction What is a Caching Open Recursive Nameserver? Reconnaissance work DNS query (maximum UDP packet size) DNS answer (TXT records) UDP and DNSSEC An actual DNS DDoS attack Defending strategies Do we have to be concerned of large DNS DDoS attacks using CORNS? 2 / 17
3 Once Upon A Time... The Internet was a happy place where it was easy to help your friends and neighbors: Telnet was THE remote administration tool/protocol Open SMTP relays were the norm rather than the exception Nameservers were Open Recursive... etc. In short: the Internet was build to be used by everybody NOT abused! 3 / 17
4 But unfortunately, things change... In 2006 several high-impact Distributed Denial of Service (DDoS) attacks. Primary attackers: Caching further revered to as CORNs. 4 / 17
5 But unfortunately, things change... In 2006 several high-impact Distributed Denial of Service (DDoS) attacks. Primary attackers: Caching further revered to as CORNs. 4 / 17
6 What is a CORN? What is a DNS server? Converts FQDN to IP-addresses and vice versa What is a Open Recursive Nameserver (further: ORN) A recursive NS for the whole wide world What is Caching Open Recursive Nameserver 5 / 17
7 What is a CORN? What is a DNS server? Converts FQDN to IP-addresses and vice versa What is a Open Recursive Nameserver (further: ORN) A recursive NS for the whole wide world What is Caching Open Recursive Nameserver 5 / 17
8 What is a CORN? What is a DNS server? Converts FQDN to IP-addresses and vice versa What is a Open Recursive Nameserver (further: ORN) A recursive NS for the whole wide world What is Caching Open Recursive Nameserver 5 / 17
9 What is a CORN? What is a DNS server? Converts FQDN to IP-addresses and vice versa What is a Open Recursive Nameserver (further: ORN) A recursive NS for the whole wide world What is Caching Open Recursive Nameserver 5 / 17
10 What is a CORN? What is a DNS server? Converts FQDN to IP-addresses and vice versa What is a Open Recursive Nameserver (further: ORN) A recursive NS for the whole wide world What is Caching Open Recursive Nameserver 5 / 17
11 Reconnaissance work... How to create a list of Nameservers? How to determine if they are Open Recursive? How to determine if they cache? How to determine if the NS is a forwarder? 6 / 17
12 Reconnaissance work... How to create a list of Nameservers? How to determine if they are Open Recursive? How to determine if they cache? How to determine if the NS is a forwarder? 6 / 17
13 Reconnaissance work... How to create a list of Nameservers? How to determine if they are Open Recursive? How to determine if they cache? How to determine if the NS is a forwarder? 6 / 17
14 Reconnaissance work... How to create a list of Nameservers? How to determine if they are Open Recursive? How to determine if they cache? How to determine if the NS is a forwarder? 6 / 17
15 Zonefile NS NS (without timed-out) CORNs.int (inside.int domain) (36%).int (outside.int domain) (32%).edu (inside.edu domain) (50%).edu (outside.edu domain) (42%) totals (46%) Table: Total numbers zonefiles statistics DNS Measurement estimates nameservers running on the Internet. With our test results we could estimate nameservers are CORNs! 7 / 17
16 The query (maximum DNS UDP packet sizes)... Maximum DNS UDP packet size: 512 bytes Normal DNS query size: 50 bytes 8 / 17
17 The query (maximum DNS UDP packet sizes)... Maximum DNS UDP packet size: 512 bytes Normal DNS query size: 50 bytes 8 / 17
18 The answer (TXT records)... Already explained: Maximum DNS UDP packet size: 512 bytes Normal DNS query size: 50 bytes Normal DNS answer size: 200 bytes Question: How to get the answer to 512 bytes Answer: TXT records (maybe other RRs?) 9 / 17
19 The answer (TXT records)... Already explained: Maximum DNS UDP packet size: 512 bytes Normal DNS query size: 50 bytes Normal DNS answer size: 200 bytes Question: How to get the answer to 512 bytes Answer: TXT records (maybe other RRs?) 9 / 17
20 The answer (TXT records)... Already explained: Maximum DNS UDP packet size: 512 bytes Normal DNS query size: 50 bytes Normal DNS answer size: 200 bytes Question: How to get the answer to 512 bytes Answer: TXT records (maybe other RRs?) 9 / 17
21 The answer (TXT records)... Already explained: Maximum DNS UDP packet size: 512 bytes Normal DNS query size: 50 bytes Normal DNS answer size: 200 bytes Question: How to get the answer to 512 bytes Answer: TXT records (maybe other RRs?) 9 / 17
22 UDP and DNSSEC... Already explained: Question: How to get the answer to 512 bytes Answer: TXT records With DNSSEC extension enabled: bump up to 2048 bytes!!! 10 / 17
23 UDP and DNSSEC... Already explained: Question: How to get the answer to 512 bytes Answer: TXT records With DNSSEC extension enabled: bump up to 2048 bytes!!! 10 / 17
24 Figure: DNSSEC and UDP 11 / 17
25 Figure: Authority section zoomed in 12 / 17
26 An actual DNS DDoS attack... We conducted 3 tests. Following statistics gathered from our own CORN. incoming: 148KB/s outgoing: 5430 KB/s incoming: 151KB/s outgoing: 5670 KB/s incoming: 149KB/s outgoing: 5441 KB/s Each byte that comes in (the query) the victim will get a answer that is times greater! You need about % bandwidth of the victim you attack. 13 / 17
27 An actual DNS DDoS attack... We conducted 3 tests. Following statistics gathered from our own CORN. incoming: 148KB/s outgoing: 5430 KB/s incoming: 151KB/s outgoing: 5670 KB/s incoming: 149KB/s outgoing: 5441 KB/s Each byte that comes in (the query) the victim will get a answer that is times greater! You need about % bandwidth of the victim you attack. 13 / 17
28 An actual DNS DDoS attack... We conducted 3 tests. Following statistics gathered from our own CORN. incoming: 148KB/s outgoing: 5430 KB/s incoming: 151KB/s outgoing: 5670 KB/s incoming: 149KB/s outgoing: 5441 KB/s Each byte that comes in (the query) the victim will get a answer that is times greater! You need about % bandwidth of the victim you attack. 13 / 17
29 Defending strategies Nameserver config solutions Disable Open Recursion Use Access Control Lists Create Views Get your logging straight NOT nameserver config solutions (firewall, routers etc.) 14 / 17
30 Further Research How many servers have DNSSEC enabled? Are there any CORNs behind forwarders? Is there a way to conduct this kind of attack with other RRs? Could you use ORNs and still stay undetected? 15 / 17
31 Question to the audience... Do we have to be concerned of large DNS DDoS attacks? Our opinion: YES! and definitely with the upcoming of DNSSEC 16 / 17
32 Question to the audience... Do we have to be concerned of large DNS DDoS attacks? Our opinion: YES! and definitely with the upcoming of DNSSEC 16 / 17
33 Question to the audience... Do we have to be concerned of large DNS DDoS attacks? Our opinion: YES! and definitely with the upcoming of DNSSEC 16 / 17
34 Questions? 17 / 17
Open Recursive Nameservers
Open Recursive Nameservers What s the problem with that? Students: P. van Abswoude P. Tavenier Supervising teachers: J.P. Velders K. Koymans System and Network Engineering University of Amsterdam Final
Using DNS Service for Amplification Attack
Using DNS Service for Amplification Attack Outline Use DNS service to achieve load balancing for a server cluster Carry out an amplification attack by taking advantage of DNS service Enforce firewall rules
CSCE 463/612 Networks and Distributed Processing Spring 2018
CSCE 463/612 Networks and Distributed Processing Spring 2018 Application Layer IV Dmitri Loguinov Texas A&M University February 13, 2018 1 Chapter 2: Roadmap 2.1 Principles of network applications 2.2
Network Working Group Request for Comments: Category: Best Current Practice October 2008
Network Working Group Request for Comments: 5358 BCP: 140 Category: Best Current Practice J. Damas ISC F. Neves Registro.br October 2008 Preventing Use of Recursive Nameservers in Reflector Attacks Status
Managing Caching DNS Server
This chapter explains how to set the Caching DNS server parameters. Before you proceed with the tasks in this chapter, see Introduction to the Domain Name System which explains the basics of DNS. Configuring
Review for Internet Introduction
Review for Internet Introduction What s the Internet: Two Views View 1: Nuts and Bolts View billions of connected hosts routers and switches protocols control sending, receiving of messages network of
Improving DNS Security and Resiliency. Carlos Vicente Network Startup Resource Center
Improving DNS Security and Resiliency Carlos Vicente Network Startup Resource Center Threats to DNS Server crashes Server compromise Denial of service attacks Amplification attacks Cache poisoning Targeted
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder. System and Network Engineering July 2014
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder System and Network Engineering July 2014 DNS Main Components Server Side: Authoritative Servers Resolvers (Recursive Resolvers, cache) Client
CSC Network Security
CSC 474 -- Security Topic 9. Firewalls CSC 474 Dr. Peng Ning 1 Outline Overview of Firewalls Filtering Firewalls Proxy Servers CSC 474 Dr. Peng Ning 2 Overview of Firewalls CSC 474 Dr. Peng Ning 3 1 Internet
Introduction to the Domain Name System
The Domain Name System (DNS) handles the growing number of Internet users. DNS translates names, such as www.cisco.com, into IP addresses, such as 192.168.40.0 (or the more extended IPv6 addresses), so
Introduction to Network. Topics
Introduction to Network Security Chapter 7 Transport Layer Protocols 1 TCP Layer Topics Responsible for reliable end-to-end transfer of application data. TCP vulnerabilities UDP UDP vulnerabilities DNS
This time. Digging into. Networking. Protocols. Naming DNS & DHCP
This time Digging into Networking Protocols Naming DNS & DHCP Naming IP addresses allow global connectivity But they re pretty useless for humans! Can t be expected to pick their own IP address Can t be
DENIAL OF SERVICE ATTACKS
DENIAL OF SERVICE ATTACKS Ezell Frazier EIS 4316 November 6, 2016 Contents 7.1 Denial of Service... 2 7.2 Targets of DoS attacks... 2 7.3 Purpose of flood attacks... 2 7.4 Packets used during flood attacks...
The DNS. Application Proxies. Circuit Gateways. Personal and Distributed Firewalls The Problems with Firewalls
Network Security - ISA 656 Application Angelos Stavrou August 20, 2008 Application Distributed Why move up the stack? Apart from the limitations of packet filters discussed last time, firewalls are inherently
Firewalls and NAT. Firewalls. firewall isolates organization s internal net from larger Internet, allowing some packets to pass, blocking others.
Firews and NAT 1 Firews By conventional definition, a firew is a partition made of fireproof material designed to prevent the spread of fire from one part of a building to another. firew isolates organization
Overview. Last Lecture. This Lecture. Next Lecture. Scheduled tasks and log management. DNS and BIND Reference: DNS and BIND, 4 th Edition, O Reilly
Last Lecture Overview Scheduled tasks and log management This Lecture DNS and BIND Reference: DNS and BIND, 4 th Edition, O Reilly Next Lecture Address assignment (DHCP) TELE 301 Lecture 11: DNS 1 TELE
Authoritative-only server & TSIG
Authoritative-only server & TSIG cctld workshop Apia, Samoa,20 23 June 2006 Andy Linton (Materials by Alain Aina) Different type of servers Several types of name servers Authoritative servers master (primary)
CSE 473 Introduction to Computer Networks. Midterm Exam Review
CSE 473 Introduction to Computer Networks Midterm Exam Review John DeHart 10/12/2015 1. (10 points). A user in Chicago, connected to the internet via a 100 Mb/s (b=bits) connection retrieves a 250 KB (B=bytes)
A proposal of a countermeasure method against DNS amplification attacks using distributed filtering by traffic route changing
A proposal of a countermeasure method against DNS amplification attacks using distributed filtering by traffic route changing Yuki Katsurai *, Yoshitaka Nakamura **, and Osamu Takahashi ** * Graduate School
Chapter 19. Domain Name System (DNS)
Chapter 19 Domain Name System (DNS) TCP/IP Protocol Suite 1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. OBJECTIVES: To describe the purpose of DNS. To define
Denial of Service. Eduardo Cardoso Abreu - Federico Matteo Bencic - Pavel Alexeenko -
Denial of Service Eduardo Cardoso Abreu - e.abreu@fe.up.pt Federico Matteo Bencic - up201501013@fe.up.pt Pavel Alexeenko - ei11155@fe.up.pt Index What is Denial of Service (DoS)? DoS vs DDoS (Distributed
4. The transport layer
4.1 The port number One of the most important information contained in the header of a segment are the destination and the source port numbers. The port numbers are necessary to identify the application
Chapter 8 roadmap. Network Security
Chapter 8 roadmap 8.1 What is network security? 8.2 Principles of cryptography 8.3 Message integrity 8.4 Securing e-mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7 Securing
Network Security Part 3 Domain Name System
Network Security Part 3 Domain Name System Domain Name System The$domain$name$system$(DNS)$is$an$applica6on7layer$ protocol$$for$mapping$domain$names$to$ip$addresses$ DNS www.example.com 208.77.188.166
ERT Threat Alert New Risks Revealed by Mirai Botnet November 2, 2016
Abstract The Mirai botnet struck the security industry in three massive attacks that shook traditional DDoS protection paradigms, proving that the Internet of Things (IoT) threat is real and the grounds
Transaction oriented DNS flow analysis (WIP)
Transaction oriented DNS flow analysis (WIP) Shigeya Suzuki / Bill Manning WIDE Project USC/ISI & Keio University + Auto-ID Labs Japan CAIDA Workshop 2006 @ISI, March 17th 2006 Topics Current on-going
DNSSEC All You Need To Know To Get Started
DNSSEC All You Need To Know To Get Started Olaf M. Kolkman RIPE NCC A Semi Technical Introduction Why do we need DNSSEC What does DNSSEC provide How does DNSSEC work Question: www.ripe.net A Reminder:
Application Firewalls
Application Moving Up the Stack Advantages Disadvantages Example: Protecting Email Email Threats Inbound Email Different Sublayers Combining Firewall Types Firewalling Email Enforcement Application Distributed
Layer 4: UDP, TCP, and others. based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers
Layer 4: UDP, TCP, and others based on Chapter 9 of CompTIA Network+ Exam Guide, 4th ed., Mike Meyers Concepts application set transport set High-level, "Application Set" protocols deal only with how handled
DNS Authentication-as-a-Service Preventing Amplification Attacks
DNS Authentication-as-a-Service Preventing Amplification Attacks Amir Herzberg Bar-Ilan University Haya Shulman Technische Universität Darmstadt Denial of Service Attacks: Statistics Reported bandwidths
ECE 650 Systems Programming & Engineering. Spring 2018
ECE 650 Systems Programming & Engineering Spring 2018 Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) Tyler Bletsch Duke University Slides are adapted from Brian Rogers (Duke) Dynamic
Local DNS Attack Lab. 1 Lab Overview. 2 Lab Tasks (Part I): Setting Up a Local DNS Server. SEED Labs Local DNS Attack Lab 1
SEED Labs Local DNS Attack Lab 1 Local DNS Attack Lab Copyright 2018 Wenliang Du, Syracuse University. The development of this document was partially funded by the National Science Foundation under Award
Agenda. Review DNS Fundamentals DNS Security Summary 1/22
Agenda Review DNS Fundamentals DNS Security Summary 1/22 Which of the following is NOT a commonly used routing metric? A. Hop count B. Bandwidth C. Delay D. Destination s IP address E. Reliability of links
Root Servers. Root hints file come in many names (db.cache, named.root, named.cache, named.ca) See root-servers.org for more detail
What is DNS? Systems to convert domain names into ip addresses: For an instance; www.tashicell.com 118.103.136.66 Reverse: 118.103.136.66 www.tashicell.com DNS Hierarchy Root Servers The top of the DNS
Exploring CVE , a Skeleton key in DNS. Jaime Cochran, Marek Vavrusa
Exploring CVE-2015-7547, a Skeleton key in DNS Jaime Cochran, Marek Vavrusa What is this about? Vulnerability in glibc DNS clients Similar to CVE-2015-0235 GHOST 2015-07-13 reported 2016-02-16 disclosed
20-CS Cyber Defense Overview Fall, Network Basics
20-CS-5155 6055 Cyber Defense Overview Fall, 2017 Network Basics Who Are The Attackers? Hackers: do it for fun or to alert a sysadmin Criminals: do it for monetary gain Malicious insiders: ignores perimeter
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 18: Network Attacks Department of Computer Science and Engineering University at Buffalo 1 Lecture Overview Network attacks denial-of-service (DoS) attacks SYN
Computer Security and Privacy
CSE P 590 / CSE M 590 (Spring 2010) Computer Security and Privacy Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others for
Rolling the Root KSK. Geoff Huston. APNIC Labs. September 2017
Rolling the Root KSK Geoff Huston APNIC Labs September 2017 Will this break the Internet? Why? If we stuff up this trust anchor key roll then resolvers that perform DNSSEC validation will fail to provide
Security+ Guide to Network Security Fundamentals, Fourth Edition. Network Attacks Denial of service Attacks
Security+ Guide to Network Security Fundamentals, Fourth Edition Network Attacks Denial of service Attacks Introduction: What is DoS? DoS attack is an attempt (malicious or selfish) by an attacker to cause
Lab Guide 1 - Basic Configuration and Interface Configuration
IXP Workshop Lab Lab Guide 1 - Basic Configuration and Interface Configuration Objective: All the workshop lab routers are set to the default configuration and cabling requirements are prebuild according
A Root DNS Server. Akira Kato. Brief Overview of M-Root. WIDE Project
A Root DNS Server Akira Kato WIDE Project kato@wide.ad.jp Brief Overview of M-Root Assumes basic knowledge on DNS Dr. Tatsuya Jinmei has introduced in Nov 19, 2004 What s Root Servers? Start point of the
Chapter 2 Application Layer. Lecture 5 DNS. Computer Networking: A Top Down Approach. 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012
Chapter 2 Application Layer Lecture 5 DNS Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 Application Layer 2-1 Chapter 2: outline 2.1 principles
CSCI 466 Midterm Networks Fall 2013
CSCI 466 Midterm Networks Fall 2013 Name: This exam consists of 6 problems on the following 7 pages. You may use your single-sided hand-written 8 ½ x 11 note sheet and a calculator during the exam. No
Toward Unspoofable Network Identifiers. CS 585 Fall 2009
Toward Unspoofable Network Identifiers CS 585 Fall 2009 The Problem DNS Spoofing Attacks (e.g., Kaminsky) At link (Ethernet) and IP layers, either: Software sets the source address in the packet, or Software
The Interactive Guide to Protecting Your Election Website
The Interactive Guide to Protecting Your Election Website 1 INTRODUCTION Cloudflare is on a mission to help build a better Internet. Cloudflare is one of the world s largest networks. Today, businesses,
DNS. DNS is an example of a large scale client-server application.
DNS Domain Name System: DNS Objective: map names to IP addresses (i.e., high level names to low level names) Original namespace was flat, didn t scale.. Hierarchical naming permits decentralization by
Cloudflare Advanced DDoS Protection
Cloudflare Advanced DDoS Protection Denial-of-service (DoS) attacks are on the rise and have evolved into complex and overwhelming security challenges. 1 888 99 FLARE enterprise@cloudflare.com www.cloudflare.com
IPv6 Commands: ipv6 h to ipv6 mi
IPv6 Commands: ipv6 h to ipv6 mi ipv6 hello-interval eigrp, page 3 ipv6 hold-time eigrp, page 5 ipv6 hop-limit, page 7 ipv6 host, page 8 ipv6 icmp error-interval, page 10 ipv6 inspect, page 12 ipv6 inspect
DNS SECURITY BEST PRACTICES
White Paper DNS SECURITY BEST PRACTICES Highlights Have alternative name server software ready to use Keep your name server software up-to-date Use DNSSEC-compliant and TSIG-compliant name server software
snoc Snoc DDoS Protection Fast Secure Cost effective Introduction Snoc 3.0 Global Scrubbing Centers Web Application DNS Protection
Snoc DDoS Protection Fast Secure Cost effective sales@.co.th www..co.th securenoc Introduction Snoc 3.0 Snoc DDoS Protection provides organizations with comprehensive protection against the most challenging
The Domain Name System
The Domain Name System Antonio Carzaniga Faculty of Informatics University of Lugano March 27, 2007 c 2005 2007 Antonio Carzaniga 1 IP addresses and host names DNS architecture DNS process DNS requests/replies
DNS and SMTP. James Walden CIT 485: Advanced Cybersecurity. James WaldenCIT 485: Advanced Cybersecurity DNS and SMTP 1 / 31
DNS and SMTP James Walden CIT 485: Advanced Cybersecurity James WaldenCIT 485: Advanced Cybersecurity DNS and SMTP 1 / 31 Table of contents 1. DNS 2. DNS Protocol Packets 3. DNS Caching 4. DNS Cache Poisoning
BEST PRACTICES FOR IMPROVING EXTERNAL DNS RESILIENCY AND PERFORMANCE
BEST PRACTICES FOR IMPROVING EXTERNAL DNS RESILIENCY AND PERFORMANCE 12-07-2016 BEST PRACTICES FOR IMPROVING EXTERNAL DNS RESILIENCY AND PERFORMANCE Your external DNS is a mission critical business resource.
DNS Basics BUPT/QMUL
DNS Basics BUPT/QMUL 2018-04-16 Related Information Basic function of DNS Host entry structure in Unix Two system calls for DNS database retrieving gethostbyname () gethostbyaddr () 2 Agenda Brief introduction
Application Layer: , DNS
Application Layer: E-mail, DNS EECS 3214 Slides courtesy of J.F Kurose and K.W. Ross, All Rights Reserved 22-Jan-18 1-1 Chapter 2: outline 2.1 principles of network applications 2.2 Web and HTTP 2.3 electronic
ECE 435 Network Engineering Lecture 7
ECE 435 Network Engineering Lecture 7 Vince Weaver http://web.eece.maine.edu/~vweaver vincent.weaver@maine.edu 25 September 2018 HW#3 was Posted Announcements 1 HW#2 Review C code will be discussed next
OFF-PATH ATTACKS AGAINST PUBLIC KEY INFRASTRUCTURES. Markus Brandt, Tianxiang Dai, Elias Heftrig, Amit Klein, Haya Shulman, Michael Waidner
OFF-PATH ATTACKS AGAINST PUBLIC KEY INFRASTRUCTURES Markus Brandt, Tianxiang Dai, Elias Heftrig, Amit Klein, Haya Shulman, Michael Waidner 1 AGENDA Objectives Attacking Impact Mitigation Summary 2 AGENDA
Closed book. Closed notes. No electronic device.
414-S17 (Shankar) Exam 3 PRACTICE PROBLEMS Page 1/6 Closed book. Closed notes. No electronic device. 1. Anonymity Sender k-anonymity Receiver k-anonymity Authoritative nameserver Autonomous system BGP
DNS & Iodine. Christian Grothoff.
DNS & Iodine christian@grothoff.org http://grothoff.org/christian/ The Domain Name System is the Achilles heel of the Web. Tim Berners-Lee 1 DNS: Domain Name System Unique Distributed Database Application-layer
Remote User - Mediatrix SBC on the Edge
Mediatrix Sentinel and Mediatrix 3000 v. 2.0.40.747 2018-03-29 Table of Contents Table of Contents to Know Before Starting 4 Remote Users - Mediatrix SBC Located on the Edge 5 Getting Started 5 Logging
Naming. To do. q What s in a name q Flat naming q Structured naming q Attribute-based naming q Next: Content distribution networks
Naming To do q What s in a name q Flat naming q Structured naming q Attribute-based naming q Next: Content distribution networks What's in a name? That which we call a rose By any other name would smell
Note: This document is still a draft, the research is not completed. Abstract
K-root measurements Yuri Schaeffer 1, NLnet Labs NLnet Labs document 2010-001 February 17, 2010 Note: This document is still a draft, the research is not completed. Abstract Enabling DNSSEC at the root
CSCE 463/612 Networks and Distributed Processing Spring 2018
CSCE 463/612 Networks and Distributed Processing Spring 2018 Application Layer III Dmitri Loguinov Texas A&M University February 8, 2018 Original slides copyright 1996-2004 J.F Kurose and K.W. Ross 1 Chapter
Remote User - Mediatrix SBC on the Edge
Mediatrix Sentinel and Mediatrix 3000 v. 43.3.1398 2018-12-13 Table of Contents Table of Contents Information to Know Before Starting 4 Remote Users - Mediatrix SBC Located on the Edge 5 Getting Started
DDoS Testing with XM-2G. Step by Step Guide
DDoS Testing with XM-G Step by Step Guide DDoS DEFINED Distributed Denial of Service (DDoS) Multiple compromised systems usually infected with a Trojan are used to target a single system causing a Denial
Internet Engineering Task Force (IETF) Request for Comments: Category: Best Current Practice ISSN: March 2017
Internet Engineering Task Force (IETF) Request for Comments: 8109 BCP: 209 Category: Best Current Practice ISSN: 2070-1721 P. Koch DENIC eg M. Larson P. Hoffman ICANN March 2017 Initializing a DNS Resolver
CHAPTER 22 DISTRIBUTED APPLICATIONS ANSWERS TO QUESTIONS ANSWERS TO PROBLEMS
CHAPTER 22 DISTRIBUTED APPLICATIONS ANSWERS TO QUESTIONS 22.1 RFC 821 defines SMTP which is the protocol for exchanging email messages. RFC 822 describes the format of those messages. 22.2 The Simple Mail
BIG-IP DNS Services: Implementations. Version 12.0
BIG-IP DNS Services: Implementations Version 12.0 Table of Contents Table of Contents Configuring DNS Express...11 What is DNS Express?...11 About configuring DNS Express...11 Configuring DNS Express
Measuring the effects of DNSSEC deployment on query load
Measuring the effects of DNSSEC deployment on query load Jelte Jansen NLnet Labs NLnet Labs document 26-2 May 1, 26 Abstract Ripe NCC recently started signing the zones on their DNS servers. This document
Domain Name System Security
Slide title 70 pt APITALS Domain Name System Security e subtitle um 30 pt Bengt Sahlin Ericsson Research NomadicLab Bengt.Sahlin@ericsson.com Objectives Provide DNS basics, essential for understanding
Filtering Trends Sorting Through FUD to get Sanity
Filtering Trends Sorting Through FUD to get Sanity NANOG48 Austin, Texas Merike Kaeo merike@doubleshotsecurity.com NANOG 48, February 2010 - Austin, Texas 1 Recent NANOG List Threads ISP Port Blocking
CCNA Exam File with Answers. Note: Underlines options are correct answers.
CCNA Exam File with Answers. Note: Underlines options are correct answers. 1. Which of the following are ways to provide login access to a router? (choose all that apply) A. HTTP B. Aux Port /TELNET C.
UDP-based Amplification Attacks and its Mitigations
UDP-based Amplification Attacks and its Mitigations Yoshiaki Kasahara kasahara@nc.kyushu-u.ac.jp 1/21/2014 APAN 37th in Bandung, Indonesia 1 Summary If you have servers with global IP addresses 1. Make
Re-engineering the DNS One Resolver at a Time. Paul Wilson Director General APNIC channeling Geoff Huston Chief Scientist
Re-engineering the DNS One Resolver at a Time Paul Wilson Director General APNIC channeling Geoff Huston Chief Scientist 1 In this presentation I ll talk about the DNS, and the root server infrastructure
Denial of Service. Serguei A. Mokhov SOEN321 - Fall 2004
Denial of Service Serguei A. Mokhov SOEN321 - Fall 2004 Contents DOS overview Distributed DOS Defending against DDOS egress filtering References Goal of an Attacker Reduce of an availability of a system
Domain Name System Security
Domain Name System Security T-110.4100 Tietokoneverkot October 2008 Bengt Sahlin 2008/10/02 Bengt Sahlin 1 Objectives Provide DNS basics, essential for understanding DNS security
The Domain Name System
The Domain Name System Antonio Carzaniga Faculty of Informatics University of Lugano October 8, 2014 Outline IP addresses and host names DNS architecture DNS process DNS requests/replies Internet applications
BIG-IP DNS Services: Implementations. Version 12.1
BIG-IP DNS Services: Implementations Version 12.1 Table of Contents Table of Contents Configuring DNS Express...9 What is DNS Express?...9 About configuring DNS Express...9 Configuring DNS Express to
Session Overview. ! Introduction! Layer 2 and 3 attack scenarios! CDP, STP & IEEE 802.1q! ARP attacks & ICMP abuse! Discovering & attacking IGPs
Session Overview! Introduction! Layer 2 and 3 attack scenarios! CDP, STP & IEEE 802.1q! ARP attacks & ICMP abuse! Discovering & attacking IGPs! RIP, IGRP, EIGRP and OSPF! Attacking tunnels! GRE intrusion
Context Based Access Control (CBAC): Introduction and Configuration
Context Based Access Control (CBAC): Introduction and Configuration Document ID: 13814 Contents Introduction Prerequisites Requirements Components Used Conventions Background Information What Traffic Do
NETLMM Security Threats on the MN-AR Interface draft-kempf-netlmm-threats-00.txt
Draft summary Reviewers' comments Mailing-list discussion NETLMM Security Threats on the MN-AR Interface draft-kempf-netlmm-threats-00.txt New Terminology 1 MN authentication: Initial authentication of
DDoS on DNS: past, present and inevitable. Töma Gavrichenkov
DDoS on DNS: past, present and inevitable Töma Gavrichenkov DNS DDoS types Volumetric: amplification, other floods Water torture and the likes DNS DDoS problem statement DNS is built on
Important note! Please start with problems 1-4; because your grade is F if you do not reach at least 15 (fifteen) points out of 20 for problems 1-4!
Examination DD2392 Protocols and Principles of the Internet EP2120 Internetworking Date: 10 March 2009 at 8:00 13:00 a) No help material is allowed - You are not allowed to use dictionaries, books, or
Introduction to internetworking, OSI, TCP/IP and Addressing.
Introduction to internetworking, OSI, TCP/IP and Addressing. Network Devices Repeater (Hub) Hubs don t break collision and broadcast domains. So any packet will be forwarded to all ports. Bridge (Switch)
Why Firewalls? Firewall Characteristics
Why Firewalls? Firewalls are effective to: Protect local systems. Protect network-based security threats. Provide secured and controlled access to Internet. Provide restricted and controlled access from
10 Defense Mechanisms
SE 4C03 Winter 2006 10 Defense Mechanisms Instructor: W. M. Farmer Revised: 23 March 2006 1 Defensive Services Authentication (subject, source) Access control (network, host, file) Data protection (privacy
(DNS, and DNSSEC and DDOS) Geoff Huston APNIC
D* (DNS, and DNSSEC and DDOS) Geoff Huston APNIC How to be bad 2 How to be bad Host and application-based exploits abound And are not going away anytime soon! And there are attacks on the Internet infrastructure
OpenFlow DDoS Mitigation
OpenFlow DDoS Mitigation C. Dillon, M. Berkelaar February 9, 2014 University of Amsterdam Quanza Engineering Introduction Distributed Denial of Service attacks Types of attacks Application layer attacks
An Overview of DNSSEC. Cesar Diaz! lacnic.net!
An Overview of DNSSEC Cesar Diaz! cesar@ lacnic.net! 1 DNSSEC??? The DNS Security Extension (DNS SEC) attach special kind of information called criptographic signatures to the queries and response that
Modular Policy Framework. Class Maps SECTION 4. Advanced Configuration
[ 59 ] Section 4: We have now covered the basic configuration and delved into AAA services on the ASA. In this section, we cover some of the more advanced features of the ASA that break it away from a
12 DNS Security Extensions DNS resolution via recursive nameserver DNS request/response format Simple DNS cache poisoning The Dan Kaminsky DNS
12 DNS Security Extensions DNS resolution via recursive nameserver DNS request/response format Simple DNS cache poisoning The Dan Kaminsky DNS vulnerability DNS root servers DNSSEC chain of trust DNSSEC
Internet Load Balancing Guide. Peplink Balance Series. Peplink Balance. Internet Load Balancing Solution Guide
Peplink Balance Internet Load Balancing Solution Guide http://www.peplink.com Copyright 2010 Peplink Internet Load Balancing Instant Improvement to Your Network Introduction Introduction Understanding
DNSSEC: what every sysadmin should know to keep things working
DNSSEC: what every sysadmin should know to keep things working Roland van Rijswijk - Deij roland.vanrijswijk@surfnet.nl About SURFnet National Research and Education Network (NREN) Founded in 1986 > 11000km
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 8
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 8 System Vulnerabilities and Denial of Service Attacks System Vulnerabilities and
How to Add Domains and DNS Records
Configure the Barracuda NextGen X-Series Firewall to be the authoritative DNS server for your domains or subdomains to take advantage of Split DNS or dead link detection. Step 1. Make the X-Series Firewall
Firewall Simulation COMP620
Firewall Simulation COMP620 Firewall Simulation The simulation allows participants to configure their own simulated firewalls using Cisco-like syntax. Participants can take benign or malicious actions
Domain Name System Security
Domain Name System Security T-110.4100 Tietokoneverkot September 2010 Bengt Sahlin 2011/09/27 Bengt Sahlin 1 Objectives Provide DNS basics, essential for understanding DNS security
DNS Security. Ch 1: The Importance of DNS Security. Updated
DNS Security Ch 1: The Importance of DNS Security Updated 8-21-17 DNS is Essential Without DNS, no one can use domain names like ccsf.edu Almost every Internet communication begins with a DNS resolution
Data Sheet. DPtech Anti-DDoS Series. Overview. Series
Data Sheet DPtech Anti-DDoS Series DPtech Anti-DDoS Series Overview DoS (Denial of Service) leverage various service requests to exhaust victims system resources, causing the victim to deny service to