Turbo King: Framework for Large-Scale Internet Delay Measurements

Abstract

Abstract-Distance estimation and topological proximity in the. Besides deploying tracers and using virtual coordinates, distance is often estimated using end-to-end methods such as King [13] that rely on the existing DNS infrastructure. However, the question of accuracy in such end-to-end estimation and its ability to produce a large-scale map of Internet delays has never been examined. We undertake this task below and show that King suffers from non-negligible error when DNS zones employ geographically diverse authoritative servers or utilize forwarders, both of which are very common in the existing Internet. We also show that King requires insertion of numerous unwanted DNS records in caches of remote servers (which is called cache pollution) and requires large traffic overhead when deployed in large-scale. To overcome these limitations, we propose a new framework we call Turbo King (T-King) that obtains end-to-end delay samples without bias in the presence of distant authoritative servers and forwarders, while consuming half the bandwidth needed by King and reducing the impact of cache pollution by several orders of magnitude. We finish the paper by evaluating Turbo King in several experiments.

WSEC DNS: Protecting recursive DNS resolvers from poisoning attacks

“…showed that 32% of RDNS resolvers in their study use some sort of "hidden" forwarder [16]. A possible solution would be to move the RDNS in front of the NAT/PAT, but this may not be always possible or easy to do, depending on the specific network architecture or configuration (for example, a change in the network architecture may expose the RDNS to other kinds of attacks, beside cache poisoning).…”

“…In the following we will assume Γ T XID = 2 16 (perfect randomization of the TXID), and Γ port = 2 16 − 1024 (i.e., perfect randomization of all the ports excluding the first usually reserved 1024 ports). For the 0x20-bit encoding we consider three cases, namely Γ 0x20 = 2 6 for short domain names containing 6 letters (e.g., cnn.com, aol.com, etc.…”

“…For the 0x20-bit encoding we consider three cases, namely Γ 0x20 = 2 6 for short domain names containing 6 letters (e.g., cnn.com, aol.com, etc. ), Γ 0x20 = 2 12 because [7] reports 12 as the average length of domain names, and Γ 0x20 = 2 16 . Also, we assume WSEC DNS queries are performed using random alphanumeric prefixes of length 5, thus Γ W SEC = 36 5 (WSEC random strings consists of combinations of lower-case letters and digits).…”

On the Impact of Clustering on Measurement Reduction

“…In addition, others proposed techniques for monitoring networks and, possibly, reducing the amount of required measurements while keeping accurate the measured metrics [17,18,19,7,9]. In particular, Donnet et al [9] impose a limit on the number of traceroute monitor that can probe a given destination.…”

Enabling High-Performance Internet-Wide Measurements on Windows

“…Our third project studies the DNS infrastructure for Internet-wide delay measurements [8] and various botnet-related anomalies, which requires traversing the DNS tree with over 650M DNS requests. Sending such a large number of small packets presents a problem for Winsock and limits the duration of the measurement to days instead of minutes.…”