on measuring the client
play

On Measuring the Client- Side DNS Infrastructure Kyle Schomp , Tom - PowerPoint PPT Presentation

Jul 28, 2023 •412 likes •1.07k views

On Measuring the Client- Side DNS Infrastructure Kyle Schomp , Tom Callahan, Michael Rabinovich , Mark Allman Case Western Reserve University International Computer Science Institute 10/23/2013 ACM IMC 2013 1 Motivation

  1. On Measuring the Client- Side DNS Infrastructure Kyle Schomp †, Tom Callahan†, Michael Rabinovich †, Mark Allman†‡ †Case Western Reserve University ‡International Computer Science Institute 10/23/2013 ACM IMC 2013 1

  2. Motivation • DNS provides the mapping between human friendly names and machine friendly addresses • amazon.com -> 1.2.3.4 • DNS resolution path is both complex and hidden • Multiple layers of resolvers • Controlled by different organizations • No clear attribution if something goes wrong 10/23/2013 ACM IMC 2013 2

  3. Our Contribution • Methodologies for discovering the client-side DNS infrastructure • Measurement techniques for teasing apart behavior of various actors • Application of our methodologies and techniques to assess behavior • How long are records retained in caches • How time-to-live (TTL) values a modified by resolvers We have also used our methodologies to study security properties of DNS. This is a separate work that is not discussed today. 10/23/2013 ACM IMC 2013 3

  4. Discovery Methodology • We randomly sample IP addresses from the Internet • To each sampled IP address, we send DNS requests looking for open resolvers • We also deploy an authoritative DNS server • Our DNS request probes target our own domain • We can collect both the ingress and egress servers of the client-side DNS infrastructure 10/23/2013 ACM IMC 2013 4

  5. The Client-Side DNS Infrastructure • Origins are either end user devices or our measurement points • 95% of ODNS are FDNS • 78% of ODNS are likely residential Structure of the client-side DNS infrastructure network devices observed in our datasets. 10/23/2013 ACM IMC 2013 5

  6. The Client-Side DNS Infrastructure • Origins are either end user devices or our measurement points • 95% of ODNS are FDNS • 78% of ODNS are likely residential Structure of the client-side DNS infrastructure network devices observed in our datasets. 10/23/2013 ACM IMC 2013 5

  7. The Client-Side DNS Infrastructure • Origins are either end user devices or our measurement points • 95% of ODNS are FDNS • 78% of ODNS are likely residential Structure of the client-side DNS infrastructure network devices observed in our datasets. 10/23/2013 ACM IMC 2013 5

  8. The Client-Side DNS Infrastructure • Origins are either end user devices or our measurement points • 95% of ODNS are FDNS • 78% of ODNS are likely residential Structure of the client-side DNS infrastructure network devices observed in our datasets. 10/23/2013 ACM IMC 2013 5

  9. The Client-Side DNS Infrastructure • Origins are either end user devices or our measurement points • 95% of ODNS are FDNS • 78% of ODNS are likely residential Structure of the client-side DNS infrastructure network devices observed in our datasets. 10/23/2013 ACM IMC 2013 5

  10. RDNS Discovery • 2/3 of RDNS in our datasets are closed • Do not respond to direct probes • Must be discovered through FDNS • Two techniques for RDNS discovery • Multiple DNS requests to each FDNS • CNAME “chains” from our ADNS 10/23/2013 ACM IMC 2013 6

  11. RDNS Discovery (cont.) • Multiple DNS requests to each FDNS RDNS 1 Origin FDNS RDNS 2 RDNS 3 10/23/2013 ACM IMC 2013 7

  12. RDNS Discovery (cont.) • Multiple DNS requests to each FDNS RDNS 1 ex1.dnsresearch.us ? Origin FDNS RDNS 2 RDNS 3 10/23/2013 ACM IMC 2013 7

  13. RDNS Discovery (cont.) • Multiple DNS requests to each FDNS RDNS 1 ex1.dnsresearch.us ? ex2.dnsresearch.us ? ex2.dnsresearch.us ? Origin FDNS RDNS 2 RDNS 3 10/23/2013 ACM IMC 2013 7

  14. RDNS Discovery (cont.) • Multiple DNS requests to each FDNS RDNS 1 ex1.dnsresearch.us ? ex2.dnsresearch.us ? ex2.dnsresearch.us ? Origin FDNS RDNS 2 ex3.dnsresearch.us ? RDNS 3 10/23/2013 ACM IMC 2013 7

  15. RDNS Discovery (cont.) • CNAME chains from our ADNS ADNS RDNS 1 RDNS 2 RDNS 3 10/23/2013 ACM IMC 2013 8

  16. RDNS Discovery (cont.) • CNAME chains from our ADNS ADNS RDNS 1 RDNS 2 RDNS 3 10/23/2013 ACM IMC 2013 8

  17. RDNS Discovery (cont.) • CNAME chains from our ADNS ADNS RDNS 1 RDNS 2 RDNS 3 10/23/2013 ACM IMC 2013 8

  18. RDNS Discovery (cont.) • CNAME chains from our ADNS ADNS RDNS 1 RDNS 2 RDNS 3 10/23/2013 ACM IMC 2013 8

  19. RDNS Discovery (cont.) • CNAME chains from our ADNS ADNS RDNS 1 RDNS 2 RDNS 3 10/23/2013 ACM IMC 2013 8

  20. RDNS Discovery (cont.) • CNAME chains from our ADNS ADNS RDNS 1 RDNS 2 RDNS 3 10/23/2013 ACM IMC 2013 8

  21. Measurement Principles • Non-Interference with Normal Operation • Probe for our own domain only • Limit probing rate • ODNS Short Lifetime • Experiment during discovery • Random bindings • Two requests for the same domain will receive different bindings with high probability 10/23/2013 ACM IMC 2013 9

  22. Measuring FDNS (Cache Injection) • Records filter through upstream resolvers before arriving at FDNS 1. ex.dnsresearch.us ? Origin FDNS RDNS 10/23/2013 ACM IMC 2013 10

  23. Measuring FDNS (Cache Injection) • Records filter through upstream resolvers before arriving at FDNS 1. ex.dnsresearch.us ? 2. ex.dnsresearch.us ? Origin FDNS RDNS 10/23/2013 ACM IMC 2013 10

  24. Measuring FDNS (Cache Injection) • Records filter through upstream resolvers before arriving at FDNS 1. ex.dnsresearch.us ? 2. ex.dnsresearch.us ? 3. ex.dnsresearch.us = Y Origin FDNS RDNS Y 10/23/2013 ACM IMC 2013 10

  25. Measuring FDNS (Cache Injection) • Records filter through upstream resolvers before arriving at FDNS 1. ex.dnsresearch.us ? 2. ex.dnsresearch.us ? 3. ex.dnsresearch.us = Y 4. ex.dnsresearch.us = Y Origin FDNS RDNS Y Y 10/23/2013 ACM IMC 2013 10

  26. Measuring FDNS (Cache Injection) • Records filter through upstream resolvers before arriving at FDNS 1. ex.dnsresearch.us ? 2. ex.dnsresearch.us ? 2. ex.dnsresearch.us = X Origin FDNS RDNS 10/23/2013 ACM IMC 2013 10

  27. Measuring FDNS (Cache Injection) • Records filter through upstream resolvers before arriving at FDNS 1. ex.dnsresearch.us ? 2. ex.dnsresearch.us ? 2. ex.dnsresearch.us = X Origin FDNS RDNS 3. ex.dnsresearch.us = X X 10/23/2013 ACM IMC 2013 10

  28. Measuring FDNS (Cache Injection) • Records filter through upstream resolvers before arriving at FDNS 1. ex.dnsresearch.us ? Origin FDNS RDNS X 10/23/2013 ACM IMC 2013 10

  29. Measuring FDNS (Cache Injection) • Records filter through upstream resolvers before arriving at FDNS 1. ex.dnsresearch.us ? 2. ex.dnsresearch.us = X Origin FDNS RDNS X • 7-9% of FDNS vulnerable to cache injection 10/23/2013 ACM IMC 2013 10

  30. Measuring RDNS • Probing an RDNS can be blocked by FDNS caching 1. ex.dnsresearch.us ? 2. ex.dnsresearch.us ? Origin FDNS RDNS 10/23/2013 ACM IMC 2013 11

  31. Measuring RDNS • Probing an RDNS can be blocked by FDNS caching 1. ex.dnsresearch.us ? 2. ex.dnsresearch.us ? 3. ex.dnsresearch.us = Y 4. ex.dnsresearch.us = Y Origin FDNS RDNS Y Y 10/23/2013 ACM IMC 2013 11

  32. Measuring RDNS • Probing an RDNS can be blocked by FDNS caching 1. ex.dnsresearch.us ? Origin FDNS RDNS Y Y 10/23/2013 ACM IMC 2013 11

  33. Measuring RDNS • Probing an RDNS can be blocked by FDNS caching 1. ex.dnsresearch.us ? 2. ex.dnsresearch.us = Y Origin FDNS RDNS Y Y 10/23/2013 ACM IMC 2013 11

  34. Measuring RDNS (Coordinated Probing) FDNS 1 Origin RDNS FDNS 2 10/23/2013 ACM IMC 2013 12

  35. Measuring RDNS (Coordinated Probing) FDNS 1 Origin RDNS Y FDNS 2 10/23/2013 ACM IMC 2013 12

  36. Measuring RDNS (Coordinated Probing) FDNS 1 Origin RDNS Y FDNS 2 10/23/2013 ACM IMC 2013 12

  37. ODNS Population • There are approximately 32 million ODNS • Estimation from sampling • Agrees with full scans from openresolverproject.org • Previous 2010 study found 15 million ODNS • The number of ODNS has doubled within 3 years 10/23/2013 ACM IMC 2013 13

  38. FDNS / RDNS Relationship RDNS are used by many FDNS FDNS use “pools” of RDNS resolvers 10/23/2013 ACM IMC 2013 14

  39. FDNS / RDNS Relationship (cont.) MaxMinds GeoIP database RTT to RDNS - ICMP ping to FDNS 10/23/2013 ACM IMC 2013 15

  40. Measuring RDNS RTT FDNS s Origin RDNS FDNS 10/23/2013 ACM IMC 2013 16

  41. Measuring RDNS RTT FDNS s Origin RDNS Y FDNS 10/23/2013 ACM IMC 2013 16

  42. Measuring RDNS RTT FDNS s t 1 Origin RDNS Y t 2 FDNS 10/23/2013 ACM IMC 2013 16

  43. Measuring RDNS RTT FDNS s t 1 Origin RDNS Y t 2 FDNS • t 2 – t 1 = RDNS RTT 10/23/2013 ACM IMC 2013 16

  44. Caching Behavior • Caching has an important impact on scalability, performance, security • Example: DNS-based traffic engineering is complicated by caching • A single cached DNS record binds an unknown load to the selected server • DNS offers a time-to-live (TTL) value to limit the duration of records in cache • Many studies have observed that the TTL rule is violated • Violations caused by: • Resolvers maintaining records in their cache beyond TTL • Resolvers modifying the TTL returned to clients 10/23/2013 ACM IMC 2013 17

Recommend

Measuring the Internet Project Introduction Mat Ford / David Belson measuring@isoc.org

Measuring the Internet Project Introduction Mat Ford / David Belson measuring@isoc.org

14 September, 2020 African Internet Summit Measuring the Internet Project Introduction Mat Ford / David Belson measuring@isoc.org Presentation title Client name Measuring the Internet Why? The Internet Societys efforts focus on

336 views • 9 slides
Multi-Threaded Servers December 6, 2007 1 Client-Server Communication Client Client Client

Multi-Threaded Servers December 6, 2007 1 Client-Server Communication Client Client Client

Multi-Threaded Servers December 6, 2007 1 Client-Server Communication Client Client Client Client Client Client Client Client Client Google Client Client Client Client Client Client Many clients; 1 server Server starts and then

333 views • 6 slides
Evolution of the Web 1 Client Server 2 2 / 22 1 Client Server 2 2 / 22 1 Client Server

Evolution of the Web 1 Client Server 2 2 / 22 1 Client Server 2 2 / 22 1 Client Server

E LIOM Tierless Web programming from the ground up Gabriel R ADANNE Jrme V OUILLON Vincent B ALAT Vasilis P APAVASILEIOU Evolution of the Web 1 Client Server 2 2 / 22 1 Client Server 2 2 / 22 1 Client Server DOM 2 2 / 22 1

778 views • 42 slides
SRS Client Future direction of SRS client Current Client Tested on 5 different distros in

SRS Client Future direction of SRS client Current Client Tested on 5 different distros in

SRS Client Future direction of SRS client Current Client Tested on 5 different distros in 32 bit and 64 bit Requires a dedicated test/build box Difficult Crypt::OpenPGP dependencies Poor error reporting Not thread

495 views • 5 slides
Measuring the Quality of Credit Scoring Models Martin ez Dept. of Mathematics and

Measuring the Quality of Credit Scoring Models Martin ez Dept. of Mathematics and

Measuring the Quality of Credit Scoring Models Martin ez Dept. of Mathematics and Statistics, Faculty of Science, Masaryk University CSCC XI, Edinburgh August 2009 Content 1. Introduction 3 2. Good/bad client definition 4 3.

475 views • 30 slides
Measuring the Financial Health of Suppliers and Ongoing Monitoring Presentation for CIPS,

Measuring the Financial Health of Suppliers and Ongoing Monitoring Presentation for CIPS,

Measuring the Financial Health of Suppliers and Ongoing Monitoring Presentation for CIPS, Yorkshire Branch, Leeds 24 September 2013 by John A. Smith Client Relationship Director Company Watch Hindsight in Advance Confidential to Apple

518 views • 25 slides
InfoAnywhere Client Profile Client Overview Client Name: TestPerson Palliative #2650 First

InfoAnywhere Client Profile Client Overview Client Name: TestPerson Palliative #2650 First

Please Note: This view was saved in October 2018. Elements of this page may have been updated, added or removed. If client data is on this screen, it is purely fictitious in nature and was taken from our test system. Please excuse the

308 views • 6 slides
ITU on Measuring Speech Quality Measuring Perceived Quality Typically done by using standards

ITU on Measuring Speech Quality Measuring Perceived Quality Typically done by using standards

Outline Measuring Perceived Quality of Introduction Speech and Video in Multimedia Measuring Perceived Quality Conferencing Applications What is Multimedia Quality? UCL Approach to Measuring Quality Anna Watson and M. Angela

328 views • 4 slides
1 Picturing the client relation (See diagram tool of EiffelStudio.) SUPPLIER CLIENT I ntro. to

1 Picturing the client relation (See diagram tool of EiffelStudio.) SUPPLIER CLIENT I ntro. to

Chair of Softw are Engineering Einfhrung in die Programmierung Introduction to Programming Prof. Dr. Bertrand Meyer October 2006 February 2007 Lecture 4: The Interface of a Class 2 Client, supplier Definitions A client of a

704 views • 11 slides
Describing is good: measuring is better. A new means of measuring the effectiveness of networks

Describing is good: measuring is better. A new means of measuring the effectiveness of networks

Describing is good: measuring is better. A new means of measuring the effectiveness of networks and simultaneously strengthening their function 9 th September 2015 Claire Grealy (Urbis) Gail Winkworth & Michael White Known dimensions of

422 views • 16 slides
Maximising the Power of your People BCTWF Overview Measuring the Employee Experience Why Best

Maximising the Power of your People BCTWF Overview Measuring the Employee Experience Why Best

O Best Company Survey 2017 Maximising the Power of your People BCTWF Overview Measuring the Employee Experience Why Best Company? The Deloitte Best Company Survey has evolved over time in line with client needs and global trends Refreshed

660 views • 20 slides
Caches & Memcache Example Client N. America Client System Asia + Caches Client Africa

Caches & Memcache Example Client N. America Client System Asia + Caches Client Africa

Caches & Memcache Example Client N. America Client System Asia + Caches Client Africa Client Client Client while(get(done1) == false) while(get(done2) == false) put (k1, f(data)) ; ; put (done1, true) put (k2, g(get(k1));

839 views • 61 slides
Extravagance Where do we even start??? This client came to us as a referral from another client

Extravagance Where do we even start??? This client came to us as a referral from another client

Residential Bathroom $75,000 $100,000 Actual Project Cost: $90,000.00 English Tudor Rustic Extravagance Where do we even start??? This client came to us as a referral from another client for whom we had done a beautiful kitchen

284 views • 27 slides
PgBouncer and a Bit of Queueing Theory Peter Eisentraut peter.eisentraut@2ndquadrant.com

PgBouncer and a Bit of Queueing Theory Peter Eisentraut peter.eisentraut@2ndquadrant.com

PgBouncer and a Bit of Queueing Theory Peter Eisentraut peter.eisentraut@2ndquadrant.com @petereisentraut client client client client client client client client client client client DB max_connections = 10000 max_connections =

592 views • 27 slides
Measuring the Measuring the Benefits of Income- B Based Repayment d R t for Graduate and

Measuring the Measuring the Benefits of Income- B Based Repayment d R t for Graduate and

Measuring the Measuring the Benefits of Income- B Based Repayment d R t for Graduate and for Graduate and Professional St d Students t Jason Delisle, Alex Holt, & Kristin Blagg gg New America Foundation Rationale for

864 views • 17 slides
Measuring Environmental & Social Value Introduction Agenda Introductions What is

Measuring Environmental & Social Value Introduction Agenda Introductions What is

Measuring Environmental & Social Value Introduction Agenda Introductions What is value? Why measuring broader value is important Measuring Environmental Value Coffee Break Measuring Social Value Questions

440 views • 30 slides
Primary/Backup CS 452 Single-node key/value store Client Put key1 value1 Client

Primary/Backup CS 452 Single-node key/value store Client Put key1 value1 Client

Primary/Backup CS 452 Single-node key/value store Client Put key1 value1 Client Redis Put key2 value2 Client Get key1 Single-node state machine Client Op1 args1 State machine Client Op2 args2 Client Op

788 views • 46 slides
Primary/Backup CS 452 Single-node key/value store Client Put key1 value1 Client

Primary/Backup CS 452 Single-node key/value store Client Put key1 value1 Client

Primary/Backup CS 452 Single-node key/value store Client Put key1 value1 Client Redis Put key2 value2 Client Get key1 Single-node state machine Client Op1 args1 State machine Client Op2 args2 Client Op

942 views • 42 slides
Measuring What Matters Quality, Impact and Measuring Social Value Philip Angier, Angier Griffin

Measuring What Matters Quality, Impact and Measuring Social Value Philip Angier, Angier Griffin

Measuring What Matters Quality, Impact and Measuring Social Value Philip Angier, Angier Griffin Measuring what matters Introductions: Name Organisation Where youre from first part of postcode Size approx annual

583 views • 27 slides
Measuring Happiness the Big Data Way Measuring emotional content Clinical and Translational

Measuring Happiness the Big Data Way Measuring emotional content Clinical and Translational

Happiness Some motivation Measuring Happiness the Big Data Way Measuring emotional content Clinical and Translational Research Seminar, UVM Data sets Analysis Songs Peter Dodds, Chris Danforth, Blogs SOTU Isabel Kloumann, Cathy Bliss,

886 views • 62 slides
Measuring -- a Simple Solution!? Why not obtain a WCET estimate by measuring the execution time?

Measuring -- a Simple Solution!? Why not obtain a WCET estimate by measuring the execution time?

Measuring Execution Times Peter Puschner Benedikt Huber slides credits: P. Puschner, R. Kirner, B. Huber VU 2.0 182.101 SS 2015 Contents Why (not to) measure

832 views • 43 slides
Measuring over-indebtedness Measuring over-indebtedness EU indicators Brussels, December 12,

Measuring over-indebtedness Measuring over-indebtedness EU indicators Brussels, December 12,

Measuring over-indebtedness Measuring over-indebtedness EU indicators Brussels, December 12, 2014 A lot of information available Various institutions Eurostat European Central Bank Eurobarometer World Bank Ad-hoc

447 views • 19 slides
Measuring & Using Patient Experiences: Surveying Adult and Child Patients Measuring &

Measuring & Using Patient Experiences: Surveying Adult and Child Patients Measuring &

Measuring & Using Patient Experiences: Surveying Adult and Child Patients Measuring & using patient experience: surveying adults and children What we will cover: About Picker Institute Europe Introduction Conducting and using surveys

1.03k views • 75 slides
Measuring, Modeling, and Shaping Skill Development Andrew Caplin: HCEO Conference on Measuring and

Measuring, Modeling, and Shaping Skill Development Andrew Caplin: HCEO Conference on Measuring and

Measuring, Modeling, and Shaping Skill Development Andrew Caplin: HCEO Conference on Measuring and Assessing Skills Chicago, October 2 2015 Introduction I Will pose ve basic (abstract) questions I Question 1: How well does standard multiple

1.05k views • 28 slides

More recommend