- dns-wg - mailman.ripe.net

Minutes DNS-wg RIPE 66
by Jaap Akkerhuis 01 Oct '13

01 Oct '13

All, The minutes have been posted at the usual place <https://www.ripe.net/ripe/groups/wg/dns/minutes/ripe-66>. Please review so they can be approved. Thanks! jaap

1 0

yet another final version of the agenda for Athens
by Jim Reid 01 Oct '13

01 Oct '13

Oops! There was a cut and paste error in the version of the agenda I circulated yesterday. Sorry about that. This has been fixed in the updated version below. Which should be the final version until the next change. :-) # # $Id: Agenda,v 1.7 2013/10/01 08:56:56 jim Exp $ # FINAL DNS WG AGENDA - RIPE 67 [0] Usual Administrivia 5 mins [1] ENUM WG Announcement 5 mins Niall O'Reilly, UCD [2] PMTU for better IPv6 Performance 10 mins Willem Toorop, NLnet Labs Options for utilising ICMPv6 Packet-Too-Big (PTB) messages to increase DNS responsiveness are explored. Working solutions, evaluated with RIPE Atlas, are presented. The effect of the solutions in the real world are further assessed with the help of traffic captures from SIDN and SURFnet. [3] DNS over TCP analysis 20 mins Geoff Huston, APNIC The Host requirements Specification, RFC 1123, states that "DNS resolvers and recursive servers MUST support UDP, and SHOULD support TCP". There has been some recent discussion about the viability of employing TCP rather than UDP for large DNS responses as a means of mitigating the vulnerability to large scale DNS DDOS attacks, and this got us wondering whether resolvers still supported TCP. This is a report of an experiment to measure what proportion of the Internet's users use DNS resolvers that are capable of using TCP to query authoritative name servers. [4] Defeating DNS Amplification Attacks 15 mins Ralf Weber, Nominum Discussions of amplification attacks have largely focused on authoritative servers. These attacks are beginning to use recursive resolvers. The current generation of attacks leverages home gateways that forward DNS queries coming in on their WAN interface, masking their origin when they arrive at a resolver. It's unlikely vulnerable home gateways can be updated anytime soon, so this presentation will describe how log data from DNS resolvers can be used to identify attacks and detail proposals for mitigating them without impacting legitimate DNS traffic. [5] UDP Fragmentation/PMTU attack mitigation 20 mins Ondřej Surý, CZ.NIC Recent work has indicated transport- and link-level fragmentation issues are a concern for the DNS. CZ.NIC have been working on a proof of concept to illustrate these potential problems and what might be done to defend against them. [6] Open discussion of [2], [3], [4] & [5] 15 mins LUNCH BREAK [7] NCC DNS Report 10 mins Anand Buddhev, RIPE NCC [8] Which habitat fits your name server's nature best? 15 mins Willem Toorop, NLnet Labs The performance measurements used for NSD version 4 will be discussed. The core architectural choices in the implementations of various popular name servers are explained. An analyisis given of which environments and under what circumstances these implementations flourish best. [9] Introducing Hedgehog 10 mins Dave Knight, ICANN Hedgehog, a replacement for DSC which is snazzier in many ways, has been developed for ICANN and will be published as Free/Open Source Software. [10] Client-IP EDNS Option Concerns 15 mins Florian Streibelt, TU Berlin Adoption of the proposed DNS extension, EDNS-Client-Subnet (ECS) offers unique, but likely unintended, opportunities to discover details about operational practices by ECS adopters at almost no cost. By utilising only a single residential vantage point and relying solely on publicly available information, we are able to (i) uncover the global footprint of ECS adopters with very little effort; (ii) infer the DNS response cacheability and end-user clustering of ECS adopters for an arbitrary network in the Internet; and (iii) capture snapshots of user to server mappings as practiced by major ECS adopters. While pointing out such new measurement opportunities, our work is also intended to make current and future ECS adopters aware of which operational information gets exposed when utilizing this recent DNS extension. [11] OTE's resolver infrastructure/design/rollout 20 mins Kostas Zorbadelos, Otenet * Initial presentation of the resolving service * Why anycast, motives for the service redesign * Design choices for anycast nodes in OTE's network * Software choices and anycast node setup * Transition to the new setup for existing users * Monitoring / alerting / measurement tools * Future work / discussion [12] DITL Data Analysis for ICANN gTLD Collision Study 10 mins Jim Reid, RTFM LLP Earlier this year ICANN commissioned a study into the issues and risks of name collision which may be caused by the addition of new gTLDs. This presentation describes how several terabytes of DNS traffic comprising 150+ billion queries, mostly provided by root server operators for DNS-OARC's DITL exercise, were processed and the technical challenges/constraints on doing this work. [13] AOB

1 0

final version of the agenda for RIPE67
by Jim Reid 30 Sep '13

30 Sep '13

Colleagues, here is what should be the final version of the WG agenda for Athens. Although no further changes are anticipated, please bear in mind there is always the possibility we get over taken by events between now and Oct 15th. Hope to see most of you in Athens in a couple of weeks. # # $Id: Agenda,v 1.6 2013/09/29 14:26:04 jim Exp $ # FINAL? DNS WG AGENDA - RIPE 67 [0] Usual Administrivia 5 mins [1] ENUM WG Announcement 5 mins Niall O'Reilly, UCD [2] PMTU for better IPv6 Performance 10 mins Willem Toorop, NLnet Labs Options for utilising ICMPv6 Packet-Too-Big (PTB) messages to increase DNS responsiveness are explored. Working solutions, evaluated with RIPE Atlas, are presented. The effect of the solutions in the real world are further assessed with the help of traffic captures from SIDN and SURFnet. [3] DNS over TCP analysis 20 mins Geoff Huston, APNIC The Host requirements Specification, RFC 1123, states that "DNS resolvers and recursive servers MUST support UDP, and SHOULD support TCP". There has been some recent discussion about the viability of employing TCP rather than UDP for large DNS responses as a means of mitigating the vulnerability to large scale DNS DDOS attacks, and this got us wondering whether resolvers still supported TCP. This is a report of an experiment to measure what proportion of the Internet's users use DNS resolvers that are capable of using TCP to query authoritative name servers. [4] Defeating DNS Amplification Attacks 15 mins Ralf Weber, Nominum Discussions of amplification attacks have largely focused on authoritative servers. These attacks are beginning to use recursive resolvers. The current generation of attacks leverages home gateways that forward DNS queries coming in on their WAN interface, masking their origin when they arrive at a resolver. It's unlikely vulnerable home gateways can be updated anytime soon, so this presentation will describe how log data from DNS resolvers can be used to identify attacks and detail proposals for mitigating them without impacting legitimate DNS traffic. [5] UDP Fragmentation/PMTU attack mitigation 20 mins Ondřej Surý, CZ.NIC Options for utilising ICMPv6 Packet-Too-Big (PTB) messages to increase DNS responsiveness are explored. Working solutions, evaluated with RIPE Atlas, are presented. The effect of the solutions in the real aworld are further assessed with the help of traffic captures from SIDN and SURFnet. [6] Open discussion of [2], [3], [4] & [5] 15 mins LUNCH BREAK [7] NCC DNS Report 10 mins Anand Buddhev, RIPE NCC [8] Which habitat fits your name server's nature best? 15 mins Willem Toorop, NLnet Labs The performance measurements used for NSD version 4 will be discussed. The core architectural choices in the implementations of various popular name servers are explained. An analyisis given of which environments and under what circumstances these implementations flourish best. [9] Introducing Hedgehog 10 mins Dave Knight, ICANN Hedgehog, a replacement for DSC which is snazzier in many ways, has been developed for ICANN and will be published as Free/Open Source Software. [10] Client-IP EDNS Option Concerns 15 mins Florian Streibelt, TU Berlin Adoption of the proposed DNS extension, EDNS-Client-Subnet (ECS) offers unique, but likely unintended, opportunities to discover details about operational practices by ECS adopters at almost no cost. By utilising only a single residential vantage point and relying solely on publicly available information, we are able to (i) uncover the global footprint of ECS adopters with very little effort; (ii) infer the DNS response cacheability and end-user clustering of ECS adopters for an arbitrary network in the Internet; and (iii) capture snapshots of user to server mappings as practiced by major ECS adopters. While pointing out such new measurement opportunities, our work is also intended to make current and future ECS adopters aware of which operational information gets exposed when utilizing this recent DNS extension. [11] OTE's resolver infrastructure/design/rollout 20 mins Kostas Zorbadelos, Otenet * Initial presentation of the resolving service * Why anycast, motives for the service redesign * Design choices for anycast nodes in OTE's network * Software choices and anycast node setup * Transition to the new setup for existing users * Monitoring / alerting / measurement tools * Future work / discussion [12] DITL Data Analysis for ICANN gTLD Collision Study 10 mins Jim Reid, RTFM LLP Earlier this year ICANN commissioned a study into the issues and risks of name collision which may be caused by the addition of new gTLDs. This presentation describes how several terabytes of DNS traffic comprising 150+ billion queries, mostly provided by root server operators for DNS-OARC's DITL exercise, were processed and the technical challenges/constraints on doing this work. [13] AOB

1 0

Provisional Agenda for Athens
by Jim Reid 15 Sep '13

15 Sep '13

Colleagues, here is the provisional (V1.0) agenda for the DNS WG at RIPE67. Please note these details are not finalised. However the speakers and topics below are confirmed. The precise running order (and times) have still to be decided. And of course things may be added, changed or dropped between now and October 16th. Watch this space. As always, please get in touch if you have suggestions for the agenda or questions on what's lined up for our next meeting Hope to see you in Athens. # # $Id: Agenda,v 1.1 2013/09/15 18:22:29 jim Exp $ # PROVISIONAL DNS WG AGENDA - RIPE 67 [0] Usual Administrivia [1] OTE's resolver infrastructure/design/rollout Kostas Zorbadelos, Otenet * Initial presentation of the resolving service * Why anycast, motives for the service redesign * Design choices for anycast nodes in OTE's network * Software choices and anycast node setup * Transition to the new setup for existing users * Monitoring / alerting / measurement tools * Future work / discussion [2] DNS over TCP analysis Geoff Huston, APNIC The Host requirements Specification, RFC 1123, states that "DNS resolvers and recursive servers MUST support UDP, and SHOULD support TCP". There has been some recent discussion about the viability of employing TCP rather than UDP for large DNS responses as a means of mitigating the vulnerability to large scale DNS DDOS attacks, and this got us wondering whether resolvers still supported TCP. This is a report of an experiment to measure what proportion of the Internet's users use DNS resolvers that are capable of using TCP to query authoritative name servers. [3] Defeating DNS Amplification Attacks Ralf Weber, Nominum Discussions of amplification attacks have largely focused on authoritative servers. These attacks are beginning to use recursive resolvers. The current generation of attacks leverages home gateways that forward DNS queries coming in on their WAN interface, masking their origin when they arrive at a resolver. It's unlikely vulnerable home gateways can be updated anytime soon, so this presentation will describe how log data from DNS resolvers can be used to identify attacks and detail proposals for mitigating them without impacting legitimate DNS traffic. [4] UDP Fragmentation/PMTU attack mitigation Ondřej Surý, CZ.NIC [5] PMTU for better IPv6 Performance Willem Toorop, NLnetLabs Options for utilising ICMPv6 Packet-Too-Big (PTB) messages to increase DNS responsiveness are explored. Working solutions, evaluated with RIPE Atlas, are presented. The effect of the solutions in the real aworld are further assessed with the help of traffic captures from SIDN and SURFnet. [6] Which habitat fits your name server's nature best? Willem Toorop, NLnetLabs The performance measurements used for NSD version 4 will be discussed. The core architectural choices in the implementations of various popular name servers are explained. An analyisis given of which environments and under what circumstances these implementations flourish best. [7] NCC DNS Report Stuckee, RIPE NCC [8] Client-IP EDNS Option Concerns Florian Streibelt, TU Berlin Adoption of the proposed DNS extension, EDNS-Client-Subnet (ECS) offers unique, but likely unintended, opportunities to discover details about operational practices by ECS adopters at almost no cost. By utilising only a single residential vantage point and relying solely on publicly available information, we are able to (i) uncover the global footprint of ECS adopters with very little effort; (ii) infer the DNS response cacheability and end-user clustering of ECS adopters for an arbitrary network in the Internet; and (iii) capture snapshots of user to server mappings as practiced by major ECS adopters. While pointing out such new measurement opportunities, our work is also intended to make current and future ECS adopters aware of which operational information gets exposed when utilizing this recent DNS extension. [9] DITL Data Analysis for ICANN gTLD Collision Study Jim Reid, RTFM LLP Earlier this year ICANN commissioned a study into the issues and risks of name collision which may be caused by the addition of new gTLDs. This presentation describes how several terabytes of DNS traffic comprising 150+ billion queries, mostly provided by root server operators for DNS-OARC's DITL exercise, were processed and the technical challenges/constraints on doing this work. [10] OpenDNSSEC Update Sara Dickinson, Sinodun Project announcements

1 0

New on RIPE Labs: A Question of DNS Protocols (by Geoff Huston)
by Mirjam Kuehne 28 Aug '13

28 Aug '13

Dear colleagues, Please find a new article by Geoff Huston on RIPE Labs: A Question of DNS Protocols: https://labs.ripe.net/Members/gih/a-question-of-dns-protocols Kind regards, Mirjam Kuehne RIPE NCC

1 0

RIPE 67 CFP extended deadline 9 September 2013
by Benno Overeinder 26 Aug '13

26 Aug '13

Dear Colleagues, A list of currently accepted RIPE 67 Plenary talks, BoFs, Tutorials and Workshops is now published at: https://ripe67.ripe.net/programme/meeting-plan/draft-programme/ There are still few slots remaining for a final RIPE 67 programme and RIPE Programme Committee will accept new proposals until *9 September 2013*. This is our last call for you to submit your proposals. See https://ripe67.ripe.net/programme/cfp/ or find the original CFP below. Kind regards Filiz Yilmaz for RIPE Programme Committee ------------------ Call for Presentations A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. RIPE 67 will take place from 14-18 October 2013 in Athens, Greece. The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary session presentations, BoFs (Birds of a Feather sessions), panels, workshops, tutorials and lightning talks at RIPE 67. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: * IPv6 deployment * Managing IPv4 scarcity in operations * Commercial transactions of IPv4 addresses * Data centre technologies * Network and DNS operations * Internet governance and regulatory practices * Network and routing security * Content delivery * Internet peering and mobile data exchange Submissions RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and not attempt a product demonstration. The RIPE PC accepts proposals for different presentation formats, including plenary session presentations, tutorials, workshops, BoFs (Birds of a Feather sessions) and lightning talks. See the full descriptions of these formats at https://ripe67.ripe.net/programme/i-want-to-present/presentation-formats/ Presenters who are proposing a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. In addition to presentations selected in advance for the plenary, the RIPE PC also offers several time slots for "lightning talks", which are selected immediately before or during the conference. The following general requirements apply: * Proposals for plenary session presentations, BoFs, panels, workshops and tutorials must be submitted for full consideration no later than 4 August 2013, using the meeting submission system (https://ripe67.ripe.net/submit-topic/). Proposals submitted after this date will be considered on a space-available basis. * Lightning talks should also be submitted using the meeting submission system (https://ripe67.ripe.net/submit-topic/) and can be submitted just days before the RIPE Meeting starts or even during the meeting week. The allocation of lightning talk slots will be announced in short notice - in some cases on the same day but often one day prior to the relevant session. * Presenters should indicate how much time they will require. See more information on time slot allocations per presentation format (https://ripe67.ripe.net/programme/i-want-to-present/presentation-formats/) * Proposals for talks will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panelists, presenters and moderators. * Due to potential technical issues, it is expected that most, if not all, presenters/panelists will be physically present at the RIPE Meeting. If you have any questions or requests concerning content submissions, please email pc [at] ripe [dot] net. -- Benno J. Overeinder NLnet Labs http://www.nlnetlabs.nl/

1 0

agenda topics for RIPE67
by Jim Reid 21 Aug '13

21 Aug '13

Colleagues, the next RIPE meeting is just under two months away. If you have suggestions for discussion topics and/or presentations for the WG, please send them to dns-wg-chair(a)ripe.net. Thanks.

1 0

protect DNS servers from dns amplification attacks
by Michael Hock 07 Aug '13

07 Aug '13

Hi there, I need to set up a DNS server which is accessible from the whole internet. I have not chosen a DNS software yet, so maybe we could discuss about some, e.g. bind, dnsmasq, ... My biggest concerns are dns amplification attacks, I don't want my server to be part of this. Is it already possible to protect DNS servers from spoofing attacks? Maybe just by rate-limiting the requests, without breaking legit requests? Best regards, Michael

6 6

Call for Papers: RIPE 67, 14-18 October 2013 in Athens, Greece
by Benno Overeinder 23 Jul '13

23 Jul '13

Call for Presentations A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. RIPE 67 will take place from 14-18 October 2013 in Athens, Greece. The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary session presentations, BoFs (Birds of a Feather sessions), panels, workshops, tutorials and lightning talks at RIPE 67. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity in operations - Commercial transactions of IPv4 addresses - Data centre technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange Submissions RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and not attempt a product demonstration. The RIPE PC accepts proposals for different presentation formats, including plenary session presentations, tutorials, workshops, BoFs (Birds of a Feather sessions) and lightning talks. See the full descriptions of these formats at https://ripe67.ripe.net/programme/i-want-to-present/presentation-formats/ Presenters who are proposing a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. In addition to presentations selected in advance for the plenary, the RIPE PC also offers several time slots for "lightning talks", which are selected immediately before or during the conference. The following general requirements apply: - Proposals for plenary session presentations, BoFs, panels, workshops and tutorials must be submitted for full consideration no later than 4 August 2013, using the meeting submission system (https://ripe67.ripe.net/submit-topic/). Proposals submitted after this date will be considered on a space-available basis. - Lightning talks should also be submitted using the meeting submission system (https://ripe67.ripe.net/submit-topic/) and can be submitted just days before the RIPE Meeting starts or even during the meeting week. The allocation of lightning talk slots will be announced in short notice - in some cases on the same day but often one day prior to the relevant session. - Presenters should indicate how much time they will require. See more information on time slot allocations per presentation format (https://ripe67.ripe.net/programme/i-want-to-present/presentation-formats/) - Proposals for talks will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panelists, presenters and moderators. - Due to potential technical issues, it is expected that most, if not all, presenters/panelists will be physically present at the RIPE Meeting. If you have any questions or requests concerning content submissions, please email pc [at] ripe [dot] net. -- Benno J. Overeinder NLnet Labs http://www.nlnetlabs.nl/

1 0

draft agenda DNS-WG in Dublin
by Jaap Akkerhuis 10 May '13

10 May '13

Folks, Here is the latest version. See you in Dublin jaap ----- DNS WG, Wednesday May 15th 11:00-12:30, Morning Session A. Administrative matters o Welcome o Scribe selection/introduction o Jabber selection/introduction o Microphone Etiquette o Finalise agenda B. Matters arising from RIPE-59 Minutes C. Review of Action items (No open items) D. DNS Abuse @.nl SIDN Experiences with (Rate) limiting Stephan Rütten, SIDN E. New DNS zone parser for Knot Marek Vavrusa, nic.cz F. OpenDNSSEC Sara Dickinson, Sinodun G. Dynamic Zone Provisioning in YADIFA Peter Janssen, EUrid Z. AOB(1) ___________________ DNS WG, Wednesday May 15th 14:00-15:30, Afternoon Session H. RIPE-NCC Report; News about DNSmon Anand Buddhdev I. ENUM-WG Update Niall O'Reilly or Carsten Schiefner K. News from SSAC Issues with unallocated TLDs that shortly will be allocated, case study with internal certificates Patrik Fältström, Netnod L. Analysis of query traffic to .com/.net name servers Matt Larson, Verisign ZZ. AOB(2)

1 0