- dns-wg - mailman.ripe.net

Framework for DNSSEC audits
by Matthijs Mekking 07 Jan '14

07 Jan '14

Hi all, This might be of interest to you. In collaboration with SWITCH, we have developed a DNSSEC audit framework: http://www.nlnetlabs.nl/downloads/publications/dns-audit-framework-1.0.pdf The scope of the framework is largely based on the documents RFC 2870, RFC 6841, RFC 6781 and the Secure Domain Name System (DNS) Deployment Guide from NIST. Having this publicly available we believe it will improve the deployment of DNSSEC. Best regards, Matthijs Mekking NLnet Labs

3 3

Fake Conferences CSCI and WORLDCOMP of Hamid Arabnia
by rickardbrown＠hushmail.com 25 Dec '13

25 Dec '13

Fake Conferences CSCI and WORLDCOMP of Hamid Arabnia Hamid Arabnia from University of Georgia is well known for his fake WORLDCOMP conferences https://sites.google.com/site/dumpconf This website has an open challenge posted sometime in 2012 and it also has comments from several well-known researchers on WORLDCOMP. Hamd Arabnia never responded to these because his conferences are bogus. Hamid Arabnia (the money hungry professor) has recently started 2014 International Conference on Computational Science and Computational Intelligence (CSCI'14) http://www.americancse.org to deceive researchers further. CSCI'14 is started under the title of “American Council on Science and Education” which is a dummy corporation (does not exist anywhere in the world). Hamid Arabnia buried his name in the list of names of other innocent steering and program committee members of CSCI’14 to avoid any special attention. He knows that if his name is given any special attention then researchers immediately notice that the conference is fake due to his “track record” with WORLDCOMP. Hamid Arabnia (Guru of Fake Conferences and champion of academic scam) spoiled the reputations and careers of many authors who submitted papers to his infamous WORLDCOMP for more than a decade and he is now ready to do the same using CSCI. Interestingly, CSCI is scheduled to be held at the same venue where WORLDCOMP was held until 2012. CSCI has no general chair. It has no physical person’s name or physical address or phone number to contact. Only contact address is an email address. Hamid Arabnia and his puppets answer the emails, if needed, using fake names. Do not spoil your resume by submitting your papers in this bogus conference CSCI which will not be held beyond 2014. CSCI will not be indexed by DBLP. Recently, Hamid Arabnia paid money and published few “news articles” claiming him a victim of online harassment and cyber bullying. Now he started posting (using fake names and through his puppets) in various emails, blogs and forums, referring to those “news articles” and trying to get back sympathy and trust of the research community to make his CSCI successful. Hamid Arabnia is a Wolf in a Sheep’s skin. We challenge Hamid Arabnia to openly publish the names and affiliation details of the reviewers for thousands of research papers submitted to WORLDCOMP for the last thirteen years. We also challenge Hamid Arabnia to openly publish all the reviews (after removing authors identification details) for all the thousands of research papers submitted to WORLDCOMP for the last thirteen years. There are more challenges at https://sites.google.com/site/moneycomp1 We know that he never accepts these challenges because there were no reviews and no reviewers and he simply cheated the research community for all these years. We are not surprised if he comes out tomorrow claiming that his computer crashed and he lost the reviews and reviewers’ details. He can play any deceiving trick. See the important website https://sites.google.com/site/worlddump1 for more information on WORLDCOMP, including links to DBLP stop indexing WORLDCOMP proceedings. See http://worldcomp-fake-bogus.blogspot.com for Hamid Arabnia and his puppet’s Anti-Christmas Greetings campaign. We ask Hamid Arabnia and his puppets to address the above issues and challenges before posting any other message. Do not spoil your resume by publishing in the fake conferences of Hamid Arabnia. Sincerely, Many researchers cheated by the conferences of Hamid Arabnia

2 1

FWD: Call for Presentations - DNS-OARC Spring Workshop, May 2014
by Peter Koch 20 Dec '13

20 Dec '13

FYI, this is the weekend before the Warsaw RIPE meeting. We'll talk to each other re: topics and presentations, as with prior adjacent events. There will be a call for presentations for the RIPE DNS WG early Jan 2014. Season's Greetings, Peter ----------------------------------------------------------------------------- Call for Presentations - DNS-OARC Spring Workshop, May 2014 Next OARC Spring Workshop will take place in Warsaw, Poland on May 10th and 11th, the weekend before RIPE68. OARC is requesting proposals for presentations, with a preference for DNS privacy and confidentiality work and ideas, and DNS over alternative (non UDP) transports. This workshop continues OARC's tradition of having meetings include a strong operational component. Presentations from DNS operators are particularly welcome. We'll also gladly accept talks from DNS researchers, as well as any other DNS-related subjects such as tools, visualizations and data analysis. If you are an OARC member, and have a sensitive topic you would like to present for members-only, we will accommodate those talks too. Adopting practice from other conferences, a section of lightning talks will be added for short presentations. Workshop Milestones * 20 December 2013, Call for Presentations posted * 6 January 2014, Open for submissions * 1 March 2014, Deadline for submission * 28 March 2014, Final Program published * May 9 2014, Final deadline for slideset submission Details for abstract submission will be published here: https://indico.dns-oarc.net/event/workshop-2014-05 at the beginning of January 2014. If you consider submitting a presentation, please let the Programme Committee know in advance to help us organize the presentations tracks. You can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via submissions(a)dns-oarc.net if you have questions or concerns. Sebastian Castro, for the OARC Programme Committee (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.)

1 0

RIPE NCC Authoritative DNS service degraded
by Anand Buddhdev 15 Nov '13

15 Nov '13

Dear colleagues, The RIPE NCC's authoritative DNS infrastructure is experiencing a very high query rate at the moment. This query rate is more than our routers can handle, and as a result, responses from our name servers are sporadic. We are working on mitigating this denial-of-service event. Please check our service outages page for updates. http://www.ripe.net/lir-services/service-announcements Regards, Anand Buddhdev RIPE NCC

5 4

New on RIPE Labs: New gTLD Concerns: Dotless Names and Name Collisions
by Mirjam Kuehne 12 Nov '13

12 Nov '13

Dear colleagues, We published a new article by Geoff Huston on RIPE Labs: New gTLD Concerns: Dotless Names and Name Collisions https://labs.ripe.net/Members/gih/dotless-names In the long discussions about the new generic Top level Domains (gTLD), there were two technical topics that were the subject of many assertions and little in the way of observed data. The first concerned the viability of a so-called "dotless" name, where the gTLD label itself contains an IP address in the DNS, and the second concerns the concept of "name collisions" between existing local use of a name and the same name being delegated as a new gTLD. This article explores these two topics, and adds some data to the debate in the way of observed behaviours of the way common operating systems and browsers handle names. Kind Regards, Mirjam Kuehne RIPE NCC

1 0

PTR Record Problem
by Mehdi Sabour 07 Nov '13

07 Nov '13

Dear Colleague, I have faced a problem and I want to address it to you; I hope you can help me. I have created 77.104.67.162 PTR record in my DNS Servers and make its domain in Ripe Database 67.104.77.in-addr.arpa on Monday 4th of November. However, DNS servers do not resolve this IP address. I checked this IP in my DNS Server and Ripe database and It seems everything is OK. I promise you can help me. Best Regards. --- Mehdi Sabour OC Manager Technical Division Respina Networks & Beyond T: +98 21 84 23 00 00 F: +98 21 88 19 10 83 www.respina.net<http://www.respina.net/> ________________________________ This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system administrator. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of RESPINA. Finally, the recipient should check this email and any attachments for the presence of viruses. RESPINA accepts no liability for any damage caused by any virus transmitted by this email. ________________________________

4 3

action item 67.1: gather input for guidance on ccTLD secondary service by the RIPE NCC
by Peter Koch 16 Oct '13

16 Oct '13

Dear WG, with reference to slide 7 in Anand's presentation <https://ripe67.ripe.net/presentations/248-RIPE67_AnandBuddhdev_DNS_update.p…> we are looking for volunteers to join a small short lived group that will look into the current situation and help inform a wg discussion with the intended goal of providing guidance to the NCC if and how to continue the ccTLD DNS secondary service. Please identify yourselves to the WG chairs at <dns-wg-chairs(a)ripe.net>. The result of our short deliberations will serve as input to the open WG discussion. Thanks, Peter

1 0

yet another "final" agenda for the WG
by Jim Reid 15 Oct '13

15 Oct '13

There have been a couple of tweaks to what had been the final agenda. Tomáš Hlaváček will be speaking instead of Ondřej Surý and I've found 5 minutes to squeeze in an update on the ISC from its new CEO, Jeff Osborn. Here's what should be the final, definitive agenda for tomorrow. Maybe. :-) # # $Id: Agenda,v 1.8 2013/10/15 06:45:47 jim Exp $ # FINAL FINAL DNS WG AGENDA - RIPE 67 [0] Usual Administrivia 5 mins [1] ENUM WG Announcement 5 mins Niall O'Reilly, UCD [2] PMTU for better IPv6 Performance 10 mins Willem Toorop, NLnet Labs Options for utilising ICMPv6 Packet-Too-Big (PTB) messages to increase DNS responsiveness are explored. Working solutions, evaluated with RIPE Atlas, are presented. The effect of the solutions in the real world are further assessed with the help of traffic captures from SIDN and SURFnet. [3] DNS over TCP analysis 20 mins Geoff Huston, APNIC The Host requirements Specification, RFC 1123, states that "DNS resolvers and recursive servers MUST support UDP, and SHOULD support TCP". There has been some recent discussion about the viability of employing TCP rather than UDP for large DNS responses as a means of mitigating the vulnerability to large scale DNS DDOS attacks, and this got us wondering whether resolvers still supported TCP. This is a report of an experiment to measure what proportion of the Internet's users use DNS resolvers that are capable of using TCP to query authoritative name servers. [4] Defeating DNS Amplification Attacks 15 mins Ralf Weber, Nominum Discussions of amplification attacks have largely focused on authoritative servers. These attacks are beginning to use recursive resolvers. The current generation of attacks leverages home gateways that forward DNS queries coming in on their WAN interface, masking their origin when they arrive at a resolver. It's unlikely vulnerable home gateways can be updated anytime soon, so this presentation will describe how log data from DNS resolvers can be used to identify attacks and detail proposals for mitigating them without impacting legitimate DNS traffic. [5] UDP Fragmentation/PMTU attack mitigation 20 mins Tomáš Hlaváček, CZ.NIC Recent work has indicated transport- and link-level fragmentation issues are a concern for the DNS. CZ.NIC have been working on a proof of concept to illustrate these potential problems and what might be done to defend against them. [6] Open discussion of [2], [3], [4] & [5] 15 mins LUNCH BREAK [7] NCC DNS Report 10 mins Anand Buddhev, RIPE NCC [8] ISC News 5 mins Jeff Osborn, ISC/DNSco [9] Which habitat fits your name server's nature best? 15 mins Willem Toorop, NLnet Labs The performance measurements used for NSD version 4 will be discussed. The core architectural choices in the implementations of various popular name servers are explained. An analyisis given of which environments and under what circumstances these implementations flourish best. [10] Introducing Hedgehog 10 mins Dave Knight, ICANN Hedgehog, a replacement for DSC which is snazzier in many ways, has been developed for ICANN and will be published as Free/Open Source Software. [11] Client-IP EDNS Option Concerns 15 mins Florian Streibelt, TU Berlin Adoption of the proposed DNS extension, EDNS-Client-Subnet (ECS) offers unique, but likely unintended, opportunities to discover details about operational practices by ECS adopters at almost no cost. By utilising only a single residential vantage point and relying solely on publicly available information, we are able to (i) uncover the global footprint of ECS adopters with very little effort; (ii) infer the DNS response cacheability and end-user clustering of ECS adopters for an arbitrary network in the Internet; and (iii) capture snapshots of user to server mappings as practiced by major ECS adopters. While pointing out such new measurement opportunities, our work is also intended to make current and future ECS adopters aware of which operational information gets exposed when utilizing this recent DNS extension. [12] OTE's resolver infrastructure/design/rollout 20 mins Kostas Zorbadelos, Otenet * Initial presentation of the resolving service * Why anycast, motives for the service redesign * Design choices for anycast nodes in OTE's network * Software choices and anycast node setup * Transition to the new setup for existing users * Monitoring / alerting / measurement tools * Future work / discussion [13] DITL Data Analysis for ICANN gTLD Collision Study 10 mins Jim Reid, RTFM LLP Earlier this year ICANN commissioned a study into the issues and risks of name collision which may be caused by the addition of new gTLDs. This presentation describes how several terabytes of DNS traffic comprising 150+ billion queries, mostly provided by root server operators for DNS-OARC's DITL exercise, were processed and the technical challenges/constraints on doing this work. [14] AOB

1 0

Minutes DNS-wg RIPE 66
by Jaap Akkerhuis 01 Oct '13

01 Oct '13

All, The minutes have been posted at the usual place <https://www.ripe.net/ripe/groups/wg/dns/minutes/ripe-66>. Please review so they can be approved. Thanks! jaap

1 0

yet another final version of the agenda for Athens
by Jim Reid 01 Oct '13

01 Oct '13

Oops! There was a cut and paste error in the version of the agenda I circulated yesterday. Sorry about that. This has been fixed in the updated version below. Which should be the final version until the next change. :-) # # $Id: Agenda,v 1.7 2013/10/01 08:56:56 jim Exp $ # FINAL DNS WG AGENDA - RIPE 67 [0] Usual Administrivia 5 mins [1] ENUM WG Announcement 5 mins Niall O'Reilly, UCD [2] PMTU for better IPv6 Performance 10 mins Willem Toorop, NLnet Labs Options for utilising ICMPv6 Packet-Too-Big (PTB) messages to increase DNS responsiveness are explored. Working solutions, evaluated with RIPE Atlas, are presented. The effect of the solutions in the real world are further assessed with the help of traffic captures from SIDN and SURFnet. [3] DNS over TCP analysis 20 mins Geoff Huston, APNIC The Host requirements Specification, RFC 1123, states that "DNS resolvers and recursive servers MUST support UDP, and SHOULD support TCP". There has been some recent discussion about the viability of employing TCP rather than UDP for large DNS responses as a means of mitigating the vulnerability to large scale DNS DDOS attacks, and this got us wondering whether resolvers still supported TCP. This is a report of an experiment to measure what proportion of the Internet's users use DNS resolvers that are capable of using TCP to query authoritative name servers. [4] Defeating DNS Amplification Attacks 15 mins Ralf Weber, Nominum Discussions of amplification attacks have largely focused on authoritative servers. These attacks are beginning to use recursive resolvers. The current generation of attacks leverages home gateways that forward DNS queries coming in on their WAN interface, masking their origin when they arrive at a resolver. It's unlikely vulnerable home gateways can be updated anytime soon, so this presentation will describe how log data from DNS resolvers can be used to identify attacks and detail proposals for mitigating them without impacting legitimate DNS traffic. [5] UDP Fragmentation/PMTU attack mitigation 20 mins Ondřej Surý, CZ.NIC Recent work has indicated transport- and link-level fragmentation issues are a concern for the DNS. CZ.NIC have been working on a proof of concept to illustrate these potential problems and what might be done to defend against them. [6] Open discussion of [2], [3], [4] & [5] 15 mins LUNCH BREAK [7] NCC DNS Report 10 mins Anand Buddhev, RIPE NCC [8] Which habitat fits your name server's nature best? 15 mins Willem Toorop, NLnet Labs The performance measurements used for NSD version 4 will be discussed. The core architectural choices in the implementations of various popular name servers are explained. An analyisis given of which environments and under what circumstances these implementations flourish best. [9] Introducing Hedgehog 10 mins Dave Knight, ICANN Hedgehog, a replacement for DSC which is snazzier in many ways, has been developed for ICANN and will be published as Free/Open Source Software. [10] Client-IP EDNS Option Concerns 15 mins Florian Streibelt, TU Berlin Adoption of the proposed DNS extension, EDNS-Client-Subnet (ECS) offers unique, but likely unintended, opportunities to discover details about operational practices by ECS adopters at almost no cost. By utilising only a single residential vantage point and relying solely on publicly available information, we are able to (i) uncover the global footprint of ECS adopters with very little effort; (ii) infer the DNS response cacheability and end-user clustering of ECS adopters for an arbitrary network in the Internet; and (iii) capture snapshots of user to server mappings as practiced by major ECS adopters. While pointing out such new measurement opportunities, our work is also intended to make current and future ECS adopters aware of which operational information gets exposed when utilizing this recent DNS extension. [11] OTE's resolver infrastructure/design/rollout 20 mins Kostas Zorbadelos, Otenet * Initial presentation of the resolving service * Why anycast, motives for the service redesign * Design choices for anycast nodes in OTE's network * Software choices and anycast node setup * Transition to the new setup for existing users * Monitoring / alerting / measurement tools * Future work / discussion [12] DITL Data Analysis for ICANN gTLD Collision Study 10 mins Jim Reid, RTFM LLP Earlier this year ICANN commissioned a study into the issues and risks of name collision which may be caused by the addition of new gTLDs. This presentation describes how several terabytes of DNS traffic comprising 150+ billion queries, mostly provided by root server operators for DNS-OARC's DITL exercise, were processed and the technical challenges/constraints on doing this work. [13] AOB

1 0