Analysis of query traffic to.com/.net name servers! Duane Wessels, Matt Larson, Allison Mankin! Verisign Labs! APRICOT 2013!
|
|
|
- Sydney Banks
- 5 years ago
- Views:
Transcription
1 Analysis of query traffic to.com/.net name servers! Duane Wessels, Matt Larson, Allison Mankin! Verisign Labs! APRICOT 2013! 1!
2 Our Infrastructure! Operator of A root (6 sites), J root (70) Registry for.com/.net and some others 17 sites at large IX, including Singapore 63 additional SPAN (switched port analyzer) feeds from large sites Started with 4, numbers increasing Growing dedicated SPAN backhaul No SPAN feeds from Asia-Pacific sites yet 2!
3 Our Data Source! Data since March 2011 At first from four routers: dfw, nyc (2), sfo Later, additional feeds: ams, chi, fra, iad, lax, lon, sea The srcip-count program runs on a server connected to backbone SPAN feeds Records source IP, destination IP, query counts by type, DO, RD, EDNS buffer size, and min/max IP TTL Writes a data file every 60 seconds # File format version: 1.0 ($Id: srcip-count.c :25:18Z mlarson $)! # Interval: ( :47: :48:00)! # Columns: src dst bufsize rd do a aaaa mx ptr ds dnskey ns other min_ip_ttl max_ip_ttl! ! ! ! ! ! ! ! 3!
4 Our Data Sets! 1-Month: srcip-count data for the month of June, Month: srcip-count data for March 2011 to June 2012 Minus August 2011 Minus parts of March/April 2012 Between 4-10 sites, coming in from SPAN feeds Queries to gtld-servers.net name servers only I.e., authoritative servers for.com,.net and.edu Excluding queries from /20 (ourselves) Analyzed on Hadoop cluster in Verisign Labs 1-Month -> 3 TB in Hadoop (1-minute granularity) 15-Month -> 14 TB in Hadoop (24-hour granularity) 4!
5 Site Coverage ams1 chi2 dfw2 fra1 Sites iad3 lax2 lon3 nyc3 sea1 sfo1 F 11 M A M J J A S O N D J Date 12 F M A M J J 5!
6 Queries Per Day (Billions) ams chi dfw fra iad lax lon nyc sea F 11 M A M J J A S O N D J Date 12 F M A M J J sfo1 6!
7 0.4 Fraction of Clients Seen At Multiple Sites From May day ( ) week ( ) month ( ) 0.3 Fraction of Clients Number of Sites 7!
8 8! Caveat: We Don t See All The Data!
9 Agenda! Number of Clients AAAA Queriers IP TTL Analysis Characterizing Top Talkers Conclusions Appendix Clustering Clients by Query Type EDNS0 and DO=1 Analysis RD=1 Analysis 9!
10 10! Number of Clients!
11 Unique Clients Per Day (1-Month)! Millions of Clients Days 11!
12 How Many Unique IPs Queried in June 2011?! 26,437,427! 12!
13 Number of Clients Seen Every Day Since The Start! Millions of Clients , Days 13!
14 How Many IPs Query Less Than Once Per Day?! 15,626,031! 14!
15 Histogram of Clients Seen per Number of Days! This Many (Millions) of Clients , Were Seen In Exactly This Many Days 15!
16 Cumulative Number of Unique Clients Seen (1-Month)! 25 We haven't seen this end...very long tail! 20 Millions of Clients Days 16!
17 Millions of Clients / day / day / day / day / day / day / day / day / day / day Cumulative Client Count nyc million new IPs in 110 days! = 194,900 IPs/day! or one /8 every 2.9 months! IANA allocated one /8 every 1.5 months! F 11 M A M J J A S O N D J Date 12 F M A M J 17!
18 / day / day / day / day / day / day Cumulative Client Count nyc3 This trend looks worrisome, but it is an artifact of the analysis. Given more time, some of these clients would become inactive and their mean query rate would decrease and we d color them differently.! Thousands of Clients F 11 M A M J J A S O N D J Date 12 F M A M J 18!
19 / day / day Cumulative Client Count nyc Clients F 11 M A M J J A S O N D J Date 12 F M A M J 19!
20 all ams1 dfw2 iad3 nyc3 sfo1 Cumulative Client Count Each Site Compared to All IPs Seen Millions of Clients Nov11 5 Dec Jan Date Feb !
21 Cumulative Client Count Each Site Compared to All IPs Seen Fraction of Clients nyc3 ams1 sfo1 iad3 dfw2 21! 0 28 Nov11 5 Dec Jan Feb12 Date
22 22! AAAA Queriers!
23 Queries for A and AAAA! One measure of IPv6 deployment is queries for AAAA! How many source IPs send at least one AAAA query vs. at least one A query? How many total queries for AAAA vs. total queries for A? SOURCES 6/2011 A 91.4% 19,925,511 AAAA 14.7% 3,214,272 ALL 100.0% 21,811,360 6/2012 A 95.1% 31,020,570 AAAA 18.0% 5,869,714 ALL 100.0% 32,607,318 QUERIES 6/2011 A 68.7% 93,413,090,254 AAAA 12.3% 16,701,014,767 ALL 100.0% 135,914,964,320 6/2012 A 66.3% 492,837,069,754 AAAA 11.8% 87,371,872,688 ALL 100.0% 742,991,989,695 23!
24 Queries for A and AAAA! One measure of IPv6 deployment is queries for AAAA! How many source IPs send at least one AAAA query vs. at least one A query? How many total queries for AAAA vs. total queries for A? SOURCES 6/2011 A 91.4% 19,925,511 AAAA 14.7% 3,214,272 ALL 100.0% 21,811,360 6/2012 A 95.1% 31,020,570 AAAA 18.0% 5,869,714 ALL 100.0% 32,607,318 QUERIES 6/2011 A 68.7% 93,413,090,254 AAAA 12.3% 16,701,014,767 ALL 100.0% 135,914,964,320 6/2012 A 66.3% 492,837,069,754 AAAA 11.8% 87,371,872,688 ALL 100.0% 742,991,989,695 24!
25 A vs AAAA Queries A_sources AAAA_sources A_queries AAAA_queries Percent ! 0 F 11 M A M J J A S O N D J 12 Date F M A M J J A S O N D J 13
26 26! IP TTL Analysis!
27 IP Time To Live (June 2011)! The IP datagram header has an 8-bit TTL field Router decrements the field as it forwards a packet Hosts set initial TTL value when sending packets Common values are: 64 (BSD, Linux, MacOS) 128 (Windows) 255 (SunOS/Solaris) TTL analysis may aid in detecting spoofed queries Do clients have consistent TTL values? 27!
28 IP TTL Histogram! Millions of Clients IP TTL 28!
29 29!
30 30! Characterizing Top Talkers!
31 Ranked Clients CDF! 1 Fraction of Total Queries busiest clients! generate 50% of! queries! 100 busiest clients! generate 10% of! queries! 200,000 busiest clients! generate 90% of! queries! Client Rank 31!
32 Top Talkers June 2011! Source Org Mean qps Cablevision Websense Sprint Cablevision Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Cablevision !
33 33!
34 8 7 6 What Percent of All Queries Come These Companies? chinanet google level3 comcast opendns microsoft 5 Percent ! 0 F 11 M A M J J A S O N D J 12 Date F M A M J J
35 Daily Changes of Client IPs! Number of Clients Days Yesterday but not today Yeserday and Today New Today 35!
36 20000 Daily Changes in ASes Seen May 2012 SFO Number of ASes ! Days Yesterday but not Today Yeserday and Today New Today
37 Conclusions & Observations! The 15-Month dataset pushes the limits of our small Hadoop cluster. More resources are probably necessary to tackle, say, all the sites. We see queries from about 2% of all IPv4 addresses over the course of a year. Probably higher with more sites. IPv6 queries are significant part of the workload now. Big Resolvers each contribute 3-5% to the total query load. DNSSEC analysis not in this talk, but some results on EDNS0 and D0=1 in Appendix. Also in Appendix, RD=1 queriers mostly spammers. 37!
38 Running Hadoop Map/Reduce Jobs! Still...we will continue questions and suggestions sought.!! Thanks!! 38!
39 39!
40 40!
41 41! APPENDIX!
42 42! Client Profiles by Query Type!
43 Query Type Profiles! Goal to create profiles of resolvers based on the types of queries they send Define a profile as the fraction of: A, AAAA, MX, PTR, NS, DS, DNSKEY, Other The profile values sum to 1 Treat profiles as points in 8-D space Then use some clustering techniques to identify the common profiles K-Means clustering, iterated Ignore clients sending less than 100 queries/month More detail at end of online deck 43!
44 K-Means Clustering! Select K random initial centers For each point in the data, find its closest center Recalculate centers as mean of all points closest to it Repeat Stop when centers stabilize according to some metric Results are good if different random starting points lead to the same final points 44!
45 45! Finding Clusters of Query Type Profiles!
46 K-Means Clustering to Find Profiles! Begin with approx 60 random centers subject to following constraints: Center must lie on the 7-D surface described by c A +c AAAA +c MX +c PTR +c NS +c DNSKEY +c DS +c Other =1 Centers must be separated by 0.4 units Ignore clients that send less than 100 queries (per month) Data includes 7,664,000 of 26,437,000 clients (29%) Every 10 iterations, remove the center that is closest to all other centers Stop when there are 16 centers remaining 46!
47 Query Type Profile Clusters! Query Type Fraction ! 367! 18! OTHER NS DNSKEY DS PTR MX AAAA A ! 28.2% 16.6% 15.4% 11.4% 9.86% 6.15% 6.05% 2.75% 1.37% 0.930% 0.929% 0.222% 0.161% Percent of clients clustered around each profile % % %
48 Query Type Cluster Variance! Query Type Fraction Standard Deviation OTHER NS DNSKEY DS PTR MX AAAA A ! Standard Deviation of clients clustered around each profile
49 49! EDNS0 and DO=1!
50 EDNS0! Extension mechanism for DNS queries and responses RFC 2671 Adds: More flags More response codes Ability to advertise a maximum UDP receive buffer size Mechanism for additional extensions via standards action Maximum UDP buffer size advertisement allows DNS messages > 512 bytes Large packets require support of underlying network What buffer sizes do queriers advertise? 50!
51 EDNS0 Buffer Size Histogram (June 2011)! No EDNS! Percent of Queries EDNS Payload Size 51!
52 Indicating Support for DNSSEC! Resolvers indicate DNSSEC comprehension by setting DO ( DNSSEC OK ) bit Flag enabled by (and therefore requiring) EDNS0 DO means, I understand DNSSEC types, so send them if you have them. DNSKEY, RRSIG, DS, NSEC/NSEC % of all queries analyzed had DO=1 81.1% of clients always set DO=0 12.2% of clients always set DO=1 6.7% of clients have some mixture 52!
53 53! RD=1!
54 Recursion Desired! The RD bit is set by dumb stub resolvers that rely on smarter iterative resolvers to do the hard work of following referrals Iterative resolvers are found in recursive name servers In theory stub resolvers should not be sending queries to the.com/.net name servers. In other words, most queries we receive should have RD=0 Some debugging tools, like dig, set RD=1 by default, so we can expect to see some RD=1 queries What do we really see? 6.79% of all queries have RD bit set 53% clients RD=0, 42.5% RD=1, 4.5% mix 54!
55 How Many Queries Do 100% RD=1 and RD=0 Clients Send?! 100%_RD=0 100%_RD=1 1,000, ,000 This Many Clients 10,000 1, ,000 10, ,000 1,000,000 10,000, ,000,000 Sending This Many Queries 55!
56 Analysis of 100% RD=1 Queries! Features Most common query type Most common query name (at least 5% of queries) Most common second level domain (at least 5%) Source port entropy (bits) Query ID entropy (bits) Similarity between first-components of names 56!
57 Sampling Sources! Examine our monthly archived pcap files from Jan-Jun For sites (ams1, iad3, nyc3, sfo1) generate a list of sources with 100% RD=1 queries. Order by query count. From the list of sources, select a logarithmically-based subset of sources to examine in full. About 11 sources per site per date. Analyze each using a Perl script 57!
58 RD=1 Results! Source Site Query Count Popular Type Source Port Bits Query ID Bits Name Similarity Popular SLD Popular Name nyc3 1,627,963 NS [99%] sfo1 1,256,491 MX [80%] aardvarkpest.com [56%] aardvarkpest.com [56%] dfw2 456,432 DNSKEY[100%] [100%]. [100%] ams1 385,263 TXT [94%] osvr.com [93%] osvr.com [93%] sfo1 302,248 A [83%] spamcop.net [15%] ams1 311,759 A [83%] spamcop.net [14%] ams1 279,425 A [83%] spamcop.net [14%] sfo1 274,864 MX [74%] tessag.com [63%] tessag.com [63%] sfo1 15,644 MX [92%] ams1 195 A [61%] zenon.net [10%] dns1.zenon.net [5%] 58!
59 How Did We Calculate #Bits?! For a uniform discrete distribution, the variance (square of standard deviation) is n Where n is the largest possible value in the distribution For a given sample of integers, we can calculate its standard deviation, and thus its variance, and invert the above equation to estimate n For example, the variance of (1,2,3,4,5,6) is 3.5 ( ) +1 = ln = 2.7bits 59!
60 Name Similarity Metric! Sort all first-label names seen from the client Calculate the fraction of similar characters in sorted word pairs. Similar to Hamming Distance Average all the per-pair fractions. 60!
61 MX Queries with 8-bit IDs are very common! 03:00: IP > : 110+ MX? abb-es.com. (28)! 03:00: IP > : 111+ MX? dfaslfd.com. (29)! 03:00: IP > : 165+ MX? awfde.com. (27)! 03:00: IP > : 148+ MX? afdcd.com. (27)! 03:00: IP > : 141+ MX? jyhsdfne.com. (30)! 03:00: IP > : 101+ MX? mailnaitor.com. (32)! 03:00: IP > : 23+ MX? sdvckjsx.com. (30)! 03:00: IP > : 125+ MX? dahakjh.com. (29)! 03:00: IP > : 10+ MX? asfdsgf.com. (29)! 03:00: IP > : 176+ MX? fdsa com. (33)! 03:00: IP > : 56+ MX? dfhde.com. (27)! 03:00: IP > : 255+ MX? dwawdfa.com. (29)! 03:00: IP > : 242+ MX? lsdajflkasjfd.com. (35)! 03:00: IP > : 205+ MX? asdfkasjfhk.com. (33)! 03:00: IP > : 24+ MX? argerg.com. (28)! 03:00: IP > : 2+ MX? kahsgf.com. (28)! 03:00: IP > : 29+ MX? aosdfl.com. (28)! 03:00: IP > : 178+ MX? tbrwpyeo.com. (30)! 03:00: IP > : 42+ MX? aodfasd.com. (29)! 03:00: IP > : 206+ MX? awfde.com. (27)! 54,914 queries from this source! poor source port randomness! poor query ID randomness! About ¾ of the sources fit this pattern! mostly MX queries! 61!
62 Spam Blocker?! 20:00: IP > : A? ns.rz-ip.net. (30)! 20:00: IP > : MX? aol.com. (25)! 20:00: IP > : TXT? sa-accredit.habeas.com. (54)! 20:00: IP > : A? rbldns7.sorbs.net. (35)! 20:00: IP > : A? rbldns3.sorbs.net. (35)! 20:00: IP > : A? psbl.primerelay.net. (37)! 20:00: IP > : A? blns55.spamcop.net. (36)! 20:00: IP > : A? ltns2.rpdns.net. (33)! 20:00: IP > : TXT? bl.spamcop.net. (46)! 20:00: IP > : A? rbldns8.sorbs.net. (35)! 20:00: IP > : A? cmtu.mt.ns.els-gms.att.net. (44)! 20:00: IP > : A? dnsbl.sorbs.net. (48)! 20:00: IP > : A? blns69.spamcop.net. (36)! 20:00: IP > : A? ns4.apnic.com. (31)! 20:00: IP > : A? blns65.spamcop.net. (36)! 20:00: IP > : MX? ms9.hinet.net. (31)! 20:00: IP > : A? auth3.ns.gin.ntt.net. (38)! 20:00: IP > : A? psbl.surriel.com. (50)! The lower query rate and numerous references to RBLs make me think this is a spam-blocking application (with custom DNS resolution).!! in-addr.arpa domain name pointer mx17.pchome.com.tw.! 62!
63 CNAME looker-uppers?! 20:00: IP > : CNAME? gmail.com. (27)! 20:00: IP > : CNAME? gmail.com. (27)! 20:00: IP > : CNAME? vsnl.net. (26)! 20:00: IP > : CNAME? asp.net. (25)! 20:00: IP > : CNAME? signet-india.com. (34)! 20:00: IP > : CNAME? hotmail.com. (29)! 20:00: IP > : CNAME? yahoo.com. (27)! 20:00: IP > : CNAME? tbwt.com. (26)! 20:01: IP > : A? mm9india-com.mail.eo.outlook.com. (50)! 20:01: IP > : CNAME? yahoo.com. (27)! 20:01: IP > : CNAME? yahoo.com. (27)! 20:01: IP > : A? mx.connactivity.com. (37)! 20:01: IP > : MX? gl00on.net. (28)! 20:01: IP > : CNAME? gmail.com. (27)! 20:01: IP > : A? mrin4-b.corp.bf1.yahoo.com. (44)! 20:01: IP > : CNAME? gmail.com. (27)! 20:01: IP > : CNAME? hotmail.com. (29)! 20:01: IP > : CNAME? gmail.com. (27)! 20:01: IP > : CNAME? yahoo.com. (27)! 20:01: IP > : CNAME? retailmart.web10.eperiumindia.com. (51)! 20:01: IP > : CNAME? fascom.com. (28)! 20:01: IP > : CNAME? gmail.com. (27)! 20:01: IP > : CNAME? aakronrule.com. (3! in-addr.arpa domain name pointer host rediffdns.com.!! rediff = India s leading portal which covers India news, Hindi Movies, Photos 63!
64 Trolling for registrations?! 23:59: IP > : NS? mzmslcbpcbpz.cc. (33)! 23:59: IP > : NS? smmyuhxlt.cc. (30)! 23:59: IP > : NS? sfhbkoesbf.tv. (31)! 23:59: IP > : NS? garrtchx.net. (30)! 23:59: IP > : NS? garrtchx.net. (30)! 23:59: IP > : NS? cwnizwzd.tv. (29)! 23:59: IP > : NS? zoipmnwr.tv. (29)! 23:59: IP > : NS? xtnouxrcav.cc. (31)! 23:59: IP > : NS? fvzkoky.net. (29)! 23:59: IP > : NS? mcpzonsstpqx.tv. (33)! 23:59: IP > : NS? gnjbyaoolbc.tv. (32)! 23:59: IP > : NS? wkylsjrw.tv. (29)! 23:59: IP > : NS? qeezwogo.com. (30)! 23:59: IP > : NS? wwgdswgnek.net. (32)! 23:59: IP > : NS? egbmbdey.tv. (29)! 64!
Open Resolvers in COM/NET Resolution!! Duane Wessels, Aziz Mohaisen! DNS-OARC 2014 Spring Workshop! Warsaw, Poland!
Open Resolvers in COM/NET Resolution!! Duane Wessels, Aziz Mohaisen! DNS-OARC 2014 Spring Workshop! Warsaw, Poland! Outine! Why do we care about Open Resolvers?! Surveys at Verisign! Characterizing Open
Who s Asking? Geoff Huston, Joao Damas APNIC. Roy Arends ICANN
Who s Asking? Geoff Huston, Joao Damas APNIC Roy Arends ICANN Background Experiments that are intended to expose the way in which recursive resolvers interact with the DNS root and its authoritative servers
OpenINTEL an infrastructure for long-term, large-scale and high-performance active DNS measurements. Design and Analysis of Communication Systems
OpenINTEL an infrastructure for long-term, large-scale and high-performance active DNS measurements DACS Design and Analysis of Communication Systems Why measure DNS? (Almost) every networked service relies
DNS. A Massively Distributed Database. Justin Scott December 12, 2018
DNS A Massively Distributed Database Justin Scott December 12, 2018 What is DNS? Translates Hostnames to IP Addresses What is DNS? Example: www.serverlogic.com 23.185.0.4 What is DNS? Example: www.serverlogic.com
RIPE Network Coordination Centre. K-root and DNSSEC. Wolfgang Nagele RIPE NCC.
K-root and DNSSEC Wolfgang Nagele RIPE NCC RIPE NCC One of the five Regional Internet Registries Provides IP address and AS number resources to Europe and Middle-East regions DNS related work - Parent
Large-scale DNS. Hot Topics/An Analysis of Anomalous Queries
Large-scale DNS Caching Servers Hot Topics/An Analysis of Anomalous Queries Shintaro NAKAGAMI, Tsuyoshi TOYONO Keisuke ISHIBASHI, Haruhiko NISHIDA, and Haruhiko OHSHIMA NTT Communications, OCN NTT Laboratories
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover Duane Wessels DNS-OARC 26 San Jose, CA September 29, 2017 Background 2 2017 Root Zone KSK Rollover October 11, 2017! Root zone DNSKEY
(Slightly Updated) Port and Message ID Analysis of Resolvers Querying.com/.net Name Servers Matt Larson David Blacka
(Slightly Updated) Port and Message ID Analysis of Resolvers Querying.com/.net Name Servers Matt Larson David Blacka February 2, 2009 Global DNS Risk Technical Operations Meeting, Atlanta, GA Goals + Primary:
DNS Anycast Statistic Collection
DNS Anycast Statistic Collection RIPE 61 Measurement Analysis and Tools Working Group 18 Nov 2010 Edward Lewis Neustar 1 What s so hard about reporting? 2 Collecting DNS Statistics (Generic) The Technical
Understanding and Characterizing Hidden Interception of the DNS Resolution Path
Who Is Answering My Queries? Understanding and Characterizing Hidden Interception of the DNS Resolution Path Baojun Liu, Chaoyi Lu, Haixin Duan, YingLiu, ZhouLi, ShuangHaoand MinYang ISP DNS Resolver DNS
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder. System and Network Engineering July 2014
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder System and Network Engineering July 2014 DNS Main Components Server Side: Authoritative Servers Resolvers (Recursive Resolvers, cache) Client
Measurements of traffic in DITL 2008
Measurements of traffic in DITL 2008 Sebastian Castro secastro@caida.org CAIDA / NIC Chile 2008 OARC Workshop Sep 2008 Ottawa, CA Overview DITL 2008 General statistics Query characteristics Query rate
BIND-USERS and Other Debugging Experiences. Mark Andrews Internet Systems Consortium
BIND-USERS and Other Debugging Experiences Mark Andrews Internet Systems Consortium Mark_Andrews@isc.org http://isc.org BIND-USERS and Other Debugging Experiences We will look at some typical debugging
Updates and Analyses
Archipelago Measurement Infrastructure Updates and Analyses Young Hyun CAIDA ISMA 2009 AIMS Workshop Feb 12, 2009 2 Outline Focus and Architecture Monitor Deployment Measurements Future Work 3 Introduction
NAT, IPv6, & UDP CS640, Announcements Assignment #3 released
NAT, IPv6, & UDP CS640, 2015-03-03 Announcements Assignment #3 released Overview Network Address Translation (NAT) IPv6 Transport layer User Datagram Protocol (UDP) Network Address Translation (NAT) Hacky
The impact of DNSSEC on k.root-servers.net and ns-pri.ripe.net
The impact of DNSSEC on k.root-servers.net and ns-pri.ripe.net Olaf M. Kolkman Question What would be the immediate and initial effect on memory, CPU and bandwidth resources if we were to deploy DNSSEC
Implementing DNSSEC with DynDNS and GoDaddy
Implementing DNSSEC with DynDNS and GoDaddy Lawrence E. Hughes Sixscape Communications 27 December 2017 DNSSEC is an IETF standard for adding security to the DNS system, by digitally signing every resource
CS519: Computer Networks. Lecture 6: Apr 5, 2004 Naming and DNS
: Computer Networks Lecture 6: Apr 5, 2004 Naming and DNS Any problem in computer science can be solved with another layer of indirection David Wheeler Naming is a layer of indirection What problems does
Preparation Test AAAA and EDNS0 support Share Your Results Results Reported Testing Period
Testing Recursive Name Servers for IPv6 and EDNS0 Support SAC 017 15 March 2007 Preparation Test AAAA and EDNS0 support Share Your Results Results Reported Testing Period Background The DNS Root Server
CSCE 463/612 Networks and Distributed Processing Spring 2018
CSCE 463/612 Networks and Distributed Processing Spring 2018 Application Layer III Dmitri Loguinov Texas A&M University February 8, 2018 Original slides copyright 1996-2004 J.F Kurose and K.W. Ross 1 Chapter
DNS Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO
DNS Workshop @CaribNOG12 Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and
Domain Name System - Advanced Computer Networks
- Advanced Computer Networks Saurabh Barjatiya International Institute Of Information Technology, Hyderabad 26 August, 2011 Contents 1 Distributed database, highly volatile Domain names Top level domains
A Question of Protocol
A Question of Protocol Geoff Huston APNIC Originally there was RFC791: Originally there was RFC791: Originally there was RFC791: All hosts must be prepared to accept datagrams of up to 576 octets (whether
Measuring the effects of DNSSEC deployment on query load
Measuring the effects of DNSSEC deployment on query load Jelte Jansen NLnet Labs NLnet Labs document 26-2 May 1, 26 Abstract Ripe NCC recently started signing the zones on their DNS servers. This document
Day In The Life of the Internet 2008 Data Collection Event.
Day In The Life of the Internet 2008 Data Collection Event http://www.caida.org/projects/ditl Duane Wessels The Measurement Factory/CAIDA k claffy CAIDA NANOG 42 February 19, 2008 NANOG 42 0 The Measurement
DNS/DNSSEC Workshop. In Collaboration with APNIC and HKIRC Hong Kong. Champika Wijayatunga Regional Security Engagement Manager Asia Pacific
DNS/DNSSEC Workshop In Collaboration with APNIC and HKIRC Hong Kong Champika Wijayatunga Regional Security Engagement Manager Asia Pacific 22-24 January 2018 1 Agenda 1 2 3 Introduction to DNS DNS Features
Inter-Domain Routing Trends
Inter-Domain Routing Trends Geoff Huston gih@apnic.net APNIC March 2007 Agenda 1. Some data about the network and BGP over 2006 2. Some observations about the distribution patterns of BGP updates 3. Pointers
Covert channel detection using flow-data
Covert channel detection using flow-data Guido Pineda Reyes MSc. Systems and Networking Engineering University of Amsterdam July 3, 2014 Guido Pineda Reyes (UvA) Covert channel detection using flow-data
Objectives. Upon completion you will be able to:
Domain Name System: DNS Objectives Upon completion you will be able to: Understand how the DNS is organized Know the domains in the DNS Know how a name or address is resolved Be familiar with the query
ECE 435 Network Engineering Lecture 7
ECE 435 Network Engineering Lecture 7 Vince Weaver http://web.eece.maine.edu/~vweaver vincent.weaver@maine.edu 25 September 2018 HW#3 was Posted Announcements 1 HW#2 Review C code will be discussed next
Internet Engineering Task Force (IETF) Request for Comments: Category: Best Current Practice ISSN: March 2017
Internet Engineering Task Force (IETF) Request for Comments: 8109 BCP: 209 Category: Best Current Practice ISSN: 2070-1721 P. Koch DENIC eg M. Larson P. Hoffman ICANN March 2017 Initializing a DNS Resolver
Testing IPv6 address records in the DNS root
Testing IPv6 address records in the DNS root February 2007 Geoff Huston Chief Scientist APNIC Priming a DNS name server 1. Take the provided root hints file 2. Generate a DNS query for resource records
Writing Assignment #1. A Technical Description for Two Different Audiences. Yuji Shimojo WRTG 393. Instructor: Claudia M. Caruana
Writing Assignment #1 A Technical Description for Two Different Audiences Yuji Shimojo WRTG 393 Instructor: Claudia M. Caruana November 9, 2016 1 Introduction I work in IT technical support at a web design
Observing DNSSEC validation in the wild
Observing DNSSEC validation in the wild Ólafur Guðmundsson and Stephen D. Crocker Shinkuro, Inc. 4922 Fairmont Avenue Suite 250 Bethesda MD 20814 U.S.A. Email: ogud@shinkuro.com and steve@shinkuro.com
DNSSEC Trust tree: (A) ---dnslab.org. (DS keytag: 9247 dig (DNSKEY keytag. ---org. (DS keytag: d
DNSSEC Trust tree: www.dnslab.org. (A) ---dnslab.org. (DNSKEY keytag: 7308 alg ---dnslab.org. (DNSKEY keytag: 9247 ---dnslab.org. (DS keytag: 9247 dig DNSSEC ---org. (DNSKEY keytag: 24209 a Domain Name
Protecting DNS from Routing Attacks -Two Alternative Anycast Implementations
Protecting DNS from Routing Attacks -Two Alternative Anycast Implementations Boran Qian StudentID 317715 Abstract The Domain Names System (DNS) is an important role of internet infrastructure and supporting
Domain Name System (DNS) Session-1: Fundamentals. Joe Abley AfNOG Workshop, AIS 2017, Nairobi
Domain Name System (DNS) Session-1: Fundamentals Joe Abley AfNOG Workshop, AIS 2017, Nairobi Computers use IP addresses. Why do we need names? Names are easier for people to remember Computers may be moved
IDN query trends seen at JP and Root. Kazunori Fujiwara, JPRS 2016/4/3, IEPG meeting
IDN query trends seen at JP and Root Kazunori Fujiwara, JPRS fujiwara@jprs.co.jp 2016/4/3, IEPG meeting Is IDN use increasing? It is said that IDN is important for non- English speakers IDN implementations
Scaling up: How we made millions of domains happier. Tom Arnfeld, DNS Engineer Pavel Odintsov, DNS Engineer
Scaling up: How we made millions of domains happier Tom Arnfeld, DNS Engineer Pavel Odintsov, DNS Engineer Cloudflare DNS Services Authoritative DNS IPv4 and IPv6 support Low latency propagation DNSSEC
Root Servers. Root hints file come in many names (db.cache, named.root, named.cache, named.ca) See root-servers.org for more detail
What is DNS? Systems to convert domain names into ip addresses: For an instance; www.tashicell.com 118.103.136.66 Reverse: 118.103.136.66 www.tashicell.com DNS Hierarchy Root Servers The top of the DNS
DNS. Introduction To. everything you never wanted to know about IP directory services
Introduction To DNS everything you never wanted to know about IP directory services Linux Users Victoria, April 3 rd 2007 what is the domain name system anyway? it's like a phone book...kinda DNS is (1)
Domain Name System (DNS) Session-1: Fundamentals. Computers use IP addresses. Why do we need names? hosts.txt does not scale
Domain Name System (DNS) Computers use IP addresses. Why do we need names? Names are easier for people to remember Session-1: Fundamentals Computers may be moved between networks, in which case their IP
An Update on Anomalous DNS Behavior
An Update on Anomalous DNS Behavior Duane Wessels, and CAIDA wessels@measurement-factory October 23 Motivation Why are root servers getting slammed? Are caching/forwarding DNS servers doing the right thing?
RSA and ECDSA. Geoff Huston APNIC. #apricot2017
RSA and ECDSA Geoff Huston APNIC It s all about Cryptography Why use Cryptography? Public key cryptography can be used in a number of ways: protecting a session from third party eavesdroppers Encryption
Internet Engineering Task Force (IETF) Obsoletes: 2671, 2673 Category: Standards Track. April 2013
Internet Engineering Task Force (IETF) Request for Comments: 6891 STD: 75 Obsoletes: 2671, 2673 Category: Standards Track ISSN: 2070-1721 J. Damas Bond Internet Systems M. Graff P. Vixie Internet Systems
Expires: June 16, 2004 VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST December 17, 2003
DNS Extensions Internet-Draft Expires: June 16, 2004 R. Arends Telematica Instituut M. Larson VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST December 17, 2003 Protocol Modifications for the DNS
Assessing IPv6 Adop/on. Michael Bailey, University of Michigan NANOG 57
Assessing IPv6 Adop/on Michael Bailey, University of Michigan NANOG 57 Collaborators Mark Allman, Interna>onal Comp. Sci. Ins>tute Jakub Czyz, University of Michigan ScoG Iekel- Johnson, Arbor Networks
Measuring ATR. Joao Damas Geoff March 2018
Measuring ATR Joao Damas Geoff Huston @apnic.net March 2018 September 2017: The Internet has a problem Instead of evolving to be more flexible and more capable, it appears that the Internet s transport
DNS Basics BUPT/QMUL
DNS Basics BUPT/QMUL 2018-04-16 Related Information Basic function of DNS Host entry structure in Unix Two system calls for DNS database retrieving gethostbyname () gethostbyaddr () 2 Agenda Brief introduction
Identifier Technology Health Indicators (ITHI) Alain Durand, Christian Huitema 13 March 2018
Identifier Technology Health Indicators (ITHI) Alain Durand, Christian Huitema 13 March 2018 ITHI Principles of Operation Technical focus Problem areas à Metrics à Measurement Current value and trend over
Domain Name System (DNS) DNS Fundamentals. Computers use IP addresses. Why do we need names? hosts.txt does not scale. The old solution: HOSTS.
Domain Name System (DNS) Computers use IP addresses. Why do we need names? Names are easier for people to remember DNS Fundamentals Computers may be moved between networks, in which case their IP address
Domain Name System (DNS)
Domain Name System (DNS) Computer Networks Lecture 9 http://goo.gl/pze5o8 Domain Name System Naming service used in the Internet Accomplishes mapping of logical ("domain") names to IP addresses (and other
DNS Mark Kosters Carlos Martínez ARIN - LACNIC
DNS Workshop @CaribNOG8 Mark Kosters Carlos Martínez ARIN - LACNIC DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and integrity
Measuring ATR. Joao Damas Geoff May 2018
Measuring ATR Joao Damas Geoff Huston @apnic.net May 2018 September 2017: The Internet has a problem Instead of evolving to be more flexible and more capable, it appears that the Internet s transport is
Keeping DNS parents and children in sync at Internet Speed! Ólafur Guðmundsson
Keeping DNS parents and children in sync at Internet Speed! Ólafur Guðmundsson olafur@cloudflare.com How long does it take to? Post a new selfie on Facebook and all your friends to be notified few seconds
Managing Caching DNS Server
This chapter explains how to set the Caching DNS server parameters. Before you proceed with the tasks in this chapter, see Introduction to the Domain Name System which explains the basics of DNS. Configuring
ELEC / COMP 177 Fall 2015
ELEC / COMP 177 Fall 2015 Thursday, December 10 th 8am- 11am Same format as midterm Open notes, open computer, open internet 1 programming problem using Python Time limited 3 hours max Bring your Linux
ICANN DNSSEC Workshop Comcast s Operational Experiences 14 March 2012
ICANN DNSSEC Workshop Comcast s Operational Experiences 14 March 2012 NATIONAL ENGINEERING & TECHNICAL OPERATIONS DNSSEC Deployment Status We began working on this in 2008 (see Bmeline) We completed our
Is Your Caching Resolver Polluting the Internet?
Is Your Caching Resolver Polluting the Internet? Duane Wessels The Measurement Factory, and CAIDA wessels@measurement-factory.com September 2004 SIGCOMM 2004 NetTs 0 The Measurement Factory A Disclaimer
DNSSEC for the Root Zone. IEPG IETF 77 Anaheim, USA March 2010
DNSSEC for the Root Zone IEPG IETF 77 Anaheim, USA March 2010 Joe Abley, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC
Some Lacunae in APNIC DNS Measurement. George Michaelson CAIDA WIDE Workshop Marina Del Ray 2006
Some Lacunae in APNIC DNS Measurement George Michaelson CAIDA WIDE Workshop Marina Del Ray 2006 Backtracking Same DNS measurement since 2001/2.. Re-installation of nameservers forced reinstallation of
DNS Fundamentals. Steve Conte ICANN60 October 2017
DNS Fundamentals Steve Conte ICANN60 October 2017 Names and Numbers IP addresses easy for machines but hard for people IPv4: 192.0.2.7 IPv6: 2001:db8::7 People need to use names In the early days of the
RFC 2181 Ranking data and referrals/glue importance --- new resolver algorithm proposal ---
RFC 2181 Ranking data and referrals/glue importance --- new resolver algorithm proposal --- Kazunori Fujiwara fujiwara@jprs.co.jp Japan Registry Services Co., Ltd (JPRS) DNS-OARC Workshop 2016/10/16 Last
DNSSEC DNS SECURITY EXTENSIONS INTRODUCTION TO DNSSEC FOR SECURING DNS QUERIES AND INFORMATION
DNSSEC DNS SECURITY EXTENSIONS INTRODUCTION TO DNSSEC FOR SECURING DNS QUERIES AND INFORMATION Peter R. Egli 1/10 Contents 1. Security Problems of DNS 2. Solutions for securing DNS 3. Security with DNSSEC
DNSSEC: what every sysadmin should know to keep things working
DNSSEC: what every sysadmin should know to keep things working Roland van Rijswijk - Deij roland.vanrijswijk@surfnet.nl About SURFnet National Research and Education Network (NREN) Founded in 1986 > 11000km
CSc 450/550 Computer Networks Domain Name System
CSc 450/550 Computer Networks Domain Name System Jianping Pan Summer 2007 5/28/07 CSc 450/550 1 Review: Web/HTTP Web URI/URL, HTML tags, embedded objects HTTP request and response persistence, statefulness
A versatile platform for DNS metrics
A versatile platform for DNS metrics Stéphane Bortzmeyer AFNIC bortzmeyer@nic.fr OARC - Atlanta - 2 february 2009 1 A versatile platform for DNS metrics Where are we in the talk? 1 General presentation
Network Working Group
Network Working Group R. Arends Request for Comments: 4035 Telematica Instituut Obsoletes: 2535, 3008, 3090, 3445, 3655, 3658, R. Austein 3755, 3757, 3845 ISC Updates: 1034, 1035, 2136, 2181, 2308, 3225,
Root KSK Roll Delay Update
Root KSK Roll Delay Update PacNOG 21 Patrick Jones, Sr. Director, Global Stakeholder Engagement 4 December 2017 1 Background When you validate DNSSEC signed DNS records, you need a Trust Anchor. A Trust
Computer Networks. Domain Name System. Jianping Pan Spring /25/17 CSC361 1
Computer Networks Domain Name System Jianping Pan Spring 2017 1/25/17 CSC361 1 Review: Web/HTTP Web URI/URL, HTML tags embedded/linked objects HTTP request and response persistence, statefulness web caching,
Software Systems for Surveying Spoofing Susceptibility
Software Systems for Surveying Spoofing Susceptibility Matthew Luckie, Ken Keys, Ryan Koga, Bradley Huffaker, Robert Beverly, kc claffy https://spoofer.caida.org/ AusNOG 2016, September 2nd 2016 www.caida.o
Networking Applications
Networking Dr. Ayman A. Abdel-Hamid College of Computing and Information Technology Arab Academy for Science & Technology and Maritime Transport 1 Outline Introduction Name Space concepts Domain Name Space
DNSSEC KSK-2010 Trust Anchor Signal Analysis
DNSSEC KSK-2010 Trust Anchor Signal Analysis MAPRG @ IETF102 1 Overview Background: DNSSEC KSK rollover and plan Problems with the KSK rollover Case study analysis: difficulty in identifying old Trust
Defeating DNS Amplification Attacks. UKNOF Manchester Central, UK January Ralf Weber Senior Infrastructure Architect
Defeating DNS Amplification Attacks UKNOF Manchester Central, UK January 21 2014 Ralf Weber Senior Infrastructure Architect History of DNS Amplification DNS amplification attacks aren't new Periodically
ICANN and Technical Work: Really? Yes! Steve Crocker DNS Symposium, Madrid, 13 May 2017
ICANN and Technical Work: Really? Yes! Steve Crocker DNS Symposium, Madrid, 13 May 2017 Welcome, everyone. I appreciate the invitation to say a few words here. This is an important meeting and I think
ARIN Support for DNSSEC and RPKI. ION San Diego 11 December 2012 Pete Toscano, ARIN
ARIN Support for DNSSEC and ION San Diego 11 December 2012 Pete Toscano, ARIN 2 DNS and BGP They have been around for a long time. DNS: 1982 BGP: 1989 They are not very secure. Methods for securing them
Routing the Internet in Geoff Huston APNIC March 2007
Routing the Internet in 2006 Geoff Huston APNIC March 2007 IPv4 in 2006 Total Advertised BGP Prefixes BGP Table Growth 210000 200000 190000 BGP FIB Entries 180000 2006 170000 2005 160000 150000 Jan Feb
Software Systems for Surveying Spoofing Susceptibility
Software Systems for Surveying Spoofing Susceptibility Matthew Luckie, Ken Keys, Ryan Koga, Bradley Huffaker, Robert Beverly, kc claffy https://spoofer.caida.org/ NANOG68, October 18th 2016 www.caida.o
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting Frankfurt, 26. January 2010 Samuel Benz samuel.benz@switch.ch About SWITCH The SWITCH foundation operates the national research network since 1987 SWITCH
Domain Name System (DNS) Session 2: Resolver Operation and debugging. Joe Abley AfNOG Workshop, AIS 2017, Nairobi
Domain Name System (DNS) Session 2: Resolver Operation and debugging Joe Abley AfNOG Workshop, AIS 2017, Nairobi DNS Resolver Operation How Resolvers Work (1)! If we've dealt with this query before recently,
Applications & Application-Layer Protocols: The Domain Name System and Peerto-Peer
CPSC 360 Network Programming Applications & Application-Layer Protocols: The Domain Name System and Peerto-Peer Systems Michele Weigle Department of Computer Science Clemson University mweigle@cs.clemson.edu
A Root DNS Server. Akira Kato. Brief Overview of M-Root. WIDE Project
A Root DNS Server Akira Kato WIDE Project kato@wide.ad.jp Brief Overview of M-Root Assumes basic knowledge on DNS Dr. Tatsuya Jinmei has introduced in Nov 19, 2004 What s Root Servers? Start point of the
Expires: November 15, 2004 VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST May 17, 2004
DNS Extensions Internet-Draft Expires: November 15, 2004 R. Arends Telematica Instituut M. Larson VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST May 17, 2004 Protocol Modifications for the DNS
Measuring IPv6 Adop3on
Measuring IPv6 Adop3on Jakub Czyz, University of Michigan Mark Allman, Interna=onal Computer Science Ins=tute Jing Zhang, University of Michigan ScoA Iekel- Johnson, Arbor Networks Eric Osterweil, Verisign
DNSSEC at Scale. Dani Grant CloudFlare
DNSSEC at Scale Dani Grant DNS @ CloudFlare CloudFlare - Authoritative DNS provider (includes DNSSEC for free) - 4M+ domains - 40+ billion queries per day - 76 edge locations in 40 countries (growing)
RSSAC Activities Update. Lars Johan Liman and Tripti Sinha RSSAC Chair ICANN-54 October 2015
RSSAC Activities Update Lars Johan Liman and Tripti Sinha RSSAC Chair ICANN-54 October 2015 Agenda 1 2 3 Overview RSSAC002 Implementation Status Update RSSAC003: RSSAC Report on Root Zone TTLs 4 5 6 RSSAC
4. Performance Specifications. 4.1 Goals and intentions of Service Level Agreements and Public Service Monitoring. Goals of Service Level Agreements:
4. Performance Specifications 4.1 Goals and intentions of Service Level Agreements and Public Service Monitoring Goals of Service Level Agreements: Service Level Agreements are set between ICANN and Registry
Measuring the IPv6 Internet by active DNS and HTTP measurements (work in progress)
Measuring the IPv6 Internet by active DNS and HTTP measurements (work in progress) emile.aben@ripe.net Early 21st centry http://www.ripe.net 1 The 2 Internets The IPv4 Internet The IPv6 Internet How are
Introduction to Information Science and Technology 2017 Networking II. Sören Schwertfeger 师泽仁
II Sören Schwertfeger 师泽仁 Outline Review Network Layer Routing Transport Layer Applications HTTP Demos Internet: Huge network of networks Billions of hosts (computers) Internet Structure Network Edge:
Introduction to Network. Topics
Introduction to Network Security Chapter 7 Transport Layer Protocols 1 TCP Layer Topics Responsible for reliable end-to-end transfer of application data. TCP vulnerabilities UDP UDP vulnerabilities DNS
What If Everyone Did It? Geoff Huston APNIC Labs
What If Everyone Did It? Geoff Huston APNIC Labs DNS Security Se#ng the AD bit in a recursive resolver response seems like a rather unimpressive way of conveying a posi;ve security outcome, and in the
DNS. Some advanced topics. Karst Koymans. Informatics Institute University of Amsterdam. (version 17.2, 2017/09/25 12:41:57)
DNS Some advanced topics Karst Koymans Informatics Institute University of Amsterdam (version 17.2, 2017/09/25 12:41:57) Friday, September 22, 2017 Karst Koymans (UvA) DNS Friday, September 22, 2017 1
Some advanced topics. Karst Koymans. Tuesday, September 16, 2014
DNS Some advanced topics Karst Koymans Informatics Institute University of Amsterdam (version 44, 2014/09/15 08:39:47) Tuesday, September 16, 2014 Karst Koymans (UvA) DNS Tuesday, September 16, 2014 1
Goal of this session
DNS refresher Overview Goal of this session What is DNS? How is DNS built and how does it work? How does a query work? Record types Caching and Authoritative Delegation: domains vs zones Finding the error:
An Overview of DNSSEC. Cesar Diaz! lacnic.net!
An Overview of DNSSEC Cesar Diaz! cesar@ lacnic.net! 1 DNSSEC??? The DNS Security Extension (DNS SEC) attach special kind of information called criptographic signatures to the queries and response that
IPv6: Are we really ready to turn off IPv4? Geoff Huston APNIC
IPv6: Are we really ready to turn off IPv4? Geoff Huston APNIC The IPv6 Timeline 1990 2000 2010 2020 The IPv6 Timeline Yes, we ve been working on this for close to 30 years! 1990 2000 2010 2020 In-situ
The Impact of Router Outages on the AS-Level Internet
The Impact of Router Outages on the AS-Level Internet Matthew Luckie* - University of Waikato Robert Beverly - Naval Postgraduate School *work started while at CAIDA, UC San Diego SIGCOMM 2017, August
Network Awareness and Network Security
Network Awareness and Network Security John McHugh Canada Research Chair in Privacy and Security Director, oratory Dalhousie University, Halifax, NS CASCON CyberSecurity Workshop 17 October 2005 Overview
Network Protocols. DNS Intel *slightly modified public version of another talk. TDC 375 Autumn 2009/10 John Kristoff DePaul University 1
Network Protocols DNS Intel *slightly modified public version of another talk TDC 375 Autumn 2009/10 John Kristoff DePaul University 1 What's in a name? dns research01.cti.depaul.edu. TDC 375 Autumn 2009/10
Akamai's V6 Rollout Plan and Experience from a CDN Point of View. Christian Kaufmann Director Network Architecture Akamai Technologies, Inc.
Akamai's V6 Rollout Plan and Experience from a CDN Point of View Christian Kaufmann Director Network Architecture Akamai Technologies, Inc. Agenda About Akamai General IPv6 transition technologies Challenges