DNS Working Group Agenda

Wednesday, 16 October 11:00 – 12:30

 

Presenter Name Presentation Title Type Date Added
Tomas Hlavacek IP fragmentation attack on DNS application/pdfvideo 2013-10-16
Carsten Schiefner ENUM Status application/pdfvideo 2013-10-16
Willem Toorop Using Path MTU Discovery (PMTUD) for better IPv6 DNS responsiveness application/pdfvideo 2013-10-16
Ralf Weber Defeating DNS Amplification Attacks application/vnd.ms-powerpointapplication/pdfvideo 2013-10-12
Geoff Huston DNS over TCP Analysis application/pdfvideo 2013-10-10

A. Administrative Matters (5 mins)

B. ENUM WG Announcement (5 mins)
Carsten Schiefner, DENIC eG

C. PMTU for better IPv6 Performance (10 mins)
Willem Toorop, NLnet Labs

Options for utilising ICMPv6 Packet-Too-Big (PTB) messages to increase DNS responsiveness are explored. Working solutions, evaluated with RIPE Atlas, are presented. The effect of the solutions in the real world are further assessed with the help of traffic captures from SIDN and SURFnet.

D. DNS over TCP analysis (20 mins)
Geoff Huston, APNIC

The Host requirements Specification, RFC 1123, states that “DNS resolvers and recursive servers MUST support UDP, and SHOULD support TCP”. There has been some recent discussion about the viability of employing TCP rather than UDP for large DNS responses as a means of mitigating the vulnerability to large-scale DNS DDOS attacks, and this got us wondering whether resolvers still supported TCP. This is a report of an experiment to measure what proportion of the Internet’s users use DNS resolvers that are capable of using TCP to query authoritative name servers.

E. Defeating DNS Amplification Attacks (15 mins)
Ralf Weber, Nominum

Discussions of amplification attacks have largely focused on authoritative servers. These attacks are beginning to use recursive resolvers. The current generation of attacks leverages home gateways that forward DNS queries coming in on their WAN interface, masking their origin when they arrive at a resolver. It’s unlikely vulnerable home gateways can be updated anytime soon, so this presentation will describe how log data from DNS resolvers can be used to identify attacks and detail proposals for mitigating them without impacting legitimate DNS traffic.

F. UDP Fragmentation/PMTU attack mitigation (20 mins)
Tomáš Hlaváček, CZ.NIC

Recent work has indicated transport- and link-level fragmentation issues are a concern for the DNS. CZ.NIC have been working on a proof of concept to illustrate these potential problems and what might be done to defend against them.

G. Open discussion of C., D., E. & F. (15 mins)

Wednesday, 16 October 14:00 – 15:30

 

Presenter Name Presentation Title Type Date Added
Willem Toorop Which habitat fits your name server’s nature best? application/pdfvideo 2013-10-16
Anand Buddhdev RIPE NCC DNS Update application/vnd.ms-powerpointapplication/pdfvideo 2013-10-16
Dave Knight Introducing Hedgehog application/pdfvideo 2013-10-16
Kostas Zorbadelos Anycasting the DNS resolving service for a country-wide ISP network application/pdfvideo 2013-10-15
Florian Streibelt Client-IP EDNS Option Concerns application/pdfvideo 2013-10-15
Jim Reid DITL Crunching application/keynoteapplication/pdf 2013-10-15

H. RIPE NCC DNS Report (10 mins)
Anand Buddhev, RIPE NCC

I. Which habitat fits your name server’s nature best? (15 mins)
Willem Toorop, NLnet Labs

The performance measurements used for NSD version 4 will be discussed. The core architectural choices in the implementations of various popular name servers are explained. An analyisis is given of which environments and under what circumstances these implementations flourish best.

J. Introducing Hedgehog (10 mins)
Dave Knight, ICANN

Hedgehog, a replacement for DSC which is snazzier in many ways, has been developed for ICANN and will be published as Free/Open Source Software.

K. ISC News (5 mins)
 Jeff Osborn, ISC/DNScoL

L. Client-IP EDNS Option Concerns (15 mins)
Florian Streibelt, TU Berlin

Adoption of the proposed DNS extension, EDNS-Client-Subnet (ECS) offers unique, but likely unintended, opportunities to discover details about operational practices by ECS adopters at almost no cost. By utilising only a single residential vantage point and relying solely on publicly available information, we are able to:
(i) Uncover the global footprint of ECS adopters with very little effort;
(ii) Infer the DNS response cacheability and end-user clustering of ECS adopters for an arbitrary network in the Internet;
(iii) Capture snapshots of user to server mappings as practiced by major ECS adopters.
While pointing out such new measurement opportunities, our work is also intended to make current and future ECS adopters aware of which operational information gets exposed when utilising this recent DNS extension.

M. OTE’s resolver infrastructure/design/rollout (20 mins)
Kostas Zorbadelos, Otenet

  • Initial presentation of the resolving service
  • Why anycast, motives for the service redesign
  • Design choices for anycast nodes in OTE’s network
  • Software choices and anycast node setup
  • Transition to the new setup for existing users
  • Monitoring/alerting/measurement tools
  • Future work/discussion

N. DITL Data Analysis for ICANN gTLD Collision Study (10 mins)
Jim Reid, RTFM LLP

Earlier this year, ICANN commissioned a study into the issues and risks of name collision which may be caused by the addition of new gTLDs. This presentation describes how several terabytes of DNS traffic comprising 150+ billion queries, mostly provided by root server operators for DNS-OARC’s DITL exercise, were processed and the technical challenges/constraints on doing this work.

Z. AOB