Strange Things Found in an Open Resolver Survey
|
|
|
- Ambrose Harrison
- 5 years ago
- Views:
Transcription
1 Strange Things Found in an Open Resolver Survey Duane Wessels The Measurement Factory/CAIDA WIDE+CAIDA Workshop #9 January 19, 2008 WIDE+CAIDA 0 The Measurement Factory
2 Open Resolvers Defined: A nameserver or other DNS application that forwards queries from anywhere to an authority server. Used in some large-scale DDoS spoofing attacks. Increase susceptibility to cache poisoning and software bugs. Useful for geeks who travel a lot. WIDE+CAIDA 1 The Measurement Factory
3 How Many? Measurement Factory tracks about 450,000 open resolvers from known nameservers. authority servers caching resolvers John Kristoff counted about 16,000,000 by probing every IANA-allocated IPv4 address in April June WIDE+CAIDA 2 The Measurement Factory
4 TMF October 2007 Survey Similar to Kristoff survey, except that we only probed 5% of address space found in a routeviews snapshot. Send queries like $target.$timestamp.openresolvers.org to 87,737,391 targets. Query name contains target address Query name contains timestamp, to add uniqueness and allow gross trip-time measurements. WIDE+CAIDA 3 The Measurement Factory
5 The Model TARGET FORWARDER Reply Query Query QUERIER AUTHSERVER QUERIER sends a QUERY to TARGET Look for that QUERY to reach AUTHSERVER QUERY may or may not go through a FORWARDER AUTHSERVER always answers with a REPLY Expect REPLY to reach QUERIER WIDE+CAIDA 4 The Measurement Factory
6 Closed Resolvers TARGET FORWARDER 1 2 QUERIER AUTHSERVER We say that the Target is a closed resolver if we receive a Reply but the Authserver does not receive a Query. Of all resolvers that we find, 7.2% are Closed. This means that 92.8% of resolvers that we find will forward a Query. WIDE+CAIDA 5 The Measurement Factory
7 Where do Open Target s Queries come from?
8 Open Target, Query from Target TARGET FORWARDER 1 2 QUERIER AUTHSERVER Among open Targets, only 3.7% of Queries are received directly from the Target. WIDE+CAIDA 7 The Measurement Factory
9 Open Target, Query from Forwarder TARGET 2 FORWARDER 1 3 QUERIER AUTHSERVER Among open Targets, 96.3% of Queries are received from a Forwarder. Possibly more than one Forwarder in the path, can t tell. Leads us to believe that most open Targets simply forward queries to their ISP-configured plot distance between target and forwarder WIDE+CAIDA 8 The Measurement Factory
10 Where do Open Target s Replies come from?
11 Open Target, Reply from Target TARGET FORWARDER QUERIER AUTHSERVER For 79.9% of open Targets we a Reply back from the Target. Obviously, most of these also go back through a Forwarder. WIDE+CAIDA 10 The Measurement Factory
12 Open Target, Reply not received TARGET FORWARDER QUERIER AUTHSERVER In about 16.7% of cases, we detect an Open Target at the Authserver, but do not receive a Reply at the Querier. Almost all of these go through a Forwarder. We do not know exactly where the Reply is blocked or dropped. WIDE+CAIDA 11 The Measurement Factory
13 Open Target, Reply from Forwarder TARGET 2 FORWARDER QUERIER AUTHSERVER In 0.3% of cases, a Reply comes back from the Forwarder, instead of the Target! WIDE+CAIDA 12 The Measurement Factory
14 Open Target, Reply from Elsewhere TARGET 2 FORWARDER 1 5?? 4 3 QUERIER AUTHSERVER In 3.2% of cases, a Reply comes back from an address that is neither the Target, nor the Forwarder!! Maybe an intermediate Forwarder that we can t otherwise detect? WIDE+CAIDA 13 The Measurement Factory
15 Other Funny Stuff
16 Changed Peer Port Among both Open and Closed Replies, 20.5% of them came back from a different UDP port! 00:13: IP > : A? 4701fd92.1ca01046.openresolvers.org. (59) 00:13: IP > : UDP, length: 75 00:13: IP > : A? 4701fd92.437dfa47.openresolvers.org. (59) 00:13: IP > : UDP, length: 75 00:13: IP > : A? 4701fd92.73a04448.openresolvers.org. (59) 00:13: IP > : UDP, length: 75 Surprisingly common. Broken NAT? WIDE+CAIDA 15 The Measurement Factory
17 Changed Answers Authserver always answers with Found 49 cases like this, out of 671,329 Open Targets. 00:31: IP > : A? d openresolvers.org. (59) 00:31: IP > : A? d openresolvers.org. (59) 00:31: IP > : 11026* 1/1/0 A (97) 00:31: IP > : 53297*- 1/1/1 A (115) WIDE+CAIDA 16 The Measurement Factory
18 Reply before Query Found 698 cases (out of 671,329 open Targets) where the Querier received a Reply before the Authserver received the Query. In most of these 698 cases, the Reply code is REFUSED, SERVFAIL, or NOERROR with unexpected RDATA. In 76 of the 698 cases, the Querier got multiple Replies (ie, SERVFAIL first, followed by NOERROR later). However, in 8 cases, we got only the expected reply!! Cache hits? Pcap drops? WIDE+CAIDA 17 The Measurement Factory
19 Reply before Query Examples 05:55: IP > : A? 47024dc5.e318fe58.openresolvers.org. (59) 05:55: IP > : /1/0 A (97) 05:55: IP > : 14859% [1au] A? 47024dc5.e318fe58.openresolvers.org. ( 05:55: IP > : 14859* 1/1/1 A (108) 07:52: IP > : A? f.2c1e0b57.openresolvers.org. (59) 07:52: IP > : /0/0 A (75) 07:52: IP > : A? f.2c1e0b57.openresolvers.org. (59) 07:52: IP > : 34621* 1/1/0 A (97) 13:13: IP > : A? 4702b47e.d52314c4.openresolvers.org. (59) 13:13: IP > : 24263* 1/1/0 A (97) 13:13: IP > : 45289% [1au] A? 4702b47e.d52314c4.openresolvers.org. ( 13:13: IP > : 45289* 1/1/1 A (108) In both cases the Forwarder is forwarding for many Targets. These look like cache hits (note no * by first reply query ID) and fingerprint as ISC BIND 9.2.3rc a fingerprints as Nominum CNS WIDE+CAIDA 18 The Measurement Factory
20 Unexpected queries with same ID > tcpdump -n -r pcap dst host and dst port 53 grep -i a.root-servers.net reading from file pcap, link-type EN10MB (Ethernet) 00:20: IP > : A? a.root-servers.net. (44) 00:22: IP > : A? a.root-servers.net. (44) 00:29: IP > : A? a.root-servers.net. (44) 00:47: IP > : A? a.root-servers.net. (44) 00:55: IP > : A? a.root-servers.net. (44) 00:55: IP > : A? a.root-servers.net. (44) 00:55: IP > : A? a.root-servers.net. (44) 01:04: IP > : A? a.root-servers.net. (44) 01:07: IP > : A? a.root-servers.net. (44) 01:10: IP > : A? a.root-servers.net. (44) 01:18: IP > : A? a.root-servers.net. (44) 04:17: IP > : A? a.root-servers.net. (44) Probe host sends queries for a.root-servers.net, but it should not receive them Note all have the same query ID! These addresses could not be fingerprinted (timeout errors). Malware? Buggy CPE? WIDE+CAIDA 19 The Measurement Factory
21 The End
Open Resolvers in COM/NET Resolution!! Duane Wessels, Aziz Mohaisen! DNS-OARC 2014 Spring Workshop! Warsaw, Poland!
Open Resolvers in COM/NET Resolution!! Duane Wessels, Aziz Mohaisen! DNS-OARC 2014 Spring Workshop! Warsaw, Poland! Outine! Why do we care about Open Resolvers?! Surveys at Verisign! Characterizing Open
Domain Name System (DNS) Session 2: Resolver Operation and debugging. Joe Abley AfNOG Workshop, AIS 2017, Nairobi
Domain Name System (DNS) Session 2: Resolver Operation and debugging Joe Abley AfNOG Workshop, AIS 2017, Nairobi DNS Resolver Operation How Resolvers Work (1)! If we've dealt with this query before recently,
Packet Traces from a Simulated Signed Root
Packet Traces from a Simulated Signed Root Duane Wessels DNS-OARC DNS-OARC Workshop Beijing, China November 2009 Background We know from active measurements that some DNS resolvers cannot receive large
(Slightly Updated) Port and Message ID Analysis of Resolvers Querying.com/.net Name Servers Matt Larson David Blacka
(Slightly Updated) Port and Message ID Analysis of Resolvers Querying.com/.net Name Servers Matt Larson David Blacka February 2, 2009 Global DNS Risk Technical Operations Meeting, Atlanta, GA Goals + Primary:
Flexible Testbed for Recursive Resolver Software
Flexible Testbed for Recursive Resolver Software Paul Hoffman DNS-OARC 27, San Jose, CA 30 September 2017 v1 1 Overview The resolver server testbed The test root creator Use case: getting ready for the
Day In The Life of the Internet 2008 Data Collection Event.
Day In The Life of the Internet 2008 Data Collection Event http://www.caida.org/projects/ditl Duane Wessels The Measurement Factory/CAIDA k claffy CAIDA NANOG 42 February 19, 2008 NANOG 42 0 The Measurement
Probing Open Recursive Name Servers
Probing Open Recursive Name Servers John Kristoff jtk@ultradns.net NANOG 37 NSP-Security BoF jtk (jtk@ultradns.net) Probing ORNSs June 6, 2006 1 / 16 ORNS Candidate Data Sets 51,196 reflector attack, Feb.
BIND-USERS and Other Debugging Experiences. Mark Andrews Internet Systems Consortium
BIND-USERS and Other Debugging Experiences Mark Andrews Internet Systems Consortium Mark_Andrews@isc.org http://isc.org BIND-USERS and Other Debugging Experiences We will look at some typical debugging
RIPE Network Coordination Centre. K-root and DNSSEC. Wolfgang Nagele RIPE NCC.
K-root and DNSSEC Wolfgang Nagele RIPE NCC RIPE NCC One of the five Regional Internet Registries Provides IP address and AS number resources to Europe and Middle-East regions DNS related work - Parent
Is Your Caching Resolver Polluting the Internet?
Is Your Caching Resolver Polluting the Internet? Duane Wessels The Measurement Factory, and CAIDA wessels@measurement-factory.com September 2004 SIGCOMM 2004 NetTs 0 The Measurement Factory A Disclaimer
Is Your Caching Resolver Polluting the Internet?
Is Your Caching Resolver Polluting the Internet? Duane Wessels CAIDA & The Measurement Factory, Inc. wessels@measurement-factory.com ABSTRACT Previous research has shown that most of the DNS queries reaching
DNS Session 2: DNS cache operation and DNS debugging. Joe Abley AfNOG 2006 workshop
DNS Session 2: DNS cache operation and DNS debugging Joe Abley AfNOG 2006 workshop How caching NS works (1) If we've dealt with this query before recently, answer is already in the cache easy! Resolver
Is Your Caching Resolver Polluting the Internet?
Is Your Caching Resolver Polluting the Internet? Duane Wessels CAIDA & The Measurement Factory, Inc. wessels@measurement-factory.com ABSTRACT Previous research has shown that most of the DNS queries reaching
A deep dive into heaps of Spoofed DNS Traffic. Lars Nøring PowerTech
A deep dive into heaps of Spoofed DNS Traffic Lars Nøring PowerTech Introduction Lars Nøring (Noring) Introduction Lars Nøring (Noring) PowerTech Information Systems AS ISP established in 1993 DSL/fiber,
DNS Session 2: DNS cache operation and DNS debugging. How caching NS works (1) What if the answer is not in the cache? How caching NS works (2)
D Session 2: D cache operation and D debugging How caching works (1) If we've dealt with this query before recently, answer is already in the cache - easy! Joe Abley AfNOG 2006 workshop Resolver Query
Domain Name System (DNS)
CPSC 360 - Network Programming Domain Name System (DNS) Michele Weigle Department of Computer Science Clemson University mweigle@cs.clemson.edu April 15, 2005 http://www.cs.clemson.edu/~mweigle/courses/cpsc360
Lameness in Reverse DNS
Lameness in Reverse DNS DNS Services Manager, RIPE NCC RIPE 58, Amsterdam http://www.ripe.net 1 History Request from DNS working group in 2006 to monitor DNS lameness RIPE-400 produced in January 2007
Internet Control Message Protocol
Internet Control Message Protocol The Internet Control Message Protocol is used by routers and hosts to exchange control information, and to inquire about the state and configuration of routers and hosts.
Preparation Test AAAA and EDNS0 support Share Your Results Results Reported Testing Period
Testing Recursive Name Servers for IPv6 and EDNS0 Support SAC 017 15 March 2007 Preparation Test AAAA and EDNS0 support Share Your Results Results Reported Testing Period Background The DNS Root Server
DSC on top of PacketQ
DSC on top of PacketQ Johan Ihrén Netnod October 14, 2012 OARC meeting, Toronto, October 14, 2012, DSC on top of PacketQ, johani@netnod.se 1 / 9 DSC Why DSC? De-facto standard, especially among TLDs Why
DNS Cache Poisoning Looking at CERT VU#800113
DNS Cache Poisoning Looking at CERT VU#800113 Nadhem J. AlFardan Consulting Systems Engineer Cisco Systems ANOTHER BORING DNS ISSUE Agenda DNS Poisoning - Introduction Looking at DNS Insufficient Socket
CSE 127: Computer Security Network Security. Kirill Levchenko
CSE 127: Computer Security Network Security Kirill Levchenko November 28, 2017 Network Security Original TCP/IP design: Trusted network and hosts Hosts and networks administered by mutually trusted parties
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover Duane Wessels DNS-OARC 26 San Jose, CA September 29, 2017 Background 2 2017 Root Zone KSK Rollover October 11, 2017! Root zone DNSKEY
Root KSK Rollover Update (or, We're really doing it this time)
Root KSK Rollover Update (or, We're really doing it this time) Andres Pavez IANA LACNIC 29 / LACNOG 4 May 2018 What is the DNSSEC KSK? Two Components ("Keys") with a special mathematical bond Private KSK
Internet Engineering. DNS Message Format. Contents. Robert Elz.
Internet Engineering 241-461 Robert Elz kre@munnari.oz.au kre@coe.psu.ac.th http://fivedots.coe.psu.ac.th/~kre Contents The Domain Name System The DNS Database DNS Protocols DNS Message Formats ueries
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 18: Network Attacks Department of Computer Science and Engineering University at Buffalo 1 Lecture Overview Network attacks denial-of-service (DoS) attacks SYN
ip dhcp-client network-discovery through ip nat sip-sbc
ip dhcp-client network-discovery through ip nat sip-sbc ip dhcp-client network-discovery, page 3 ip dhcp-client update dns, page 5 ip dhcp drop-inform, page 8 ip dhcp-relay information option server-override,
BIG-IP DNS Services: Implementations. Version 12.0
BIG-IP DNS Services: Implementations Version 12.0 Table of Contents Table of Contents Configuring DNS Express...11 What is DNS Express?...11 About configuring DNS Express...11 Configuring DNS Express
Lecture 18 Overview. Last Lecture. This Lecture. Next Lecture. Internet Protocol (1) Internet Protocol (2)
Last Lecture Internet Protocol (1) This Lecture Internet Protocol (2) Lecture 18 Overview Source: chapters 19.1, 19.2, 22,1 22.2, 26.6 Next Lecture Transport Control Protocol (1) Source: chapters 24.1,
Testing IPv6 address records in the DNS root
Testing IPv6 address records in the DNS root February 2007 Geoff Huston Chief Scientist APNIC Priming a DNS name server 1. Take the provided root hints file 2. Generate a DNS query for resource records
BIG-IP DNS Services: Implementations. Version 12.1
BIG-IP DNS Services: Implementations Version 12.1 Table of Contents Table of Contents Configuring DNS Express...9 What is DNS Express?...9 About configuring DNS Express...9 Configuring DNS Express to
Domain Name System (DNS) Session-1: Fundamentals. Joe Abley AfNOG Workshop, AIS 2017, Nairobi
Domain Name System (DNS) Session-1: Fundamentals Joe Abley AfNOG Workshop, AIS 2017, Nairobi Computers use IP addresses. Why do we need names? Names are easier for people to remember Computers may be moved
DPU TDC 463. Scanning, Probing, and Surveying for Internet Hosts and Services. TDC463 Fall 2017 John Kristoff DePaul University 1
DPU TDC 463 Scanning, Probing, and Surveying for Internet Hosts and Services TDC463 Fall 2017 John Kristoff DePaul University 1 The Probing Challenge To quickly, periodically, safely and accurately discover
22/06/ :37 DNS COMPLIANCE. Fred Baker Internet Systems Consortium
DNS COMPLIANCE Fred Baker Internet Systems Consortium Background - 2014 ISC was in the process of adding DNS COOKIE (RFC 7873) to BIND and we wanted to see how many servers would mishandle DNS COOKIE options
CSC 574 Computer and Network Security. DNS Security
CSC 574 Computer and Network Security DNS Security Alexandros Kapravelos kapravelos@ncsu.edu (Derived from slides by Will Enck and Micah Sherr) A primer on routing Routing Problem: How do Alice s messages
Update on experimental BIND features to rate-limit recursive queries
Update on experimental BIND features to rate-limit recursive queries OARC Spring 2015 Cathy Almond, ISC What is this talk about? Random DNS query attacks against specific domains a (very) quick recap Mitigation
Network Protocols. Domain Name System (DNS) TDC375 Autumn 2010/11 John Kristoff - DePaul University 1
Network Protocols Domain Name System (DNS) TDC375 Autumn 2010/11 John Kristoff - DePaul University 1 One of two critical systems Routing (BGP) and naming (DNS) are by far the two most critical subsystems
Defeating DNS Amplification Attacks. UKNOF Manchester Central, UK January Ralf Weber Senior Infrastructure Architect
Defeating DNS Amplification Attacks UKNOF Manchester Central, UK January 21 2014 Ralf Weber Senior Infrastructure Architect History of DNS Amplification DNS amplification attacks aren't new Periodically
Applications & Application-Layer Protocols: The Domain Name System and Peerto-Peer
CPSC 360 Network Programming Applications & Application-Layer Protocols: The Domain Name System and Peerto-Peer Systems Michele Weigle Department of Computer Science Clemson University mweigle@cs.clemson.edu
Response Differences between NSD and other DNS Servers
Response Differences between NSD and other DNS Servers Jelte Jansen, NLnet Labs Wouter Wijngaards, NLnet Labs NLnet Labs document 2006-004 November 2, 2006 Abstract This note describes observed differences
Domain Name System.
Domain Name System http://xkcd.com/302/ CSCI 466: Networks Keith Vertanen Fall 2011 Overview Final project + presentation Some TCP and UDP experiments Domain Name System (DNS) Hierarchical name space Maps
Increase of Root and JP queries -- Long-term trends of number of queries --
Increase of Root and JP queries -- Long-term trends of number of queries -- Kazunori Fujiwara, JPRS DNS-OARC 2015 Spring Workshop Last Update: 2015/5/10 1945 (UTC) 1 Are DNS queries
Passive DNS. Using the DNS for fun and profit. Alexandre Dulaunoy. March 4, Alexandre Dulaunoy Passive DNS
Using the DNS for fun and profit March 4, 2016 Domain Name Space and Structure Domain Name Space and Structure 1/3 The domain name space is structured in a tree. The DNS root zone is at the top and provide
CS 43: Computer Networks. 10: Naming and DNS September 24, 2018
CS 43: Computer Networks 10: Naming and DNS September 24, 2018 Last class Distributed systems architectures Client-Server Peer-to-Peer Challenges in design Partial failures Event ordering Lecture 10 -
K-Root Name Server Operations
K-Root Name Server Operations Andrei Robachevsky andrei@ripe.net 1 Outline Root Server System brief update Architecture Current locations Anycast deployment K.root-servers.net Server Major milestones Current
Is your DNS server up-to-date? Pieter Lexis Senior PowerDNS Engineer April 22 nd 2018
lieter_ PowerDNS pieterlexis PowerDNS Is your DNS server up-to-date? Pieter Lexis Senior PowerDNS Engineer April 22 nd 2018 1 What s all this about? A DNS recap What is EDNS? Issues with EDNS on the internet
A Root DNS Server. Akira Kato. Brief Overview of M-Root. WIDE Project
A Root DNS Server Akira Kato WIDE Project kato@wide.ad.jp Brief Overview of M-Root Assumes basic knowledge on DNS Dr. Tatsuya Jinmei has introduced in Nov 19, 2004 What s Root Servers? Start point of the
FRNOG 25 Meeting: BIND9 Recursive Client Rate limiting
FRNOG 25 Meeting: BIND9 Recursive Client Rate limiting Cathy Almond, Sr. Technical Support Engineer Presenter Cathy Almond ISC Senior Technical Support Engineer, Support Team Lead Agenda 1. Pseudo-random
DNS Attacks. Haythem EL MIR, CISSP CTO, NACS
DNS Attacks Haythem EL MIR, CISSP CTO, NACS Why worry about DNS? All Applications Rely on DNS! VeriSign: DoS attack could shut down internet Denial-of-service attacks are growing faster than bandwidth
Internet Engineering Task Force (IETF) Request for Comments: E. Hunt ISC January 2019
Internet Engineering Task Force (IETF) Request for Comments: 8482 Updates: 1034, 1035 Category: Standards Track ISSN: 2070-1721 J. Abley Afilias O. Gudmundsson M. Majkowski Cloudflare Inc. E. Hunt ISC
RIPE NCC Academic Day. November 2016 Saudi Arabia
RIPE NCC Academic Day November 2016 Saudi Arabia Who Runs the Internet? The Short Answer is No ONE!!! 2 What is the Internet? 3 What is the Internet? 4 What is the Internet? The Internet has roughly 55,000
Large-scale DNS. Hot Topics/An Analysis of Anomalous Queries
Large-scale DNS Caching Servers Hot Topics/An Analysis of Anomalous Queries Shintaro NAKAGAMI, Tsuyoshi TOYONO Keisuke ISHIBASHI, Haruhiko NISHIDA, and Haruhiko OHSHIMA NTT Communications, OCN NTT Laboratories
DNS: Useful tool or just a hammer? Paul DNS-OARC 06 Oct 2013, Phoenix
DNS: Useful tool or just a hammer? Paul Ebersman pebersman@infoblox.com, @paul_ipv6 DNS-OARC 06 Oct 2013, Phoenix 1 Attacking your cache 2 Recursion DNS queries are either recursive or nonrecursive recursive
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder. System and Network Engineering July 2014
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder System and Network Engineering July 2014 DNS Main Components Server Side: Authoritative Servers Resolvers (Recursive Resolvers, cache) Client
Goal of this session
DNS refresher Overview Goal of this session What is DNS? How is DNS built and how does it work? How does a query work? Record types Caching and Authoritative Delegation: domains vs zones Finding the error:
Network Protocols. Domain Name System (DNS) TDC375 Spring 2010/11 John Kristoff - DePaul University 1
Network Protocols Domain Name System (DNS) TDC375 Spring 2010/11 John Kristoff - DePaul University 1 One of two critical systems Routing (BGP) and naming (DNS) are by far the two most critical subsystems
QNAME minimisation. Ralph Dolmans (NLnet Labs) https://www.nlnetlabs.nl/ March 2016 Stichting NLnet Labs
QNAME minimisation Ralph Dolmans ralph@nlnetlabs.nl (NLnet Labs) March 2016 Stichting NLnet Labs page 2 Introduction About NLnet Labs A not for profit, public benefit foundation develop Open Source software
Measuring the effects of DNSSEC deployment on query load
Measuring the effects of DNSSEC deployment on query load Jelte Jansen NLnet Labs NLnet Labs document 26-2 May 1, 26 Abstract Ripe NCC recently started signing the zones on their DNS servers. This document
ENEE 457: Computer Systems Security 11/07/16. Lecture 18 Computer Networking Basics
ENEE 457: Computer Systems Security 11/07/16 Lecture 18 Computer Networking Basics Charalampos (Babis) Papamanthou Department of Electrical and Computer Engineering University of Maryland, College Park
Internet Engineering Task Force (IETF) Request for Comments: Category: Best Current Practice ISSN: March 2017
Internet Engineering Task Force (IETF) Request for Comments: 8109 BCP: 209 Category: Best Current Practice ISSN: 2070-1721 P. Koch DENIC eg M. Larson P. Hoffman ICANN March 2017 Initializing a DNS Resolver
A Statistical Study of ANY Resource Record Based DNS Query Request Packet Traffic
A Statistical Study of ANY Resource Record Based DNS Query Request Packet Traffic A Statistical Study of ANY Resource Record Based DNS Query Request Packet Traffic Yasuo Musashi,* Yuto Takeda,** Nobuhiro
Attacks on DNS: Risks of Caching
Attacks on DNS: Risks of Caching CS 161: Computer Security Prof. David Wagner March 30, 2016 Today Midterm 2 grades available Reminder: Start Project 2, Part 2! Today, DNS: protocol for mapping hostnames
DDoS Testing with XM-2G. Step by Step Guide
DDoS Testing with XM-G Step by Step Guide DDoS DEFINED Distributed Denial of Service (DDoS) Multiple compromised systems usually infected with a Trojan are used to target a single system causing a Denial
DNS & Iodine. Christian Grothoff.
DNS & Iodine christian@grothoff.org http://grothoff.org/christian/ The Domain Name System is the Achilles heel of the Web. Tim Berners-Lee 1 DNS: Domain Name System Unique Distributed Database Application-layer
HIP Host Identity Protocol. October 2007 Patrik Salmela Ericsson
HIP Host Identity Protocol October 2007 Patrik Salmela Ericsson Agenda What is the Host Identity Protocol (HIP) What does HIP try to solve HIP basics Architecture The HIP base exchange HIP basic features
Detection of DNS Traffic Anomalies in Large Networks
Detection of Traffic Anomalies in Large Networks Milan Čermák, Pavel Čeleda, Jan Vykopal {cermak celeda vykopal}@ics.muni.cz 20th Eunice Open European Summer School and Conference 2014 1-5 September 2014,
Network Protocols. DNS Intel *slightly modified public version of another talk. TDC 375 Autumn 2009/10 John Kristoff DePaul University 1
Network Protocols DNS Intel *slightly modified public version of another talk TDC 375 Autumn 2009/10 John Kristoff DePaul University 1 What's in a name? dns research01.cti.depaul.edu. TDC 375 Autumn 2009/10
Network Security. Thierry Sans
Network Security Thierry Sans HTTP SMTP DNS BGP The Protocol Stack Application TCP UDP Transport IPv4 IPv6 ICMP Network ARP Link Ethernet WiFi The attacker is capable of confidentiality integrity availability
DNS Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO
DNS Workshop @CaribNOG12 Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and
Further Aspects of Passive DNS Datamining, visualization and alternative implementations
Further Aspects of Passive DNS Datamining, visualization and alternative implementations Sebastien Tricaud (PicViz), Alexandre Dulaunoy (CIRCL.lu), L. Aaron Kaplan (CERT.at), David Durvaux (CERT.be), John
Important note! Please start with problems 1-4; because your grade is F if you do not reach at least 15 (fifteen) points out of 20 for problems 1-4!
Examination DD2392 Protocols and Principles of the Internet EP2120 Internetworking Date: 10 March 2009 at 8:00 13:00 a) No help material is allowed - You are not allowed to use dictionaries, books, or
Computer Networks and Data Systems
Computer Networks and Data Systems Introduction TDC 463 Fall 2017 John Kristoff - DePaul University 1 Official Course Description TDC 463 Network Interconnection Technologies A detailed discussion of the
August 14th, 2018 PRESENTED BY:
August 14th, 2018 PRESENTED BY: APPLICATION LAYER ATTACKS 100% 80% 60% 40% 20% 0% DNS is the second most targeted protocol after HTTP. DNS DoS techniques range from: Flooding requests to a given host.
That KSK Roll. Geoff Huston APNIC Labs
That KSK Roll Geoff Huston APNIC Labs The DNS may look simple But with the DNS, looks are very deceiving So lets talk DNSSEC DNSSEC introduces digital signatures into the DNS It allows a DNS resolver to
An Update on Anomalous DNS Behavior
An Update on Anomalous DNS Behavior Duane Wessels, and CAIDA wessels@measurement-factory October 23 Motivation Why are root servers getting slammed? Are caching/forwarding DNS servers doing the right thing?
This time. Digging into. Networking. Protocols. Naming DNS & DHCP
This time Digging into Networking Protocols Naming DNS & DHCP Naming IP addresses allow global connectivity But they re pretty useless for humans! Can t be expected to pick their own IP address Can t be
Table of Contents. Cisco How NAT Works
Table of Contents How NAT Works...1 This document contains Flash animation...1 Introduction...1 Behind the Mask...2 Dynamic NAT and Overloading Examples...5 Security and Administration...7 Multi Homing...9
Root KSK Roll Update Webinar
Root KSK Roll Update Webinar Matt Larson, VP of Research 11 October 2017 1 Who has KSK-2017 configured as a trust anchor? Until recently, there was no way to know which trust anchors validators have configured
Measuring Access Connectivity Characteristics with Netalyzr
Measuring Access Connectivity Characteristics with Netalyzr Christian Kreibich (ICSI), Nicholas Weaver (ICSI), Boris Nechaev (HIIT/TKK), and Vern Paxson (ICSI & UC Berkeley) 1 Network Transparency And
Managing Caching DNS Server
This chapter explains how to set the Caching DNS server parameters. Before you proceed with the tasks in this chapter, see Introduction to the Domain Name System which explains the basics of DNS. Configuring
Updates and Analyses
Archipelago Measurement Infrastructure Updates and Analyses Young Hyun CAIDA ISMA 2009 AIMS Workshop Feb 12, 2009 2 Outline Focus and Architecture Monitor Deployment Measurements Future Work 3 Introduction
RFC1918 updates on servers near M and F roots C A I D A. Andre Broido, work in progress. CAIDA WIDE Workshop ISI, CAIDA / SDSC / UCSD
RFC1918 updates on servers near M and F roots Andre Broido, work in progress C A I D A CAIDA / SDSC / UCSD http://www.caida.org CAIDA WIDE Workshop ISI, 2005-03-12 Previous projects IPv4 list (Young, Brad)
Tracing a DNS Reflection Attack via Anycast Routing Changes. Duane Wessels October, 2011
Tracing a DNS Reflection Attack via Anycast Routing Changes Duane Wessels October, 2011 1 A Brief History Big Bang The Earth cooled Internet (TCP/IP) invented Domain Name System invented People realize
Using NAT in Overlapping Networks
Using NAT in Overlapping Networks Document ID: 13774 Contents Introduction Prerequisites Requirements Components Used Conventions Configure Network Diagram Configurations Verify Troubleshoot Related Information
OFF-PATH ATTACKS AGAINST PUBLIC KEY INFRASTRUCTURES. Markus Brandt, Tianxiang Dai, Elias Heftrig, Amit Klein, Haya Shulman, Michael Waidner
OFF-PATH ATTACKS AGAINST PUBLIC KEY INFRASTRUCTURES Markus Brandt, Tianxiang Dai, Elias Heftrig, Amit Klein, Haya Shulman, Michael Waidner 1 AGENDA Objectives Attacking Impact Mitigation Summary 2 AGENDA
Local DNS Attack Lab. 1 Lab Overview. 2 Lab Environment. 2.1 Install and configure the DNS server. SEED Labs Local DNS Attack Lab 1
SEED Labs Local DNS Attack Lab 1 Local DNS Attack Lab Copyright c 2006-2015 Wenliang Du, Syracuse University. The development of this document is partially funded by the National Science Foundation s Course,
IPV6 ON THE INTERNET
2010 Rocky Mountain IPv6 Summit Danny McPherson dmcpherson@verisign.com Mike Hollyman mhollyman@arbor.net IPV6 ON THE INTERNET EMPIRICAL OBSERVATIONS 1 1 Overview Various stats from infrastructure-enabling
DNS Flag Day and beyond - how will it affect you?
DNS Flag Day and beyond - how will it affect you? NANOG75: Eddy Winstead, ISC dnsflagday.net Most transactions on the Internet start with a dialog like this: Address for example.com? [flags] Resolver Authoritative
A Sampling of Internetwork Security Issues Involving IPv6
A Sampling of Internetwork Security Issues Involving IPv6 John Kristoff jtk@cymru.com DPU IPv6 Day 2012-10-16 John Kristoff Team Cymru 1 Agenda diff -u ipv4 ipv6 head What is the netsec community working
Root Zone DNSSEC KSK Rollover. DSSEC KSK Rollover
Root Zone DNSSEC KSK Rollover 2017 Edward Lewis DSSEC KSK Rollover ENOG 15 Edward.Lewis@icann.org FIRST TC September 11, 2017 5 June 2018 The Basics This talk is related to the Domain Name System, in particular,
Troubleshooting DHCP server configuration 28
Contents DHCP overview 1 Introduction to DHCP 1 DHCP address allocation 1 Allocation mechanisms 1 Dynamic IP address allocation process 2 IP address lease extension 2 DHCP message format 3 DHCP options
Root KSK Roll Delay Update
Root KSK Roll Delay Update PacNOG 21 Patrick Jones, Sr. Director, Global Stakeholder Engagement 4 December 2017 1 Background When you validate DNSSEC signed DNS records, you need a Trust Anchor. A Trust
The Data Link Layer. 32 PART I Networking Basics
32 PART I Networking Basics weather station. More realistic devices use duplex mode, where all systems can send or receive with equal facility. This is often further distinguished as half-duplex (the system
Computer Science 425 Distributed Systems CS 425 / ECE 428. Fall 2013
Computer Science 425 Distributed Systems CS 425 / ECE 428 Fall 2013 Indranil Gupta (Indy) October 10, 2013 Lecture 14 Networking Reading: Chapter 3 (relevant parts) 2013, I. Gupta, K. Nahrtstedt, S. Mitra,
Computer Security. 11. Network Security. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 11. Network Security Paul Krzyzanowski Rutgers University Spring 2018 April 15, 2018 CS 419 2018 Paul Krzyzanowski 1 The Internet Packet switching: store-and-forward routing across multiple
A versatile platform for DNS metrics
A versatile platform for DNS metrics Stéphane Bortzmeyer AFNIC bortzmeyer@nic.fr OARC - Atlanta - 2 february 2009 1 A versatile platform for DNS metrics Where are we in the talk? 1 General presentation
DNS(SEC) client analysis
DNS(SEC) client analysis powered by assisted by Bart Gijsen (TNO) DNS-OARC, San Francisco, March 2011 Overview DNS traffic analysis CLIENT [8], [9] Applic. browser Operating system DNS stub [7] Resolver
Table of Contents DNS. Short history of DNS (1) DNS and BIND. Specification and implementation. A short history of DNS.
Table of Contents Specification and implementation DNS dr. C. P. J. Koymans Informatics Institute University of Amsterdam September 14, 2009 A short history of DNS Root servers Basic concepts Delegation
Experiences in Setting Up Automatic Home Networking. Jari Arkko Ericsson Research
Experiences in Setting Up Automatic Home Networking Jari Arkko Ericsson Research 1 Background This is NOT about home gateway routers And NOT about ISPs and their IPv6 services But it IS about IPv6 networks
Software Systems for Surveying Spoofing Susceptibility
Software Systems for Surveying Spoofing Susceptibility Matthew Luckie, Ken Keys, Ryan Koga, Bradley Huffaker, Robert Beverly, kc claffy https://spoofer.caida.org/ NANOG68, October 18th 2016 www.caida.o