Old but Gold: Prospecting TCP to Engineer and Live Monitor DNS Anycast

Moura, Giovane C. M.; Heidemann, John; Hardaker, Wes; Charnsethikul, Pithayuth; Bulten, Jeroen; Ceron, João Marcelo; Hesselman, Cristian

doi:10.1007/978-3-030-98785-5_12

Cited by 12 publications

(9 citation statements)

References 56 publications

(85 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, when testing an IXP in South America, most networks in the US prefer to send replies to a transit-site in the US. This "traffic polarization" has also been identified in other studies [32]. The "drain" concept and manipulating prefix sizes.…”

Section: Traffic Drain Vantage Points and Cdn Viewsupporting

confidence: 73%

On the Asymmetry of Internet eXchange Points -Why Should IXPs and CDNs Care?

Bertholdo

Ferreira²,

Ceron

et al. 2022

2022 18th International Conference on Network and Service Management (CNSM)

View full text Add to dashboard Cite

Internet eXchange Points (IXPs) provide an infrastructure where content providers and consumers can freely exchange network traffic. The main incentive for connecting to an IXP is to decrease costs and improve the user experience by having content closer to consumers. Despite these benefits, several small Content Delivery Networks (CDNs) avoid exchanging traffic on IXPs due to the poor routing quality via IXP paths. In this paper, we investigate how traffic asymmetry affects the quality of paths. IXP asymmetry occurs when traffic is sent (or received) via a direct IXP peering but received (or sent) on an alternative path outside the IXP. We employ a new method to quantify a symmetry rate for an IXP, which we evaluate on five IXPs. Our method covers three times more ASes than alternatives, such as using RIPE ATLAS. Our results show that IXPs have 15% asymmetric paths at a distance of one AS hop, i.e., when sending traffic to a given peer on the IXP, 15% of this traffic will be responded via a transit AS that does not use the IXP path. We also identify deaf neighbors, i.e., ASes that never return traffic to the IXP. We identify egress-only paths as a major cause of asymmetries and show that this occurs only for a small number of ASes. We also quantify the impact of traffic asymmetry at IXPs in terms of latency and show that traditional traffic engineering on IXP prefixes can actually make route quality worse.

show abstract

Section: Traffic Drain Vantage Points and Cdn Viewsupporting

confidence: 73%

On the Asymmetry of Internet eXchange Points -Why Should IXPs and CDNs Care?

Bertholdo

Ferreira²,

Ceron

et al. 2022

2022 18th International Conference on Network and Service Management (CNSM)

View full text Add to dashboard Cite

show abstract

“…DNS queries are then routed to the nearest anycast locations based on the routing tables. As BGP is latency agnostic, it may eventually map clients to instances from another continent, even when closer ones are available [43].…”

Section: Background On Dns Root Server Systemmentioning

confidence: 99%

Intercept and Inject: DNS Response Manipulation in the Wild

Nosyk

Lone²,

Zhauniarovich

et al. 2023

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

DNS is a protocol responsible for translating human-readable domain names into IP addresses. Despite being essential for many Internet services to work properly, it is inherently vulnerable to manipulation. In November 2021, users from Mexico received bogus DNS responses when resolving whatsapp.net. It appeared that a BGP route leak diverged DNS queries to the local instance of the k-root located in China. Those queries, in turn, encountered middleboxes that injected fake DNS responses. In this paper, we analyze that event from the RIPE Atlas point of view and observe that its impact was more significant than initially thought-the Chinese root server instance was reachable from at least 15 countries several months before being reported. We then launch a ninemonth longitudinal measurement campaign using RIPE Atlas probes and locate 11 probes outside China reaching the same instance, although this time over IPv6. More broadly, motivated by the November 2021 event, we study the extent of DNS response injection when contacting root servers. While only less than 1% of queries are impacted, they originate from 7% of RIPE Atlas probes in 66 countries. We conclude by discussing several countermeasures that limit the probability of DNS manipulation.

show abstract

“…The root server deploys the root instance through anycast technology, and each root server instance maintains a root zone file. The deployment of root mirrors can not only effectively resist DDoS attacks, but also improve the resilience and robustness of the DNS system [15][16][17]. In addition, the localization of the root zone file is realized on the recursive side.…”

Section: Root Zone Data Managementmentioning

confidence: 99%

Research on the Construction of High-Trust Root Zone File Based on Multi-Source Data Verification

et al. 2023

View full text Add to dashboard Cite

The root zone is located at the top level of the DNS system’s hierarchical structure and serves as the entry point for all domain name resolutions. The accuracy of the root zone file determines whether domain names can be resolved correctly. To solve the problems of single-source distrust and inaccurate data in the use of root zone files, this paper utilizes multi-source root zone files to build an accurate, real-time, and highly trustworthy root zone file through the validation of data accuracy and integrity. First, we propose a weighted voting statistical verification method. We select top-level domain name records with the highest confidence from the multi-source root zone data, thereby improving data accuracy. Second, through a dynamic cyclic construction process, we achieve dynamic monitoring of root zone file version changes, effectively ensuring the real-time nature of root zone data. Finally, we adopt a DNSSEC verification mechanism to address the issue of unreliable transmission paths for actively probed root zone data, ensuring data integrity by verifying the signed top-level domain name records and their ZSK, KSK keys. In addition, through the analysis of experimental data, we find that the main reason for the inaccuracy and unreliability of the root zone file is the delay in updating and synchronizing the file. We also discover the presence of redundant KSK keys in some of the source root zone data, which led to failure in the DNSSEC validation chain. The high-trust root zone file constructed in this paper provides data support for research on the root-side resolution anomaly detection and localization application of root zone files and has wide-ranging practical value.

show abstract

Old but Gold: Prospecting TCP to Engineer and Live Monitor DNS Anycast

Cited by 12 publications

References 56 publications

On the Asymmetry of Internet eXchange Points -Why Should IXPs and CDNs Care?

On the Asymmetry of Internet eXchange Points -Why Should IXPs and CDNs Care?

Intercept and Inject: DNS Response Manipulation in the Wild

Research on the Construction of High-Trust Root Zone File Based on Multi-Source Data Verification

Contact Info

Product

Resources

About