DNS Measurements, Monitoring & Quality Control
|
|
|
- Donald Townsend
- 10 years ago
- Views:
Transcription
1 DNS Measurements, Monitoring & Quality Control Universität Bielefeld CENTR General Assembly Budapest, CENTR GA DNS Monitoring 1 of 18
2 The Monitor Some Bad News (headlines, at least) Facts behind the News How to investigate Thoughts on prevention CENTR GA DNS Monitoring 2 of 18
3 News at eleven More than 80% of all TLD and Root nameservers are vulnerable! (anonymous) CENTR GA DNS Monitoring 3 of 18
4 DNS Why bother? DNS is critical infrastructure often overlooked, but easy to understand more visible and accessible than other parts of that infrastructure proven scalability and redundancy many new tasks out there Overloading the Saddlebags of an Old Horse (Randy Bush) CENTR GA DNS Monitoring 4 of 18
5 New Challenges IDN Internationalisation expect more queries for non compliant hostnames, longer names DNSSEC Data Origin Authentication larger packets, more latency ENUM Phone Numbers hierarchy, again IPv6 A6 RRs and IP6.ARPA query volume, namespace fragmentation CENTR GA DNS Monitoring 5 of 18
6 What to look at? Server availability, responsiveness Server response times Query volume and patterns Zone quality CENTR GA DNS Monitoring 6 of 18
7 Availability Monitoring Are your servers alive? Do all your slave servers still exist? Do servers respond (locally)? Are their answers authoritative? Are they in sync? ( DNS zone convergence times) CENTR GA DNS Monitoring 7 of 18
8 Who s out there? Cooperative Association for Internet Data Analysis (CAIDA) RIPE NCC TTM RIPE DNS Hostcount TLD led initiatives, e.g. AFNIC s zonecheck DNS ISAC (Information Sharing and Analysis Center) The Matrix, Men & Mice,... CENTR GA DNS Monitoring 8 of 18
9 CAIDA s passive measurements NeTraMet listening to DNS packets only Meter sites: Auckland, Colorado, San Diego ( far end of the net) Measures RTT Compared cctlds with Root and gtlds cctld s servers receive less queries than gtlds Servers covering multiple cctlds Busiest cctlds inspected Nevil Brownlee looking for more meter sites CENTR GA DNS Monitoring 9 of 18
10 Single server monitoring Watch query patterns (and maybe responses) at single server... including all anycast instances CENTR GA DNS Monitoring 10 of 18
11 Server Anycasting multiple instances, topologically distributed server load distribution increased DDoS resilience documented in RFC 3258 deployed for certain Root Nameservers... and some TLD servers also attractive for cctld servers CENTR GA DNS Monitoring 11 of 18
12 Operational advantages by measurement & monitoring Both recent F measurements (Nemeth, Wessels) suggest limited number of high volume culprits find out which sloppy software and/or configuration costs your money microsoft.com problems first noted at COM servers reachability in remote parts of the network is service not only to remote users but also to your customers CENTR GA DNS Monitoring 12 of 18
13 DNS quality in and around RIPE NCC: Active measurements, stay tuned for next slide show DNS WG technical DNS quality on sub TLD levels collect, compile and evaluate set of tests for pre-delegation checks DNS Hostcount long standing data collection growth statistics some postprocessing looking for error patterns and habits CENTR GA DNS Monitoring 13 of 18
14 DNS checks AFNIC has published zonecheck Service freely available on the web: Hostcount data shows lots of problems Responsibilities for technical quality below TLD Problems at 2nd or 3rd level may affect innocent third parties Additional service vs. necessary monitoring Participate in test collection and evaluation CENTR GA DNS Monitoring 14 of 18
15 What is all this measuring good for? Registry resource planning Registry operations and incident response Customer service QoS documentation Deployment support Directions for future DNS work CENTR GA DNS Monitoring 15 of 18
16 Example (DE): Effects of Server Deployment CENTR GA DNS Monitoring 16 of 18
17 A Plea do (support) research (have someone) monitor your servers and service share and publish results coordinate measurements CENTR GA DNS Monitoring 17 of 18
18 ?! CENTR GA DNS Monitoring 18 of 18
K-Root Name Server Operations
K-Root Name Server Operations Andrei Robachevsky [email protected] 1 Outline Root Server System brief update Architecture Current locations Anycast deployment K.root-servers.net Server Major milestones Current
THE MASTER LIST OF DNS TERMINOLOGY. v 2.0
THE MASTER LIST OF DNS TERMINOLOGY v 2.0 DNS can be hard to understand and if you re unfamiliar with the terminology, learning more about DNS can seem as daunting as learning a new language. To help people
THE MASTER LIST OF DNS TERMINOLOGY. First Edition
THE MASTER LIST OF DNS TERMINOLOGY First Edition DNS can be hard to understand and if you re unfamiliar with the terminology, learning more about DNS can seem as daunting as learning a new language. To
IPv6 Support in the DNS. Workshop Name Workshop Location, Date
IPv6 Support in the DNS Workshop Name Workshop Location, Date Agenda How important is the DNS? DNS Resource Lookup DNS Extensions for IPv6 Lookups in an IPv6-aware DNS Tree About Required IPv6 Glue in
IPv6 Support in the DNS. Workshop Name Workshop Location, Date
IPv6 Support in the DNS Workshop Name Workshop Location, Date Copy Rights This slide set is the ownership of the 6DEPLOY project via its partners The Powerpoint version of this material may be reused and
IPv6 support in the DNS
IPv6 support in the DNS How important is the DNS? Getting the IP address of the remote endpoint is necessary for every communication between TCP/IP applications Humans are unable to memorize millions of
IANA Functions to cctlds Sofia, Bulgaria September 2008
IANA Functions to cctlds Sofia, Bulgaria September 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers What is IANA? Internet Assigned Numbers Authority
Computer Networks: Domain Name System
Computer Networks: Domain Name System Domain Name System The domain name system (DNS) is an application-layer protocol for mapping domain names to IP addresses DNS www.example.com 208.77.188.166 http://www.example.com
Telecom and Internet Regulatory Challenges and Opportunities Names, Numbers, Internet Governance
Telecom and Internet Regulatory Challenges and Opportunities Names, Numbers, Internet Governance Global Forum ICT & The Future of Internet Bucharest, Romania, 19-20 October 2009 Theresa Swinehart Vice-President
DNS. The Root Name Servers. DNS Hierarchy. Computer System Security and Management SMD139. Root name server. .se name server. .
Computer System Security and Management SMD139 Lecture 5: Domain Name System Peter A. Jonsson DNS Translation of Hostnames to IP addresses Hierarchical distributed database DNS Hierarchy The Root Name
BEST PRACTICES FOR IMPROVING EXTERNAL DNS RESILIENCY AND PERFORMANCE
BEST PRACTICES FOR IMPROVING EXTERNAL DNS RESILIENCY AND PERFORMANCE BEST PRACTICES FOR IMPROVING EXTERNAL DNS RESILIENCY AND PERFORMANCE Your external DNS is a mission critical business resource. Without
RIPE Atlas. Philip Smith Network Startup Resource Center (NSRC) PacNOG 16 1 st December 2014, Honiara, Solomon Islands
Philip Smith Network Startup Resource Center (NSRC) PacNOG 16 1 st December 2014, Honiara, Solomon Islands Intro https://atlas.ripe.net 3 Atlas in the Pacific 4 Measurement Devices 5 v1 & v2: Lantronix
Use Domain Name System and IP Version 6
Use Domain Name System and IP Version 6 What You Will Learn The introduction of IP Version 6 (IPv6) into an enterprise environment requires some changes both in the provisioned Domain Name System (DNS)
A Survey of cctld DNS Vulnerabilities. ITU cctld Workshop March 3, 2003 [email protected]
A Survey of cctld DNS Vulnerabilities ITU cctld Workshop March 3, 2003 [email protected] RATIONALE Health-check on DNS infrastructure > Now becoming a critical national resource Attacks on DNS servers
Domain Name Industry. Comparing ZA with the rest
Domain Name Industry Comparing ZA with the rest Key Defini)ons ZADNA:.ZA Domain Name Authority DNS: cctld: gtld: ICANN: SLD: Domain Name System country code Top Level Domain.za.uk.ke generic Top Level
Pre Delegation Testing (PDT) Frequently Asked Questions (FAQ)
Pre Delegation Testing (PDT) Frequently Asked Questions (FAQ) [Ver 1.7 2013-06- 04] List of contents General questions Who do I contact with questions about Pre- Delegation Testing?... 3 What is the process
An Introduction to the Domain Name System
An Introduction to the Domain Name System Olaf Kolkman [email protected] October 28, 2005 Stichting NLnet Labs This Presentation An introduction to the DNS Laymen level For non-technologists About protocol
DNS and BIND. David White
DNS and BIND David White DNS: Backbone of the Internet Translates Domains into unique IP Addresses i.e. developcents.com = 66.228.59.103 Distributed Database of Host Information Works seamlessly behind
Presented by Greg Lindsay Technical Writer Windows Server Information Experience. Presented at: Seattle Windows Networking User Group April 7, 2010
Presented by Greg Lindsay Technical Writer Windows Server Information Experience Presented at: Seattle Windows Networking User Group April 7, 2010 Windows 7 DNS client DNS devolution Security-awareness:
Introduction to the Domain Name System
CHAPTER 14 The Domain Name System (DNS) handles the growing number of Internet users. DNS translates names, such as www.cisco.com, into IP addresses, such as 192.168.40.0 (or the more extended IPv6 addresses),
NET0183 Networks and Communications
NET0183 Networks and Communications Lecture 25 DNS Domain Name System 8/25/2009 1 NET0183 Networks and Communications by Dr Andy Brooks DNS is a distributed database implemented in a hierarchy of many
APNIC IPv6 Deployment
APNIC IPv6 Deployment Ulaanbaatar, Mongolia 19 October 2015 Issue Date: Revision: Overview Deployment motivation Network deployment IPv6 Services deployment IPv6 Anycast service IPv6 Cloud service Summary
A versatile platform for DNS metrics with its application to IPv6
A versatile platform for DNS metrics with its application to IPv6 Stéphane Bortzmeyer AFNIC [email protected] RIPE 57 - Dubai - October 2008 1 A versatile platform for DNS metrics with its application
The Canadian Internet Registration Authority (CIRA) manages a 100% up time service - the.ca domain name registry for over 2.
WHO IS.CA ( CIRA )? The organization responsible for a critical part of the Internet infrastructure; expanding its services to help organizations secure their DNS in Canada The Canadian Internet Registration
Basic DNS Course. Module 1. DNS Theory. Ron Aitchison ZYTRAX, Inc. Page 1 of 24
Basic DNS Course Module 1 Ron Aitchison ZYTRAX, Inc. Page 1 of 24 The following are the slides used in this Module of the course. Some but not all slides have additional notes that you may find useful.
DNS & IPv6. Agenda 4/14/2009. MENOG4, 8-9 April 2009. Raed Al-Fayez SaudiNIC CITC [email protected], www.nic.net.sa. DNS & IPv6.
DNS & IPv6 MENOG4, 8-9 April 2009 Raed Al-Fayez SaudiNIC CITC [email protected], www.nic.net.sa Agenda DNS & IPv6 Introduction What s next? SaudiNIC & IPv6 About SaudiNIC How a cctld Registry supports
Best Practices in DNS Anycast Service-Provision Architecture. Version 1.1 March 2006 Bill Woodcock Gaurab Raj Upadhaya Packet Clearing House
Best Practices in DNS Service-Provision Architecture Version 1.1 March 2006 Bill Woodcock Gaurab Raj Upadhaya Packet Clearing House It s all Large ISPs have been running production anycast DNS for more
The Internet Ecosystem and ICANN!! Steve Sheng @ Stanford University, Center for Information and Society! 29 April 2013!
The Internet Ecosystem and ICANN!! Steve Sheng @ Stanford University, Center for Information and Society! 29 April 2013! Ecosystem! + A network of interactions among organisms, and between organisms and
5 DNS Security Risks That Keep You Up At Night (And How To Get Back To Sleep)
5 DNS Security Risks That Keep You Up At Night (And How To Get Back To Sleep) survey says: There are things that go bump in the night, and things that go bump against your DNS security. You probably know
USING TRANSACTION SIGNATURES (TSIG) FOR SECURE DNS SERVER COMMUNICATION
USING TRANSACTION SIGNATURES (TSIG) FOR SECURE DNS SERVER COMMUNICATION Transaction Signatures (TSIG) provide a secure method for communicating in the Domain Name System (DNS) from a primary to a secondary
ANATOMY OF A DDoS ATTACK AGAINST THE DNS INFRASTRUCTURE
ANATOMY OF A DDoS ATTACK AGAINST THE DNS INFRASTRUCTURE ANATOMY OF A DDOS ATTACK AGAINST THE DNS INFRASTRUCTURE The Domain Name System (DNS) is part of the functional infrastructure of the Internet and
Public-Root Name Server Operational Requirements
Public-Root Name Server Operational Requirements Published January the 17 th, 2005 Status of this Document This document provides information to the Public-Root and Internet technical community. This document
Introduction to The Internet. ISP/IXP Workshops
Introduction to The Internet ISP/IXP Workshops 1 Introduction to the Internet Topologies and Definitions IP Addressing Internet Hierarchy Gluing it all together 2 Topologies and Definitions What does all
Where is Hong Kong in the secure Internet infrastructure development. Warren Kwok, CISSP Internet Society Hong Kong 12 August 2011
The Internet is for Everyone. Become an ISOC Member. Cyber Security Symposium 2011 Where is Hong Kong in the secure Internet infrastructure development Warren Kwok, CISSP Internet Society Hong Kong 12
The IANA Functions. An Introduction to the Internet Assigned Numbers Authority (IANA) Functions
The IANA Functions An Introduction to the Internet Assigned Numbers Authority (IANA) Functions Contents SECTION 1: INTRODUCTION 4 SECTION 2: POLICY, STAKEHOLDERS AND STEWARDSHIP IMPLEMENTATION 6 SECTION
State of the Cloud DNS Report
transparency for the cloud State of the Cloud DNS Report Basic Edition April 2015 2015 Table of Contents Overview Introduction 3 Anycast vs. Unicast DNS 3 Provider Overview & Current News 4 Provider Marketshare
A Plan for the Continued Development of the DNS Statistics Collector
A Plan for the Continued Development of the DNS Statistics Collector Background The DNS Statistics Collector ( DSC ) software was initially developed under the National Science Foundation grant "Improving
State of the Cloud DNS Report
transparency for the cloud State of the Cloud DNS Report Basic Edition August 2015 2015 Table of Contents Overview Introduction 3 Anycast vs. Unicast DNS 3 Provider Overview & Current News 4 Provider Marketshare
OVERVIEW OF THE DNS AND GLOSSARY OF TERMS
PROTECT YOUR BUSINESS D-Zone Anycast DNS Service OVERVIEW OF THE DNS AND GLOSSARY OF TERMS 1 PROTECT YOUR BUSINESS OVERVIEW OF THE DNS AND GLOSSARY OF TERMS The DNS is a technology that most IT managers
Security in the Network Infrastructure - DNS, DDoS,, etc.
Security in the Network Infrastructure - DNS, DDoS,, etc. GTER, São Paulo December 8, 2006 Steve Crocker, [email protected] Russ Mundy, [email protected] Proactive Security Build security into the infrastructure
DNS Security Survey for National Computer Security Incident Response Teams December 2010
DNS Security Survey for National Computer Security Incident Response Teams December 2010 Summary As referenced during the ICANN meeting in Brussels, Belgium in June 2010, ICANN developed a survey on DNS
High-Performance DNS Services in BIG-IP Version 11
F5 White Paper High-Performance DNS Services in BIG-IP Version 11 To provide high-quality user experiences on the Internet, networks must be designed with optimized, secure, highly available, and high-performance
Conexim DNS Administrator s Guide
Conexim DNS Administrator s Guide Last Updated August 2013 Contents Conexim DNS Quick Reference... 1 DNS Delegation Information... 1 Control Panel Access... 1 Supported Record Types... 1 Getting Support...
Introduction to The Internet
Introduction to The Internet ISP Workshops Last updated 5 September 2014 1 Introduction to the Internet p Topologies and Definitions p IP Addressing p Internet Hierarchy p Gluing it all together 2 Topologies
DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008
DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers Agenda How do you
The secret life of a DNS query. Igor Sviridov <[email protected]> 20120522
The secret life of a DNS query Igor Sviridov 20120522 Preface Nowadays, when we type URL (or is it a search string? ;-) into a browser (or mobile device) many things happen. While most of
THE DOMAIN NAME INDUSTRY BRIEF VOLUME 11 ISSUE 1 APRIL 2014
THE DOMAIN NAME INDUSTRY BRIEF VOLUME 11 ISSUE 1 APRIL 2014 THE VERISIGN DOMAIN REPORT AS THE GLOBAL LEADER IN DOMAIN NAMES, VERISIGN REVIEWS THE STATE OF THE DOMAIN NAME INDUSTRY THROUGH A VARIETY OF
The Future of DNS. Johan Ihrén Netnod. October 15, 2015. http://www.netnod.se/
The Future of DNS Johan Ihrén Netnod October 15, 2015 Netnod Customer Mtg, Oct 2015, October 15, 2015, DNS and Complexity, [email protected] 1 / 16 The Future of DNS I have no idea about the future of DNS.
PLAN FOR ENHANCING INTERNET SECURITY, STABILITY, AND RESILIENCY
PLAN FOR ENHANCING INTERNET SECURITY, STABILITY, AND RESILIENCY June 2009 Table of Contents Executive Summary... 1 ICANN s Role... 2 ICANN Security, Stability and Resiliency Programs... 3 Plans to Enhance
Topic 1: Internet Architecture & Addressing
Topic 1: Internet Architecture & Addressing Objectives Understand the general architecture of Internet Identify the main actors in the Internet architecture Identify the main organizations implied in Internet
Monitoring the DNS. Gustavo Lozano Event Name XX XXXX 2015
Monitoring the DNS Gustavo Lozano Event Name XX XXXX 2015 Agenda 1 2 3 Components of the DNS Monitoring gtlds Monitoring other components of the DNS 4 5 Monitoring system Conclusion 2 Components of the
DNSSEC in your workflow
DNSSEC in your workflow Presentation roadmap Overview of problem space Architectural changes to allow for DNSSEC deployment Deployment tasks Key maintenance DNS server infrastructure Providing secure delegations
Agenda. Network Services. Domain Names. Domain Name. Domain Names Domain Name System Internationalized Domain Names. Domain Names & DNS
Agenda Network Services Domain Names & DNS Domain Names Domain Name System Internationalized Domain Names Johann Oberleitner SS 2006 Domain Names Naming of Resources Problems of Internet's IP focus IP
DNS Queries And IPv6 Root Servers
1 Is Your Caching Resolver Polluting the Internet? Duane Wessels CAIDA & The Measurement Factory, Inc. [email protected] Abstract Previous research has shown that most of the DNS queries
F-Root's DNSSEC Signing Plans. Keith Mitchell Internet Systems Consortium DNS-OARC NANOG48, Austin, 24 th Feb 2010
F-Root's DNSSEC Signing Plans Keith Mitchell Internet Systems Consortium DNS-OARC NANOG48, Austin, 24 th Feb 2010 What is ISC? Internet Systems Consortium, Inc. Headquartered in Redwood City, California
The Impact of DNSSEC. Matthäus Wander. on the Internet Landscape. <[email protected]> Duisburg, June 19, 2015
The Impact of DNSSEC on the Internet Landscape Matthäus Wander Duisburg, June 19, 2015 Outline Domain Name System Security problems Attacks in practice DNS Security Extensions
Securing DNS Infrastructure Using DNSSEC
Securing DNS Infrastructure Using DNSSEC Ram Mohan Executive Vice President, Afilias [email protected] February 28, 2009 Agenda Getting Started Finding out what DNS does for you What Can Go Wrong A Survival
DNSSEC Deployment a case study
DNSSEC Deployment a case study Olaf M. Kolkman [email protected] RIPE NCCs Project Team: Katie Petrusha, Brett Carr, Cagri Coltekin, Adrian Bedford, Arno Meulenkamp, and Henk Uijterwaal Januari 17, 2006
On the Use of Anycast in DNS
On the Use of Anycast in DNS Sandeep Sarat [email protected] Johns Hopkins University Vasileios Pappas [email protected] UCLA Andreas Terzis [email protected] Johns Hopkins University Abstract In this
DNS Domain Name System
Domain Name System DNS Domain Name System The domain name system is usually used to translate a host name into an IP address Domain names comprise a hierarchy so that names are unique, yet easy to remember.
Final. Dr. Paul Twomey President and Chief Executive Officer Internet Corporation for Assigned Names and Numbers (ICANN)
Final Dr. Paul Twomey President and Chief Executive Officer Internet Corporation for Assigned Names and Numbers (ICANN) Opening Speech to the Second International Forum Partnership Among State, Business
How To Understand The Power Of A Content Delivery Network (Cdn)
Overview 5-44 5-44 Computer Networking 5-64 Lecture 8: Delivering Content Content Delivery Networks Peter Steenkiste Fall 04 www.cs.cmu.edu/~prs/5-44-f4 Web Consistent hashing Peer-to-peer CDN Motivation
DNS Session 4: Delegation and reverse DNS. Joe Abley AfNOG 2006 workshop
DNS Session 4: Delegation and reverse DNS Joe Abley AfNOG 2006 workshop How do you delegate a subdomain? In principle straightforward: just insert NS records for the subdomain, pointing at someone else's
ICANN: achievements and challenges of a multi-stakeholder, bottom up, transparent model
ICANN: achievements and challenges of a multi-stakeholder, bottom up, transparent model Anne Rachel Inné, Giovanni Seppia Regional Liaisons Aurelio Peccei Lecture 4 April 2007 1 Presentation overview The
JPNIC Public Forum. Paul Vixie. Chairman, Internet Software Consortium. January 21, 2003
JPNIC Public Forum Paul Vixie Chairman, Internet Software Consortium January 21, 2003 1 Paul Vixie has been contributing to Internet protocols and UNIX systems as a protocol designer and software architect
Designing and Implementing a Server Infrastructure
Page 1 of 7 Overview This 5-day instructor-led course provides you with the skills and knowledge needed to plan, design, and deploy a physical and logical Windows Server 2012 Active Directory Domain Services
Distributed Systems. 09. Naming. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 09. Naming Paul Krzyzanowski Rutgers University Fall 2015 October 7, 2015 2014-2015 Paul Krzyzanowski 1 Naming things Naming: map names to objects Helps with using, sharing, and communicating
TECHNICAL REPORT Network Technologies (NTECH); Description of the DNS protocol usage in IP based operators networks
TR 184 012 V1.1.1 (2015-05) TECHNICAL REPORT Network Technologies (NTECH); Description of the DNS protocol usage in IP based operators networks 2 TR 184 012 V1.1.1 (2015-05) Reference DTR/NTECH-00003-NNAR-DNS
Strengthening our Ecosystem through Stakeholder Collaboration. Jia-Rong Low, Sr Director, Asia 20 August 2015
Strengthening our Ecosystem through Stakeholder Collaboration Jia-Rong Low, Sr Director, Asia 20 August 2015 Agenda 1 2 3 About ICANN and the Domain Name System (DNS) DNS attacks and their impact DNS Security
Internet-Praktikum I Lab 3: DNS
Kommunikationsnetze Internet-Praktikum I Lab 3: DNS Mark Schmidt, Andreas Stockmayer Sommersemester 2015 kn.inf.uni-tuebingen.de Motivation for the DNS Problem IP addresses hard to remember for humans
ISP Systems Design. ISP Workshops. Last updated 24 April 2013
ISP Systems Design ISP Workshops Last updated 24 April 2013 1 Agenda p DNS Server placement p Mail Server placement p News Server placement p Services network design p Services Network Security 2 ISP Services
Designing and Implementing a Server Infrastructure MOC 20413
Designing and Implementing a Server Infrastructure MOC 20413 Course Outline Module 1: Planning a Server Upgrade and Migration This module explains how to plan a server upgrade and migration strategy. Upgrade
The Domain Name System: An Integral Part of the Internet. By Keiko Ishioka
The Domain Name System: An Integral Part of the Internet By Keiko Ishioka The Domain Name System (otherwise known as the Domain Name Server system) (DNS) is a distributed database that is accessed by anyone