Measuring DNS Source Port Randomness
|
|
|
- Terence Jordan
- 8 years ago
- Views:
Transcription
1 Measuring DNS Source Port Randomness Duane Wessels DNS-OARC 1st CAIDA/WIDE/CASFI Workshop August 15, 2008 CAIDA+WIDE+CASFI #1 0 DNS-OARC
2 DNS sucks. Okay, I m paraphrashing... Kaminsky Use random source ports to protect from poisoning But what about NATs? CAIDA+WIDE+CASFI #1 1 DNS-OARC
3 How do you know if your DNS ports are random? Web-only Needs javascript /etc/resolv.conf nameservers only Why not something strictly DNS-based? porttest.dns-oarc.net was born. CAIDA+WIDE+CASFI #1 2 DNS-OARC
4 Lots of Queries We need lots of queries from a resolver in order to detect source port randomness. CNAMEs Delegations Resolvers typically limit CNAME chain lengths To solve looping? Probably on the order of 10 15? doxpara uses CNAME chains (5) Neils Provos test also Delegation chain length not limited to my knowledge requires unique IP per delegation Make resolvers query for long name like z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.example.com Use a CNAME to start to avoid typing the long name CAIDA+WIDE+CASFI #1 3 DNS-OARC
5 porttest.dns-oarc.net Implemented in Perl (Net::DNS::Nameserver) 26 delegations (a z) and 26 IP addresses Return TXT record reporting measure of randomness Use short TTLs to allow test to be repeated from the same location. Log the results CAIDA+WIDE+CASFI #1 4 DNS-OARC
6 Measuring Randomness There are various statistical tests for randomness, but: I m not very good with statistics Some tests assume a Normal distribution Some tests require a lot of samples. So I cheat and use standard deviation as a measure of randomness. It s easy to imagine samples that have high standard deviation but low randomness. To account for repeated ports, I multiply the calculated standard deviation by the ratio of unique samples to total samples. Its not perfect, but its pretty good and at least some people can understand it. CAIDA+WIDE+CASFI #1 5 DNS-OARC
7 Standard Deviation The standard deviation of a sample from a discrete uniform distribution of size N is: σ = N Given the standard deviation of a sample, we can estimate the number of bits in the sample size as: Scoring: bits = log 2 12σ Score σ Range bits Range GREAT , GOOD POOR CAIDA+WIDE+CASFI #1 6 DNS-OARC
8 How It Looks with dig: $ dig +short porttest.dns-oarc.net txt porttest.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.\ b.a.pt.dns-oarc.net. " is GREAT: 26 queries in 3.1 seconds \ from 26 ports with std dev 19551" or is POOR: 26 queries in 45.5 seconds \ from 24 ports with std dev 69 or is POOR: 26 queries in 1.9 seconds \ from 1 ports with std dev 0 CAIDA+WIDE+CASFI #1 7 DNS-OARC
9 70 Porttest Queries Per Day 60 Queries per Day (Thousands) VU# published porttest written proper logging Leaked Jul Aug08 Date 11 18
10 Scores Per Day Whitelisted Poor Good Great Percentage Jul Aug08 Date 11 18
11 Compare to Sid s SIE Data
12 Nominum Nominum didn t want to a lot of bits of source port randomness, for whatever reason. Implemented additional anti-spoofing/anti-poisoning features. Such as switching to TCP upon detection of a spoof attempt. Upset that their nameservers not rated GREAT. Now whitelisted (as of ) based on list of addresses they provide. CAIDA+WIDE+CASFI #1 11 DNS-OARC
13 Web-based Tool Vixie suggested to Myself, Dagon, and Neils that OARC should host a web-based randomness test. Google ads would direct users to the page. The Google ads didn t quite pan out, but I think the tool turned out nicely. Advantages: Good for people that can t use dig. Provides lots more information that a TXT response. Might end up testing more than one resolver at a time. Disadvantages: Can only test system-configured resolvers. CAIDA+WIDE+CASFI #1 12 DNS-OARC
14 Implementation Begins with an HTTP request. The HTTP response is a redirect to a URL with randomly generated name: Location: The random string becomes a cookie. It contains random parts and a timestamp. The first DNS request returns a CNAME with the cookie expanded to a sequence of separate zones: bd0974adaae13c et.dns-oarc.net IN CNAME \ b.d a.d.a.a.e.1.3.c et.dns-oarc.net. The last nameserver returns the web server address where a CGI script uses the cookie to read the query history from an SQL database and present the results. CAIDA+WIDE+CASFI #1 13 DNS-OARC
15
16
17 120 Web DNS Test Queries Per Day 100 Queries per Day (Thousands) Jul Aug08 Date 11 18
18 Web DNS Test Scores Per Day Whitelisted Poor Good Great Percentage Jul Aug08 Date 11 18
19 Deploy DNSSEC How To Not Be Poisoned Have good transaction ID randomness Have good source port randomness Implement dns-0x20 (random upper-/lower-casing of query name) Use multiple source addresses (unbound, powerdns) Detect spoof attempts (nominum, powerdns) Require multiple matching authoritative answers Add nonce via EDNS0. TCP CAIDA+WIDE+CASFI #1 18 DNS-OARC
20 Final Thoughts This testing tool is probably self selecting such that it tends to attract sources that are not yet updated. It is not a good indicator of patching rates. Should calculate Wald-Wolfowitz Z-scores and see if they correlate to standard deviation. Notify network operators of still-vulnerable resolvers. CAIDA+WIDE+CASFI #1 19 DNS-OARC
21 The End
Defending your DNS in a post-kaminsky world. Paul Wouters <paul@xelerance.com>
Defending your DNS in a post-kaminsky world Paul Wouters Overview History of DNS and the Kaminsky attack Various DNS problems explained Where to address the DNS problem Nameservers,
THE domain name system (DNS) is used at the outset
SECURING AND TRUSTING INTERNET NAMES, SATIN 2011 1 Measuring DNS Vulnerabilities and DNSSEC Challenges from an Irish Perspective William J. Glynn IE Domain Registry (IEDR) billy.glynn@iedr.ie Abstract
F-Root's DNSSEC Signing Plans. Keith Mitchell Internet Systems Consortium DNS-OARC NANOG48, Austin, 24 th Feb 2010
F-Root's DNSSEC Signing Plans Keith Mitchell Internet Systems Consortium DNS-OARC NANOG48, Austin, 24 th Feb 2010 What is ISC? Internet Systems Consortium, Inc. Headquartered in Redwood City, California
DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008
DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers Agenda How do you
Harness Your Internet Activity!
Harness Your Internet Activity Random Subdomain Attacks Plaguing the Internet Agenda Brief Intro Covered at last OARC Attack overview Latest data Progress on open dns proxies in home gateways Impact of
The secret life of a DNS query. Igor Sviridov <sia@nest.org> 20120522
The secret life of a DNS query Igor Sviridov 20120522 Preface Nowadays, when we type URL (or is it a search string? ;-) into a browser (or mobile device) many things happen. While most of
DNSSEC Applying cryptography to the Domain Name System
DNSSEC Applying cryptography to the Domain Name System Gijs van den Broek Graduate Intern at SURFnet Overview First half: Introduction to DNS Attacks on DNS Second half: DNSSEC Questions: please ask! DNSSEC
A versatile platform for DNS metrics with its application to IPv6
A versatile platform for DNS metrics with its application to IPv6 Stéphane Bortzmeyer AFNIC bortzmeyer@nic.fr RIPE 57 - Dubai - October 2008 1 A versatile platform for DNS metrics with its application
Defending your DNS in a post-kaminsky world. Paul Wouters <paul@xelerance.com>
Defending your DNS in a post-kaminsky world Paul Wouters Vendor and NGO's involved Two phase deployment First release a generic fix for the Kaminsky attack that does not leak information
Use Domain Name System and IP Version 6
Use Domain Name System and IP Version 6 What You Will Learn The introduction of IP Version 6 (IPv6) into an enterprise environment requires some changes both in the provisioned Domain Name System (DNS)
My Services Online Service Support. User Guide for DNS and NTP services
My Services Online Service Support User Guide for DNS and NTP services Table of Contents 1 MY SERVICES... 3 2 ACCESSING MY SERVICES VIA THE INTERNET... 3 2.1 Logging into My Services... 3 2.2 My Services
DNS at NLnet Labs. Matthijs Mekking
DNS at NLnet Labs Matthijs Mekking Topics NLnet Labs DNS DNSSEC Recent events NLnet Internet Provider until 1997 The first internet backbone in Holland Funding research and software projects that aid the
Domain Name System E-mail WWW. Application Layer. Mahalingam Ramkumar Mississippi State University, MS. September 15, 2014.
Application Layer Mahalingam Mississippi State University, MS September 15, 2014 Outline 1 DNS Records DNS Components 2 Message Transfer Fetching Emails 3 Applications We will focus on 3 applications DNS
Network Security. DNS (In)security. Radboud University, The Netherlands. Autumn 2015
Network Security DNS (In)security Radboud University, The Netherlands Autumn 2015 A short recap Routing means directing (Internet) traffic to its target Internet is divided into 52, 000 Autonomous Systems
DNSSEC Support in SOHO CPE. OARC Workshop Ottawa 24 th September 2008
DNSSEC Support in SOHO CPE OARC Workshop Ottawa 24 th September 2008 or: How not to write a DNS proxy Study Details What is the impact of DNSSEC on consumer-class broadband routers? Joint study between
Web-Application Security
Web-Application Security Kristian Beilke Arbeitsgruppe Sichere Identität Fachbereich Mathematik und Informatik Freie Universität Berlin 29. Juni 2011 Overview Web Applications SQL Injection XSS Bad Practice
Security of Patched DNS. Bar Ilan University, Department of Computer Science, Network Security Group Technical Report TR12-04
1 Security of Patched DNS Bar Ilan University, Department of Computer Science, Network Security Group Technical Report TR12-04 Amir Herzberg and Haya Shulman Abstract Most caching DNS resolvers still rely
Remote DNS Cache Poisoning Attack Lab
SEED Labs Remote DNS Cache Poisoning Attack Lab 1 Remote DNS Cache Poisoning Attack Lab Copyright c 2014 Wenliang Du, Syracuse University. The development of this document is/was funded by the following
Enterprise Architecture Office Resource Document Design Note - Domain Name System (DNS)
Date: 8/27/2012 Enterprise Architecture Office Resource Document Design Note - Domain Name System (DNS) Table of Contents 1 Overview...2 1.1 Other Resources...2 1.1.1 State of Minnesota Standards and Guidelines...2
IPV6 SERVICES DEPLOYMENT
IPV6 SERVICES DEPLOYMENT LINX IPv6 Technical Workshop - March 2009 Jaco Engelbrecht Group Platforms Manager, clara.net DNS root zone goes AAAA! On 4 th February 2008 IANA added AAAA records for the A,
CS 558 Internet Systems and Technologies
CS 558 Internet Systems and Technologies Dimitris Deyannis deyannis@csd.uoc.gr 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.
Global Service Loadbalancing & DNSSEC. Ralf Brünig Field Systems Engineer r.bruenig@f5.com DNSSEC
Global Service Loadbalancing & DNSSEC Ralf Brünig Field Systems Engineer r.bruenig@f5.com DNSSEC F5 s Integrated Solution Users The F5 Solution Applications Mobile Phone PDA Laptop Desktop Application
An Intrusion Detection System for Kaminsky DNS Cache poisoning
An Intrusion Detection System for Kaminsky DNS Cache poisoning Dhrubajyoti Pathak, Kaushik Baruah Departement of CSE, IIT Guwahati drbj153@alumni.iitg.ernet.in, b.kaushik@iitg.ernet.in Abstract : Domain
Domain Name System Security
Domain Name System Security Guevara Noubir Network Security Northeastern University 1 Domain Name System DNS is a fundamental applica=on layer protocol Not visible but invoked every =me a remote site is
DOMAIN NAME SECURITY EXTENSIONS
DOMAIN NAME SECURITY EXTENSIONS The aim of this paper is to provide information with regards to the current status of Domain Name System (DNS) and its evolution into Domain Name System Security Extensions
Identifying Patterns in DNS Traffic
Identifying Patterns in DNS Traffic Pieter Lexis System and Network Engineering Thu, Jul 4 2013 Reflection and Amplification Attacks DNS abused as DDoS Tool Spamhaus hit with 300 Gigabit/second DDoS Reflected
Unbound a caching, validating DNSSEC resolver. Do you trust your name server? Configuration. Unbound as a DNS cache (SEC-less)
Unbound a caching, validating DNSSEC resolver UKUUG Spring 2011 Conference Leeds, UK March 2011 Jan-Piet Mens $ dig 1.1.0.3.3.0.8.1.7.1.9.4.e164.arpa naptr Do you trust your name server? DNS clients typically
Web Security. Mahalingam Ramkumar
Web Security Mahalingam Ramkumar Issues Phishing Spreading misinformation Cookies! Authentication Domain name DNS Security Transport layer security Dynamic HTML Java applets, ActiveX, JavaScript Exploiting
Part 5 DNS Security. SAST01 An Introduction to Information Security 2015-09-21. Martin Hell Department of Electrical and Information Technology
SAST01 An Introduction to Information Security Part 5 DNS Security Martin Hell Department of Electrical and Information Technology How DNS works Amplification attacks Cache poisoning attacks DNSSEC 1 2
RSSAC Recommendation on Measurements of the Root Server System RSSAC 002
RSSAC Recommendation on Measurements of the Root Server System RSSAC 002 Table of Contents Introduction... 3 Measurement Parameters... 3 The latency in the distribution system... 4 The size of the overall
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ MEng. Nguyễn CaoĐạt
Computer Networks 1 (Mạng Máy Tính 1) Lectured by: Dr. Phạm Trần Vũ MEng. Nguyễn CaoĐạt 1 Lecture 10: Application Layer 2 Application Layer Where our applications are running Using services provided by
How to Add Domains and DNS Records
How to Add Domains and DNS Records Configure the Barracuda NextGen X-Series Firewall to be the authoritative DNS server for your domains or subdomains to take advantage of Split DNS or dead link detection.
Ralph Dolmans A solution for the DNS amplification attack problem
Ralph Dolmans A solution for the DNS amplification attack problem July 4 th, 2013 Context Spamhaus was attacked with 300Gbps Every day attacks are getting bigger Sites can be held hostage, banks cannot
DNS & IPv6. Agenda 4/14/2009. MENOG4, 8-9 April 2009. Raed Al-Fayez SaudiNIC CITC rfayez@citc.gov.sa, www.nic.net.sa. DNS & IPv6.
DNS & IPv6 MENOG4, 8-9 April 2009 Raed Al-Fayez SaudiNIC CITC rfayez@citc.gov.sa, www.nic.net.sa Agenda DNS & IPv6 Introduction What s next? SaudiNIC & IPv6 About SaudiNIC How a cctld Registry supports
Domain Name System (DNS)
Application Layer Domain Name System Domain Name System (DNS) Problem Want to go to www.google.com, but don t know the IP address Solution DNS queries Name Servers to get correct IP address Essentially
DNS. DNS Fundamentals. Goals of this lab: Prerequisites: LXB, NET
DNS DNS Fundamentals Goals of this lab: Learn how the domain name system works Learn about tools to test and troubleshoot DNS Learn how to deploy a basic DNS service Prerequisites: LXB, NET REVISION: 2.0
Q3 State of DNS Report DNSSEC Deployment in.gov
Q3 State of DNS Report DNSSEC Deployment in.gov September 22, 2010 Major findings 38% of federal.gov domains have been signed with DNSSEC as of mid- September 2010 36% of federal.gov domains are fully
Whats Wrong With The DNS
Whats Wrong With The DNS Duane Wessels The Measurement Factory/CAIDA wessels@measurement-factory.com October 3, 2006 The Measurement Factory 0 CAIDA About This Talk A collection of all DNS-related problems
Non-authoritative answer: home.web.cern.ch canonical name = drupalprod.cern.ch. Name: drupalprod.cern.ch Address: 137.138.76.28
1. Run nslookup to obtain the IP address of a Web server in Europe. frigate:desktop drb$ nslookup home.web.cern.ch Server: 130.215.32.18 Address: 130.215.32.18#53 Non-authoritative answer: home.web.cern.ch
2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008
2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers How does the DNS work? A typical DNS query The
Internet-Praktikum I Lab 3: DNS
Kommunikationsnetze Internet-Praktikum I Lab 3: DNS Mark Schmidt, Andreas Stockmayer Sommersemester 2015 kn.inf.uni-tuebingen.de Motivation for the DNS Problem IP addresses hard to remember for humans
dnstap: high speed DNS logging without packet capture Robert Edmonds (edmonds@fsi.io) Farsight Security, Inc.
: high speed DNS logging without packet capture Robert Edmonds (edmonds@fsi.io) Farsight Security, Inc. URL http://.info Documentation Presentations Tutorials Mailing list Downloads Code repositories Slide
Monitoring cache poisoning attacks
Monitoring cache poisoning attacks 2008 OARC Workshop Tsuyoshi TOYONO and Keisuke ISHIBASHI NTT Information Sharing Platform Labs. NTT 1 Outline Motivation Issues on caching servers Monitoring tool: Methodology
Glossary of Technical Terms Related to IPv6
AAAA Record An AAAA record stores a 128-bit Internet Protocol version 6 (IPv6) address, which does not fit the standard A record format. For example, 2007:0db6:85a3:0000:0000:6a2e:0371:7234 is a valid
DNS. The Root Name Servers. DNS Hierarchy. Computer System Security and Management SMD139. Root name server. .se name server. .
Computer System Security and Management SMD139 Lecture 5: Domain Name System Peter A. Jonsson DNS Translation of Hostnames to IP addresses Hierarchical distributed database DNS Hierarchy The Root Name
A Plan for the Continued Development of the DNS Statistics Collector
A Plan for the Continued Development of the DNS Statistics Collector Background The DNS Statistics Collector ( DSC ) software was initially developed under the National Science Foundation grant "Improving
Computer Networks: DNS a2acks CS 1951e - Computer Systems Security: Principles and Prac>ce. Domain Name System
Computer Networks: DNS a2acks CS 1951e - Computer Systems Security: Principles and Prac>ce 18/02/15 Networks: DNS attacks 1 Domain Name System The domain name system (DNS) is an applica>on- layer protocol
DNS Cache-Poisoning: New Vulnerabilities and Implications, or: DNSSEC, the time has come!
DNS Cache-Poisoning: New Vulnerabilities and Implications, or: DNSSEC, the time has come! Amir Herzberg and Haya Shulman Dept. of Computer Science Bar Ilan University 8/1/2013 About us Bar Ilan University
Quality Certificate for Kaspersky DDoS Prevention Software
Quality Certificate for Kaspersky DDoS Prevention Software Quality Certificate for Kaspersky DDoS Prevention Software Table of Contents Definitions 3 1. Conditions of software operability 4 2. General
The story of dnsdist - or - Do we need a DNS Delivery Controller? http://dnsdist.org/
The story of dnsdist - or - Do we need a DNS Delivery Controller? http://dnsdist.org/ PowerDNS Very briefly so you know where we come from Open source nameserver, around since 2000, open source since 2002,
CS3250 Distributed Systems
CS3250 Distributed Systems Lecture 4 More on Network Addresses Domain Name System DNS Human beings (apart from network administrators and hackers) rarely use IP addresses even in their human-readable dotted
DNSSEC and DNS Proxying
DNSSEC and DNS Proxying DNS is hard at scale when you are a huge target 2 CloudFlare DNS is big 3 CloudFlare DNS is fast 4 CloudFlare DNS is always under attack 5 CloudFlare A secure reverse proxy for
http://alice.teaparty.wonderland.com:23054/dormouse/bio.htm
Client/Server paradigm As we know, the World Wide Web is accessed thru the use of a Web Browser, more technically known as a Web Client. 1 A Web Client makes requests of a Web Server 2, which is software
Deploying IP Anycast. Core DNS Services for University of Minnesota Introduction and General discussion
Deploying IP Anycast Core DNS Services for University of Minnesota Introduction and General discussion Agenda Deploying IPv4 anycast DNS What is ANYCAST Why is ANYCAST important? Monitoring and using ANYCAST
DNS security: poisoning, attacks and mitigation
DNS security: poisoning, attacks and mitigation The Domain Name Service underpins our use of the Internet, but it has been proven to be flawed and open to attack. Richard Agar and Kenneth Paterson explain
DNS + DHCP. Michael Tsai 2015/04/27
DNS + DHCP Michael Tsai 2015/04/27 lubuntu.ova http://goo.gl/bax8b8 DNS + DHCP DNS: domain name < > IP address DHCP: gives you a IP + configuration when you joins a new network DHCP = Dynamic Host Configuration
How to Configure Captive Portal
How to Configure Captive Portal Captive portal is one of the user identification methods available on the Palo Alto Networks firewall. Unknown users sending HTTP or HTTPS 1 traffic will be authenticated,
Products, Features & Services
Products, Features & Services PowerDNS PowerDNS, founded in the late 1990s, is a premier supplier of DNS software, services and support. Deployed throughout the world with some of the most demanding users
Acquia Cloud Edge Protect Powered by CloudFlare
Acquia Cloud Edge Protect Powered by CloudFlare Denial-of-service (DoS) Attacks Are on the Rise and Have Evolved into Complex and Overwhelming Security Challenges TECHNICAL GUIDE TABLE OF CONTENTS Introduction....
The Use of DNS Resource Records
International Journal of Advances in Electrical and Electronics Engineering 230 Available online at www.ijaeee.com & www.sestindia.org/volume-ijaeee/ ISSN: 2319-1112 Simar Preet Singh Systems Engineer,
DNS, DNSSEC and DDOS. Geoff Huston APNIC February 2014
DNS, DNSSEC and DDOS Geoff Huston APNIC February 2014 The Evolu3on of Evil It used to be that they sent evil packets to their chosen vic3m but this exposed the abacker, and limited the damage they could
Response Policy Zones for the Domain Name System (DNS RPZ) By Paul Vixie, ISC (et.al.) 2010 World Tour
Response Policy Zones for the Domain Name System (DNS ) By Paul Vixie, ISC (et.al.) 2010 World Tour Overview Motivation for DNS Response Policy Zones Relationship to DNS RBL (DNSBL) Constraints and Goals
Lecture 2 CS 3311. An example of a middleware service: DNS Domain Name System
Lecture 2 CS 3311 An example of a middleware service: DNS Domain Name System The problem Networked computers have names and IP addresses. Applications use names; IP uses for routing purposes IP addresses.
Applied Network Services. Janet Services for Resilience. Andrew Davis Network Services Coordinator Email: andrew.davis@ja.net
Applied Network Services Janet Services for Resilience Andrew Davis Network Services Coordinator Email: andrew.davis@ja.net What we can do to help... Janet services Primary Nameserver Service Backup Master
PowerDNS Introduction
PowerDNS Introduction OX Summit 2015 All presentations will be on: https://www.powerdns.com/oxsummit PowerDNS History Founded in 1999 to provide database driven DNS + geographical load balancing between
CloudFlare advanced DDoS protection
CloudFlare advanced DDoS protection Denial-of-service (DoS) attacks are on the rise and have evolved into complex and overwhelming security challenges. 1 888 99 FLARE enterprise@cloudflare.com www.cloudflare.com
CS514: Intermediate Course in Computer Systems
: Intermediate Course in Computer Systems Lecture 7: Sept. 19, 2003 Load Balancing Options Sources Lots of graphics and product description courtesy F5 website (www.f5.com) I believe F5 is market leader
mydnsipv6 Success Story
Internet Identity For All mydnsipv6 Success Story By Norsuzana Harun Manager, Technology and Innovation Dept. 20 th July 2009 Agenda 1. About mydnsipv6 mydnsipv6 Roadmap (2006 2010) 2. mydnsipv6 Test Bed
The story of dnsdist - or - Do we need a DNS Delivery Controller? http://dnsdist.org/
The story of dnsdist - or - Do we need a DNS Delivery Controller? http://dnsdist.org/ PowerDNS Very briefly so you know where we come from Open source nameserver, around since 2000, open source since 2002,
Deploying the Barracuda Load Balancer with Office Communications Server 2007 R2. Office Communications Server Overview.
Deploying the Barracuda Load Balancer with Office Communications Server 2007 R2 Organizations can use the Barracuda Load Balancer to enhance the scalability and availability of their Microsoft Office Communications
Security of IPv6 and DNSSEC for penetration testers
Security of IPv6 and DNSSEC for penetration testers Vesselin Hadjitodorov Master education System and Network Engineering June 30, 2011 Agenda Introduction DNSSEC security IPv6 security Conclusion Questions
Attack and Defense Techniques
Network Security Attack and Defense Techniques Anna Sperotto, Ramin Sadre Design and Analysis of Communication Networks (DACS) University of Twente The Netherlands Attack Taxonomy Many different kind of
DOSarrest External MULTI-SENSOR ARRAY FOR ANALYSIS OF YOUR CDN'S PERFORMANCE IMMEDIATE DETECTION AND REPORTING OF OUTAGES AND / OR ISSUES
.com DOSarrest External Monitoring S ystem (DEMS) User s Guide REAL BROWSER MONITORING OF YOUR WEBSITE MULTI-SENSOR ARRAY FOR ANALYSIS OF YOUR CDN'S PERFORMANCE IMMEDIATE DETECTION AND REPORTING OF OUTAGES
Content Delivery Networks (CDN) Dr. Yingwu Zhu
Content Delivery Networks (CDN) Dr. Yingwu Zhu Web Cache Architecure Local ISP cache cdn Reverse Reverse Proxy Reverse Proxy Reverse Proxy Proxy L4 Switch Content Content Content Server Content Server
Course Content: Session 1. Ethics & Hacking
Course Content: Session 1 Ethics & Hacking Hacking history : How it all begin Why is security needed? What is ethical hacking? Ethical Hacker Vs Malicious hacker Types of Hackers Building an approach for
How To Block Child Abuse In Danesborg
CENSURFRIDNS Thomas Steen Rasmussen admin@censurfridns.dk March 11th, 2012 Agenda - Politics What is censurfridns and why does it exist What is censored on the Danish ISP nameservers? How come censurfridns
Defending against DNS reflection amplification attacks
University of Amsterdam System & Network Engineering RP1 Defending against DNS reflection amplification attacks February 14, 2013 Authors: Thijs Rozekrans Javy de Koning
This is the author manuscript, before publisher editing. The original publication is available at www.springerlink.com.
c 2013 Springer-Verlag Berlin Heidelberg. This is the author manuscript, before publisher editing. The original publication is available at www.springerlink.com. Digital Object Identifier: 10.1007/978-3-642-36516-4
page 1 DNS Rate Limiting W. Matthijs Mekking matthijs@nlnetlabs.nl http://www.nlnetlabs.nl/ 28 Feb 2013 Stichting NLnet Labs
page 1 DNS Rate Limiting W. Matthijs Mekking matthijs@nlnetlabs.nl page 2 One slide DNS Root www.nlnetlabs.nl A Referral: nl NS www.nlnetlabs.nl A 213.154.224.1 www.nlnetlabs.nl A www.nlnetlabs.nl A 213.154.224.1
How To - Configure Virtual Host using FQDN How To Configure Virtual Host using FQDN
How To - Configure Virtual Host using FQDN How To Configure Virtual Host using FQDN Applicable Version: 10.6.2 onwards Overview Virtual host implementation is based on the Destination NAT concept. Virtual
DNSwitness: A Generic Platform For DNS-based Measurements
DNSwitness: A Generic Platform For DNS-based Measurements Journée «Mesures Internet», Paris, 24 April 2012 {Samia.Mtimet, Stephane.Bortzmeyer, Mohsen.Souissi} (at) afnic.fr Overview Motivation Principles
FortiGate Multi-Threat Security Systems I
FortiGate Multi-Threat Security Systems I Module 9: Web Filtering 2013 Fortinet Inc. All rights reserved. The information contained herein is subject to change without notice. No part of this publication
Domain Name System (DNS) Fundamentals
Domain Name System (DNS) Fundamentals Mike Jager Network Startup Resource Center mike.jager@synack.co.nz These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International
Transferring Hosting to Fasthosts
Fasthosts Customer Support Transferring Hosting to Fasthosts This guide will show you how to transfer hosting to Fasthosts from another provider Customer Support Transferring Hosting to Fasthosts Contents
Finding and Preventing Cross- Site Request Forgery. Tom Gallagher Security Test Lead, Microsoft
Finding and Preventing Cross- Site Request Forgery Tom Gallagher Security Test Lead, Microsoft Agenda Quick reminder of how HTML forms work How cross-site request forgery (CSRF) attack works Obstacles
Why You Need More Than Two Library and Information Services School of African and Oriental Studies London Networkshop 38, 2010 Everything Rolled into Together Design Flaws 1990 s DNS Design in 2010 In
DNSSEC - Why Network Operators Should Care And How To Accelerate Deployment
DNSSEC - Why Network Operators Should Care And How To Accelerate Deployment Dan York, CISSP Senior Content Strategist, Internet Society Eurasia Network Operators' Group (ENOG) 4 Moscow, Russia October
Coordinación. The background image of the cover is desgned by http://www.freepik.com/ GUIDE TO DNS SECURITY 2
Autor Antonio López Padilla Coordinación Daniel Fírvida Pereira This publication belongs to INTECO (Instituto Nacional de Tecnologías de la Comunicación) and is under an Attribution- NonCommercial 3.0
DNS Session 4: Delegation and reverse DNS. Joe Abley AfNOG 2006 workshop
DNS Session 4: Delegation and reverse DNS Joe Abley AfNOG 2006 workshop How do you delegate a subdomain? In principle straightforward: just insert NS records for the subdomain, pointing at someone else's
Operational Problems in IPv6: Fallback and DNS issues
Operational Problems in : Fallback and DNS issues Tomohiro Fujisaki, Arifumi Matsumoto, Katsuyasu Toyama,Tsuyoshi Toyono and Shirou Niinobe Nippon Telegraph and Telephone Corporation Network problems associated
Benchmarking Zonemaster Sandoche Balakrichenan (Afnic) & Einar Lonn (IIS)
Benchmarking Zonemaster Sandoche Balakrichenan (Afnic) & Einar Lonn (IIS) 1 1 Health check je n'ai pas eu de retour, peut être que c'était trop sybillin 2 DNS Health check Connectivity Name Server DNSSEC
Name Server Selec+on of DNS Caching Resolvers
Name Server Selec+on of DNS Caching Resolvers Yingdi Yu 1, Duane Wessels 2, Ma> Larson 2, and Lixia Zhang 1 1 UCLA 2 VeriSign Lab 1 UCLA 2 VeriSign Labs 1 Why Select Servers Query the fastest server To
Domain Name System. CS 571 Fall 2006. 2006, Kenneth L. Calvert University of Kentucky, USA All rights reserved
Domain Name System CS 571 Fall 2006 2006, Kenneth L. Calvert University of Kentucky, USA All rights reserved DNS Specifications Domain Names Concepts and Facilities RFC 1034, November 1987 Introduction
DNS. Computer Networks. Seminar 12
DNS Computer Networks Seminar 12 DNS Introduction (Domain Name System) Naming system used in Internet Translate domain names to IP addresses and back Communication works on UDP (port 53), large requests/responses
testing and presenting Internet Health Anne-Marie Eklund Löwinder Quality & Security Manager amel@iis.se
testing and presenting Internet Health Anne-Marie Eklund Löwinder Quality & Security Manager amel@iis.se Three years of trial and learning From quite rudimentary tools 2007 to a flexible reusable tool
Startup guide for Zimonitor
Page 1 of 5 Startup guide for Zimonitor This is a short introduction to get you started using Zimonitor. Start by logging in to your version of Zimonitor using the URL and username + password sent to you.
The Domain Name System from a security point of view
The Domain Name System from a security point of view Simon Boman Patrik Hellström Email: {simbo105, pathe321}@student.liu.se Supervisor: David Byers, {davby@ida.liu.se} Project Report for Information Security
DRDoS Attacks: Latest Threats and Countermeasures. Larry J. Blunk Spring 2014 MJTS 4/1/2014
DRDoS Attacks: Latest Threats and Countermeasures Larry J. Blunk Spring 2014 MJTS 4/1/2014 Outline Evolution and history of DDoS attacks Overview of DRDoS attacks Ongoing DNS based attacks Recent NTP monlist
THE MASTER LIST OF DNS TERMINOLOGY. v 2.0
THE MASTER LIST OF DNS TERMINOLOGY v 2.0 DNS can be hard to understand and if you re unfamiliar with the terminology, learning more about DNS can seem as daunting as learning a new language. To help people
Effect of anycast on K-root
Effect of anycast on K-root Some early results 1 K root anycast deployment 3 global nodes (BGP transit) LINX... 5459 25152 25152 i AMS-IX... 25152 25152 25152 i Tokyo (since 5/2005)... 25152 25152 25152