Monitoring the DNS. Gustavo Lozano Event Name XX XXXX 2015



Similar documents
Strengthening our Ecosystem through Stakeholder Collaboration. Jia-Rong Low, Sr Director, Asia 20 August 2015

Computer Networks: Domain Name System

DNS and BIND. David White

THE MASTER LIST OF DNS TERMINOLOGY. v 2.0

DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008

Chapter 25 Domain Name System Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

THE MASTER LIST OF DNS TERMINOLOGY. First Edition

Pre Delegation Testing (PDT) Frequently Asked Questions (FAQ)

Domain Name System :49:44 UTC Citrix Systems, Inc. All rights reserved. Terms of Use Trademarks Privacy Statement

Guidance for Preparing Domain Name Orders, Seizures & Takedowns

Lecture 2 CS An example of a middleware service: DNS Domain Name System

Application and service delivery with the Elfiq idns module

How To Manage Dns On An Elfiq Link Load Balancer (Link Balancer) On A Pcode (Networking) On Ipad Or Ipad (Netware) On Your Ipad On A Ipad At A Pc Or Ipa

EMERGENCY BACK- END REGISTRY OPERATOR AGREEMENT ARTICLE 1. DESIGNATION AS EBERO; REPRESENTATIONS AND WARRANTIES

Part 5 DNS Security. SAST01 An Introduction to Information Security Martin Hell Department of Electrical and Information Technology

FAQ (Frequently Asked Questions)

Specifications for Registrars' Interaction with Flexireg Domain Registration System

DNSSEC - Why Network Operators Should Care And How To Accelerate Deployment

NANOG DNS BoF. DNS DNSSEC IPv6 Tuesday, February 1, 2011 NATIONAL ENGINEERING & TECHNICAL OPERATIONS

Use Domain Name System and IP Version 6

The Environment Surrounding DNS. 3.1 The Latest DNS Trends. 3. Technology Trends

DNS Basics. DNS Basics

DOMAIN NAME DAY. + Helsinki; 14 th February; Nigel Hickson, ICANN

SAC 049 SSAC Report on DNS Zone Risk Assessment and Management

Configuring DNS. Finding Feature Information

Network Layers. CSC358 - Introduction to Computer Networks

OVERVIEW OF THE DNS AND GLOSSARY OF TERMS

The Impact of DNSSEC. Matthäus Wander. on the Internet Landscape. Duisburg, June 19, 2015

USING TRANSACTION SIGNATURES (TSIG) FOR SECURE DNS SERVER COMMUNICATION

Overview of DNSSEC deployment worldwide

Securing DNS Infrastructure Using DNSSEC

Glossary of Technical Terms Related to IPv6

DNS Security Survey for National Computer Security Incident Response Teams December 2010

Distributed Systems. 09. Naming. Paul Krzyzanowski. Rutgers University. Fall 2015

THE DOMAIN NAME SYSTEM DNS

How to set up the Integrated DNS Server for Inbound Load Balancing

NET0183 Networks and Communications

Introduction to the Domain Name System

DNS Conformance Test Specification For Client

Domain Name System (DNS) RFC 1034 RFC

Deploying DNSSEC: From End-Customer To Content

DNS Root NameServers

DNS & IPv6. Agenda 4/14/2009. MENOG4, 8-9 April Raed Al-Fayez SaudiNIC CITC rfayez@citc.gov.sa, DNS & IPv6.

Specifications for Registrars' Interaction with the Domain Registration System During Landrush and General Registration Periods

IPV6 SERVICES DEPLOYMENT

DNSSEC. Introduction. Domain Name System Security Extensions. AFNIC s Issue Papers. 1 - Organisation and operation of the DNS

Application. Transport. Network. Data Link. Physical. Network Layers. Goal

Domain Name System. DNS is an example of a large scale client-server application. Copyright 2014 Jim Martin

DNS traffic analysis -- Issues of IPv6 and CDN --

3. The Domain Name Service

Basic DNS Course. Module 1. DNS Theory. Ron Aitchison ZYTRAX, Inc. Page 1 of 24

Best Practices in Domain Name Registry Solutions Understanding the Technical Requirements of ICANN's Applicant Guidebook

The Domain Name System from a security point of view

IANA Functions to cctlds Sofia, Bulgaria September 2008

Secure Domain Name System (DNS) Deployment Guide

Global Service Loadbalancing & DNSSEC. Ralf Brünig Field Systems Engineer r.bruenig@f5.com DNSSEC

Decoding DNS data. Using DNS traffic analysis to identify cyber security threats, server misconfigurations and software bugs

Measures to Protect (University) Domain Registrations and DNS Against Attacks. Dave Piscitello, ICANN

New gtld Basics New Internet Extensions

CS 43: Computer Networks Naming and DNS. Kevin Webb Swarthmore College September 17, 2015

Secure Domain Name System (DNS) Deployment Guide

DOMAIN NAME SECURITY EXTENSIONS

- Domain Name System -

SDNP.mw cctld DOMAIN REGISTRATION POLICY Ver 1.2 of 23 July 2015

Internet-Praktikum I Lab 3: DNS

Module 5: Planning a DNS Strategy

DNSSEC for Everybody: A Beginner s Guide

Detecting Search Lists in Authoritative DNS

How to Install the Active Directory Domain Services (AD DS) Role in Windows Server 2008 R2 and Promote a Server to a Domain Controller

DNS. The Root Name Servers. DNS Hierarchy. Computer System Security and Management SMD139. Root name server. .se name server. .

Recommendations for dealing with fragmentation in DNS(SEC)

Enterprise Architecture Office Resource Document Design Note - Domain Name System (DNS)

Text. Registry Onboarding and TLD Startup

Citrix NetScaler Global Server Load Balancing Primer:

Domain Name System (DNS)

Teldat Router. DNS Client

EECS 489 Winter 2010 Midterm Exam

The Internet Ecosystem and ICANN!! Steve Stanford University, Center for Information and Society! 29 April 2013!

Introduction to Network Operating Systems

Transcription:

Monitoring the DNS Gustavo Lozano Event Name XX XXXX 2015

Agenda 1 2 3 Components of the DNS Monitoring gtlds Monitoring other components of the DNS 4 5 Monitoring system Conclusion 2

Components of the DNS

The DNS The DNS is made of several components that must work well, in order to have a system that performs optimally as a whole. The main components of the DNS are: The root zone Top Level Domains (TLDs) Second Level Domains (SLDs) Recursive DNS service Registries, registrars and DNS operators are also part of the equation, because they are the source for the majority of the information in the DNS. Most end-users don t know about the DNS, but if the DNS is underperforming, the Internet is not working for them. 4

The DNS 5

Monitoring of gtlds

Monitoring of gtlds The new gtld program redefined ICANN s responsibilities regarding monitoring the performance of the DNS, DNSSEC, WHOIS and EPP services (critical services). The new gtld program also redefined the Service Level Requirements for Registries regarding these critical functions. The specific details about the Service Level Agreement and ICANN s responsibilities regarding monitoring could be found in Specification 10 of the new gtld base registry agreement: https://www.icann.org/resources/pages/registries/registries-agreements-en 7

How does ICANN monitor gtlds? Data Processor Probe Node Probe Node Probe Node Ry 8

Anatomy of the DNS service (authoritative) An authoritative server provides authoritative information about a DNS zone. example.com: ns1.example.com 192.0.2.1 2001:0DB8:1::1 ns2.example.com 198.51.100.1 203.0.113.1 2001:0DB8:2::1 ns3.example.com 192.0.2.2 9

Service Level Agreement DNS SLA: Parameter SLR (monthly basis) DNS service availability 0 min downtime (100% availability) DNS name server availability 432 min of downtime (» 99%) TCP DNS resolution RTT 1500 ms, for at least 95% of the queries UDP DNS resolution RTT 500 ms, for at least 95% of the queries DNS update time 60 min, for at least 95% of the probes 10

DNS Monitoring The probe node network consists of approximately 45 probe nodes around the world. If 51% or more of the DNS testing probes see the service as unavailable during a given time, the DNS service will be considered unavailable. SPEC10: Probes for measuring DNS parameters shall be placed as near as possible to the DNS resolvers on the networks with the most users. 11

DNS service availability DNS service availability: SPEC10: For the service to be considered available at a particular moment, at least, two of the delegated name servers registered in the DNS must have successful results from DNS tests to each of their public-dns registered IP addresses to which the name server resolves. Parameter SLR (monthly basis) DNS service availability 0 min downtime (100% availability) DNS name server availability 432 min of downtime (» 99%) TCP DNS resolution RTT 1500 ms, for at least 95% of the queries UDP DNS resolution RTT 500 ms, for at least 95% of the queries DNS update time 60 min, for at least 95% of the probes example.com: ns1.example.com ns2.example.com 192.0.2.1 2001:0DB8:1::1 198.51.100.1 203.0.113.1 2001:0DB8:2::1 ns3.example.com 192.0.2.2 51% 12

DNS name server availability DNS NS availability: SPEC10: Refers to the ability of a public-dns registered IP address of a particular name server listed as authoritative for a domain name, to answer DNS queries from an Internet user. Parameter SLR (monthly basis) DNS service availability 0 min downtime (100% availability) DNS name server availability 432 min of downtime (» 99%) TCP DNS resolution RTT 1500 ms, for at least 95% of the queries UDP DNS resolution RTT 500 ms, for at least 95% of the queries DNS update time 60 min, for at least 95% of the probes example.com: ns1.example.com ns2.example.com 192.0.2.1 2001:0DB8:1::1 198.51.100.1 203.0.113.1 2001:0DB8:2::1 ns3.example.com 192.0.2.2 51% 13

UDP/TCP DNS resolution RTT TCP DNS resolution RTT SPEC10: Refers to the RTT (Round-Trip Time) of the sequence of packets from the start of the TCP connection to its end, including the reception of the DNS response for only one DNS query. If the RTT is 5 times greater than the time specified in the relevant SLR, the RTT will be considered undefined. Parameter SLR (monthly basis) DNS service availability 0 min downtime (100% availability) DNS name server availability 432 min of downtime (» 99%) TCP DNS resolution RTT 1500 ms, for at least 95% of the queries UDP DNS resolution RTT 500 ms, for at least 95% of the queries DNS update time 60 min, for at least 95% of the probes example.com: ns1.example.com ns2.example.com 192.0.2.1 2001:0DB8:1::1 198.51.100.1 203.0.113.1 2001:0DB8:2::1 ns3.example.com 192.0.2.2 14

UDP/TCP DNS resolution RTT UDP DNS resolution RTT SPEC10: Refers to the RTT (Round-Trip Time) of the sequence of two packets, the UDP DNS query and the corresponding UDP DNS response. If the RTT is 5 times greater than the time specified in the relevant SLR, the RTT will be considered undefined. Parameter SLR (monthly basis) DNS service availability 0 min downtime (100% availability) DNS name server availability 432 min of downtime (» 99%) TCP DNS resolution RTT 1500 ms, for at least 95% of the queries UDP DNS resolution RTT 500 ms, for at least 95% of the queries DNS update time 60 min, for at least 95% of the probes example.com: ns1.example.com ns2.example.com 192.0.2.1 2001:0DB8:1::1 198.51.100.1 203.0.113.1 2001:0DB8:2::1 ns3.example.com 192.0.2.2 15

DNS test DNS test: SPEC10: Means one nonrecursive DNS query sent to a particular IP address (via UDP or TCP). A query with a DNS resolution RTT 5 times higher than the corresponding SLR, will be considered unanswered. example.com: ns1.example.com ns2.example.com 192.0.2.1 2001:0DB8:1::1 198.51.100.1 203.0.113.1 2001:0DB8:2::1 ns3.example.com 192.0.2.2 16

DNSSEC DNSSEC: SPEC10: For a query to be considered answered, the signatures must be positively verified against a corresponding DS record published in the parent zone. example.com: ns1.example.com ns2.example.com 192.0.2.1 2001:0DB8:1::1 198.51.100.1 203.0.113.1 2001:0DB8:2::1 ns3.example.com 192.0.2.2 17

DNS update time DNS update time: SPEC10: Refers to the time measured from the reception of an EPP confirmation to a transform command on a domain name, until the name servers of the parent domain name answer DNS queries with data consistent with the change made. Parameter SLR (monthly basis) DNS service availability 0 min downtime (100% availability) DNS name server availability 432 min of downtime (» 99%) TCP DNS resolution RTT 1500 ms, for at least 95% of the queries UDP DNS resolution RTT 500 ms, for at least 95% of the queries DNS update time 60 min, for at least 95% of the probes example.com: ns1.example.com ns2.example.com 192.0.2.1 2001:0DB8:1::1 198.51.100.1 203.0.113.1 2001:0DB8:2::1 ns3.example.com 192.0.2.2 18

EBERO EBERO: If the DNS service of a TLD fails for more than 4 hours on a rolling week basis, ICANN may appoint an Emergency Back-end Registry Operator (EBERO) to maintain the correct operation of the TLD. 19

Monitoring other components of the DNS

Monitoring other components of the DNS 21

Monitoring other components of the DNS ISPs and DNS Operators should monitor the authoritative servers for their SLDs. SLD.TLD: ns1.example.com 192.0.2.1 2001:0DB8:1::1 ISPs and DNS Operators may use the same methodology used by ICANN to monitor new gtlds. ns2.example.com 198.51.100.1 203.0.113.1 2001:0DB8:2::1 ns3.example.com 192.0.2.2 51% 22

Monitoring recursive DNS servers The recursive DNS service plays an important role in the perception of a healthy Internet service for end-users. ISPs and DNS Operators may monitor the recursive DNS service using the same methodology that ICANN uses for gtlds with some differences: 1. The probe nodes should be placed close to the endusers of the recursive name servers. 23

Monitoring recursive DNS servers 2. A domain name hosted on authoritative servers outside of the internal network may be used to monitor the recursive DNS servers. Preferably, the domain name used to monitor should be registered by the ISP or DNS Operator. 3. The cache of the recursive DNS server should be considered when monitoring a recursive DNS server. For example, the domain name used to monitor could be configured with a low TTL in order to force the recursive DNS server to execute the resolution process for the domain name. 24

Monitoring recursive DNS servers 4. If DNSSEC is supported by the recursive DNS server, the domain name used to monitor should be signed with DNSSEC. 5. Negative testing in the case of DNSSEC should be performed. A domain name with failing DNSSEC signatures should be used for negative testing. 25

Monitoring system

Monitoring system The monitoring system used by ICANN is operated in-house. The monitoring system is actively developed by Zabbix SIA, and it is based on the Zabbix monitoring platform. All code is open source, and published under the same license as the Zabbix monitoring platform. 27

Alerting The monitoring system sends email alerts to the registry operators. The monitoring system escalates the alerts via voice (phone call) to the registry operators. In addition to the threshold of 51% probe nodes detecting a problem, the monitoring system creates an incident after 3 consecutive failing test cycles (test cycle is calculated every minute). 28

Conclusion

Conclusion The health of the DNS system requires that several components operated by different actors are performing optimally. ICANN monitors and proactively works with the gtld operators when DNS issues are detected. ISPs and DNS Operators may use the same methodology to monitor the other components of the DNS (i.e. recursive servers and authoritative severs for SLDs). 30

Thank You and Questions Thank You and Questions Reach us at: Email: gustavo.lozano@icann.org Website: icann.org twitter.com/icann gplus.to/icann facebook.com/icannorg weibo.com/icannorg linkedin.com/company/icann flickr.com/photos/icann youtube.com/user/icannnews slideshare.net/icannpresentations 31