The Domain Name System (DNS) domain names to be used in network transactions (email, web requests, etc.) instead of IP addresses. The root of the DNS distributed database is managed by 13 root nameservers. We passively measure the performance of one of them: F.root-servers.net.These measurements show an astounding number of bogus queries: from 60-85% of observed queries were repeated from the same host within the measurement interval. Over 14% of a root server's query load is due to queries that violate the DNS specification. Denial of service attacks using root servers are common and occurred throughout our measurement period (7-24 Jan 2001). Though not targeted at the root servers, DOS attacks often use root servers as reflectors toward a victim network. We contrast our observations with those found in an earlier study of DNS root server performance by Danzig et. al. [1].

Abstract. We analyze the evolution of the global Internet interdomain routing system on AS, prefix and Ip address level granularities, using snapshots of RouteViews BGP tables from 1997 to 2001. We introduce the notion of scmigfobolfy mutedprefies, those present in the majority of backbone tables, and classify them into standalone -those which have no subsets, no supersets; mot -have subsets, but no supersets: and subset, or more specific, which are subsets of other blocks. Using these distinctions we find that from 1999 to 2001 many measures of routing system complexity demonstrated stability in the form of slow growth. dynamic equilibrium, and occasional contraction. We find that many net change measures reflect contributions of opposite sign, and that m e measure of variation, or chum, is the sum of their absolute magnitudes rather than the difference. Appearance and disappearance of prefixes, ASes and RouteViews peers, as well as status changes (an AS changing from transit to non-transit, or a prefix shifting from a standalone prefix to a mot prefix) are instances of routing system chum. One advantage of using our notion of semiglobal prefixes is that they exhibit less chum than global prefixes (those prefixes common to all backbone tables) and as such allow for derivation of more robust macroscopic statistics about the routing system. We study route prefix instability at a medium time granularity for late 2001 using 2-hour snapshots of BGP tables. and find that half of all prefix reannouncements (pips) are contributed by 1% of all ASes, with government networks, telecoms in developing countries and major backbone ISPs at the top of the list of instability contributors. Small ASes (those who originate only a few prefixes into the global routing system) do not contribute more than their fair share of either route entries or chum to the global routing system. We conclude that during 1999-2001 many Internet metrics were stable, and that the routing system's growth and instability are mostly caused by large and medium-sized ISPs.

We study attempts to dynamically update DNS records for private (RFC1918) addresses, by analyzing the frequency spectrum of updates observed at an authoritative nameserver for these addresses. Using a discrete autocorrelation algorithm we found that updates series have periods of 60 or 75 minutes, which we identified as default settings of outof-the-box Microsoft Windows 2000 and XP DNS software.

No abstract