- dns-wg - mailman.ripe.net

Provisional Agenda for Athens
by Jim Reid 15 Sep '13

15 Sep '13

Colleagues, here is the provisional (V1.0) agenda for the DNS WG at RIPE67. Please note these details are not finalised. However the speakers and topics below are confirmed. The precise running order (and times) have still to be decided. And of course things may be added, changed or dropped between now and October 16th. Watch this space. As always, please get in touch if you have suggestions for the agenda or questions on what's lined up for our next meeting Hope to see you in Athens. # # $Id: Agenda,v 1.1 2013/09/15 18:22:29 jim Exp $ # PROVISIONAL DNS WG AGENDA - RIPE 67 [0] Usual Administrivia [1] OTE's resolver infrastructure/design/rollout Kostas Zorbadelos, Otenet * Initial presentation of the resolving service * Why anycast, motives for the service redesign * Design choices for anycast nodes in OTE's network * Software choices and anycast node setup * Transition to the new setup for existing users * Monitoring / alerting / measurement tools * Future work / discussion [2] DNS over TCP analysis Geoff Huston, APNIC The Host requirements Specification, RFC 1123, states that "DNS resolvers and recursive servers MUST support UDP, and SHOULD support TCP". There has been some recent discussion about the viability of employing TCP rather than UDP for large DNS responses as a means of mitigating the vulnerability to large scale DNS DDOS attacks, and this got us wondering whether resolvers still supported TCP. This is a report of an experiment to measure what proportion of the Internet's users use DNS resolvers that are capable of using TCP to query authoritative name servers. [3] Defeating DNS Amplification Attacks Ralf Weber, Nominum Discussions of amplification attacks have largely focused on authoritative servers. These attacks are beginning to use recursive resolvers. The current generation of attacks leverages home gateways that forward DNS queries coming in on their WAN interface, masking their origin when they arrive at a resolver. It's unlikely vulnerable home gateways can be updated anytime soon, so this presentation will describe how log data from DNS resolvers can be used to identify attacks and detail proposals for mitigating them without impacting legitimate DNS traffic. [4] UDP Fragmentation/PMTU attack mitigation Ondřej Surý, CZ.NIC [5] PMTU for better IPv6 Performance Willem Toorop, NLnetLabs Options for utilising ICMPv6 Packet-Too-Big (PTB) messages to increase DNS responsiveness are explored. Working solutions, evaluated with RIPE Atlas, are presented. The effect of the solutions in the real aworld are further assessed with the help of traffic captures from SIDN and SURFnet. [6] Which habitat fits your name server's nature best? Willem Toorop, NLnetLabs The performance measurements used for NSD version 4 will be discussed. The core architectural choices in the implementations of various popular name servers are explained. An analyisis given of which environments and under what circumstances these implementations flourish best. [7] NCC DNS Report Stuckee, RIPE NCC [8] Client-IP EDNS Option Concerns Florian Streibelt, TU Berlin Adoption of the proposed DNS extension, EDNS-Client-Subnet (ECS) offers unique, but likely unintended, opportunities to discover details about operational practices by ECS adopters at almost no cost. By utilising only a single residential vantage point and relying solely on publicly available information, we are able to (i) uncover the global footprint of ECS adopters with very little effort; (ii) infer the DNS response cacheability and end-user clustering of ECS adopters for an arbitrary network in the Internet; and (iii) capture snapshots of user to server mappings as practiced by major ECS adopters. While pointing out such new measurement opportunities, our work is also intended to make current and future ECS adopters aware of which operational information gets exposed when utilizing this recent DNS extension. [9] DITL Data Analysis for ICANN gTLD Collision Study Jim Reid, RTFM LLP Earlier this year ICANN commissioned a study into the issues and risks of name collision which may be caused by the addition of new gTLDs. This presentation describes how several terabytes of DNS traffic comprising 150+ billion queries, mostly provided by root server operators for DNS-OARC's DITL exercise, were processed and the technical challenges/constraints on doing this work. [10] OpenDNSSEC Update Sara Dickinson, Sinodun Project announcements

1 0

New on RIPE Labs: A Question of DNS Protocols (by Geoff Huston)
by Mirjam Kuehne 28 Aug '13

28 Aug '13

Dear colleagues, Please find a new article by Geoff Huston on RIPE Labs: A Question of DNS Protocols: https://labs.ripe.net/Members/gih/a-question-of-dns-protocols Kind regards, Mirjam Kuehne RIPE NCC

1 0

RIPE 67 CFP extended deadline 9 September 2013
by Benno Overeinder 26 Aug '13

26 Aug '13

Dear Colleagues, A list of currently accepted RIPE 67 Plenary talks, BoFs, Tutorials and Workshops is now published at: https://ripe67.ripe.net/programme/meeting-plan/draft-programme/ There are still few slots remaining for a final RIPE 67 programme and RIPE Programme Committee will accept new proposals until *9 September 2013*. This is our last call for you to submit your proposals. See https://ripe67.ripe.net/programme/cfp/ or find the original CFP below. Kind regards Filiz Yilmaz for RIPE Programme Committee ------------------ Call for Presentations A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. RIPE 67 will take place from 14-18 October 2013 in Athens, Greece. The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary session presentations, BoFs (Birds of a Feather sessions), panels, workshops, tutorials and lightning talks at RIPE 67. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: * IPv6 deployment * Managing IPv4 scarcity in operations * Commercial transactions of IPv4 addresses * Data centre technologies * Network and DNS operations * Internet governance and regulatory practices * Network and routing security * Content delivery * Internet peering and mobile data exchange Submissions RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and not attempt a product demonstration. The RIPE PC accepts proposals for different presentation formats, including plenary session presentations, tutorials, workshops, BoFs (Birds of a Feather sessions) and lightning talks. See the full descriptions of these formats at https://ripe67.ripe.net/programme/i-want-to-present/presentation-formats/ Presenters who are proposing a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. In addition to presentations selected in advance for the plenary, the RIPE PC also offers several time slots for "lightning talks", which are selected immediately before or during the conference. The following general requirements apply: * Proposals for plenary session presentations, BoFs, panels, workshops and tutorials must be submitted for full consideration no later than 4 August 2013, using the meeting submission system (https://ripe67.ripe.net/submit-topic/). Proposals submitted after this date will be considered on a space-available basis. * Lightning talks should also be submitted using the meeting submission system (https://ripe67.ripe.net/submit-topic/) and can be submitted just days before the RIPE Meeting starts or even during the meeting week. The allocation of lightning talk slots will be announced in short notice - in some cases on the same day but often one day prior to the relevant session. * Presenters should indicate how much time they will require. See more information on time slot allocations per presentation format (https://ripe67.ripe.net/programme/i-want-to-present/presentation-formats/) * Proposals for talks will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panelists, presenters and moderators. * Due to potential technical issues, it is expected that most, if not all, presenters/panelists will be physically present at the RIPE Meeting. If you have any questions or requests concerning content submissions, please email pc [at] ripe [dot] net. -- Benno J. Overeinder NLnet Labs http://www.nlnetlabs.nl/

1 0

agenda topics for RIPE67
by Jim Reid 21 Aug '13

21 Aug '13

Colleagues, the next RIPE meeting is just under two months away. If you have suggestions for discussion topics and/or presentations for the WG, please send them to dns-wg-chair(a)ripe.net. Thanks.

1 0

protect DNS servers from dns amplification attacks
by Michael Hock 07 Aug '13

07 Aug '13

Hi there, I need to set up a DNS server which is accessible from the whole internet. I have not chosen a DNS software yet, so maybe we could discuss about some, e.g. bind, dnsmasq, ... My biggest concerns are dns amplification attacks, I don't want my server to be part of this. Is it already possible to protect DNS servers from spoofing attacks? Maybe just by rate-limiting the requests, without breaking legit requests? Best regards, Michael

6 6

Call for Papers: RIPE 67, 14-18 October 2013 in Athens, Greece
by Benno Overeinder 23 Jul '13

23 Jul '13

Call for Presentations A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. RIPE 67 will take place from 14-18 October 2013 in Athens, Greece. The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary session presentations, BoFs (Birds of a Feather sessions), panels, workshops, tutorials and lightning talks at RIPE 67. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity in operations - Commercial transactions of IPv4 addresses - Data centre technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange Submissions RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and not attempt a product demonstration. The RIPE PC accepts proposals for different presentation formats, including plenary session presentations, tutorials, workshops, BoFs (Birds of a Feather sessions) and lightning talks. See the full descriptions of these formats at https://ripe67.ripe.net/programme/i-want-to-present/presentation-formats/ Presenters who are proposing a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. In addition to presentations selected in advance for the plenary, the RIPE PC also offers several time slots for "lightning talks", which are selected immediately before or during the conference. The following general requirements apply: - Proposals for plenary session presentations, BoFs, panels, workshops and tutorials must be submitted for full consideration no later than 4 August 2013, using the meeting submission system (https://ripe67.ripe.net/submit-topic/). Proposals submitted after this date will be considered on a space-available basis. - Lightning talks should also be submitted using the meeting submission system (https://ripe67.ripe.net/submit-topic/) and can be submitted just days before the RIPE Meeting starts or even during the meeting week. The allocation of lightning talk slots will be announced in short notice - in some cases on the same day but often one day prior to the relevant session. - Presenters should indicate how much time they will require. See more information on time slot allocations per presentation format (https://ripe67.ripe.net/programme/i-want-to-present/presentation-formats/) - Proposals for talks will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panelists, presenters and moderators. - Due to potential technical issues, it is expected that most, if not all, presenters/panelists will be physically present at the RIPE Meeting. If you have any questions or requests concerning content submissions, please email pc [at] ripe [dot] net. -- Benno J. Overeinder NLnet Labs http://www.nlnetlabs.nl/

1 0

draft agenda DNS-WG in Dublin
by Jaap Akkerhuis 10 May '13

10 May '13

Folks, Here is the latest version. See you in Dublin jaap ----- DNS WG, Wednesday May 15th 11:00-12:30, Morning Session A. Administrative matters o Welcome o Scribe selection/introduction o Jabber selection/introduction o Microphone Etiquette o Finalise agenda B. Matters arising from RIPE-59 Minutes C. Review of Action items (No open items) D. DNS Abuse @.nl SIDN Experiences with (Rate) limiting Stephan Rütten, SIDN E. New DNS zone parser for Knot Marek Vavrusa, nic.cz F. OpenDNSSEC Sara Dickinson, Sinodun G. Dynamic Zone Provisioning in YADIFA Peter Janssen, EUrid Z. AOB(1) ___________________ DNS WG, Wednesday May 15th 14:00-15:30, Afternoon Session H. RIPE-NCC Report; News about DNSmon Anand Buddhdev I. ENUM-WG Update Niall O'Reilly or Carsten Schiefner K. News from SSAC Issues with unallocated TLDs that shortly will be allocated, case study with internal certificates Patrik Fältström, Netnod L. Analysis of query traffic to .com/.net name servers Matt Larson, Verisign ZZ. AOB(2)

1 0

New on RIPE Labs: Using RIPE Atlas to find most popular DNS anycast instances
by Mirjam Kuehne 03 May '13

03 May '13

[apologies for duplicates] Dear colleagues, Please find a new article on RIPE Labs, contributed by Stephane Bortzmeyer: Using RIPE Atlas User Defined Measurements to Find the Most Popular Instances of a DNS Anycast Name Server https://labs.ripe.net/Members/stephane_bortzmeyer/using-atlas-udm-to-find-t… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Draft agenda DNS-WG
by Jaap Akkerhuis 27 Apr '13

27 Apr '13

All, Here is the draft agenda for the DNS-WG meeting in Dublin during RIPE-66. Note that this is subject to change, there still is some room for more things and we might actually fill the time with yet another panel but things aren't finalized yet. jaap ---- DNS WG, Thursday May 15th 11:00-12:30, Morning Session A. Administrative matters +5 min o Welcome o Scribe selection/introduction o Jabber selection/introduction o Microphone Etiquette o Finalise agenda B. Matters arising from RIPE-59 Minutes +5 min C. Review of Action items +1 min (No open items) D. Ripe NCC Report +20 min Romeo Zwart (tentative) E. ENUM-WG Update +15 min Niall O'Reilly or Carsten Schiefner F. Analysis of query traffic to .com/.net name servers +30 min Matt Larson, Verisign G. New DNS zone parser for Knot +15 min Marek Vavrusa, nic.cz ___________________ DNS WG, Thursday May 15th 14:00-15:30, Afternoon Session H. DNS Abuse @.nl +20 min SIDN Experiences with (Rate) limiting Stephan Rütten, SIDN I. News from SSAC +20 min Issues with unallocated TLDs that shortly will be allocated, case study with internal certificates Patrik Fältström, Netnod K. OpenDNSSEC +15 min Sara Dickinson, Sinodun Z. AOB

1 0

RIPE65 minutes
by Jim Reid 21 Apr '13

21 Apr '13

Here are the minutes of the last WG meeting. Please speak up if there are any corrections. RIPE 65 DNS Working Group - Session I 26 September 2012, 11:00-12:30 WG co-Chairs: Jim Reid, Jaap Akkerhuis, Peter Koch Scribe: Daniel Quinn A. Administrivia Jaap Akkerhuis, DNS WG co-chair, opened the session and welcomed attendees. He announced that the minutes for RIPE 64 were online and no comments were received so he assumed it was safe to publish them as final. He reminded attendees to state their name clearly before asking a question. Jaap said that there would be some changes to the agenda and that the OpenDNSSEC and benchmarking effort presentations would swap. B. Software Reports DNS Benchmarking Effort - Shane Kerr, ISC https://ripe65.ripe.net/presentations/168-ripe65-dns-benchmarking.pdf Jim Reid, WG co-chair, asked if they had a mailing list or website where the public can see what was going on. He would like to see benchmarks and other forms of information. Shane said there wasn't and that although BIND is not developed in a committee-fashion, ISC is still interested in requests from the community. Daniel Karrenberg, RIPE NCC, asked which direction they were going and whether it was just local benchmarking or a more natural network setting with remote clients. He also asked if they were looking for realistic test loads that come from actual server operators. Shane replied that real world query traffic is important, but it is also important for people to be able to reproduce these benchmarks in their own environment. Also, privacy is a concern. Emilio Madaio, RIPE NCC, pointed out that there was in fact a mailing list: dns-benchmarking(a)lists.dns-oarc.net OpenDNSSEC Update - Sara Dickinson, Sinodun Internet Technologies https://ripe65.ripe.net/presentations/189-ripe65-opendnssec.pdf John Bond, RIPE NCC, asked if they were planning on continuing auditor development. Sara explained that it is no longer part of the product and would require a lot of work to maintain. It is unlikely to continue. C. RIPE NCC DNS Update - Romeo Zwart, RIPE NCC https://ripe65.ripe.net/presentations/179-RIPE65_RomeoZwart_NCC_DNS_update_… Antoin Verschuren, SIDN, asked if it was possible to mandate that networks that have a local K-root node have to do validation. Romeo agreed that that was a good idea. Wilfried Woeber, Univie, pointed out that the RIPE NCC's current model of thinking will exclude networks that are built around ASes like his. Romeo acknowledged this and said that he'd like to make sure that the RIPE NCC approaches these settings on a case-by-case basis. D. DNSSEC Measurement-A slightly closer look - Geoff Huston, APNIC https://ripe65.ripe.net/presentations/177-2012-09-26-dnssec.pdf Lorenzo Colitti, Google, commented that the numbers of 8 and 15% are different for their various tests and experiments but that they always vary with the same range between them. He added that '3' is the number you can trust, which is 8-5. Jim Reid wanted to know if they were doing fingerprinting for software identification. Geoff replied that they were. Heather Schiller, ARIN, asked what record the IP addressess in Geoff's final slide were querying, remarking that if they belonged to her, she would have them fixed. Geoff said that they were querying the A record all the way down in that domain. Paul Vixie, ARIN Board of Trustees, commented that the version of BIND (8) that exhibited this behaviour is known to be susceptible to two stack smashing attacks. He suggested that publication of this information would encourage the managers of those machines to upgrade. E. Panel: Overcoming the “First Mover Loses” Paradigm for IPv6 DNSSEC Deployment https://ripe65.ripe.net/presentations/161-worldfitbday.pdf Panel: Patrick Falstrom (Netnod) Andrei Robachevsky (ISOC), Roland Van Rijswijk (Surfnet), Antoin Verschuren (SIDN) Jim Reid commented that validation may not be as painful as many may think. He suggested that better explanation might help with adoption. Patrik pointed out that what he's heard from others was that the process was so painless, they don't really have any comment on it. Roland said that it cost his organisation nothing, and made no money aside from offers to pay him for talking about it at conferences. He added that training costs should be small because all that's needed is a one or two-day course. Andrew Sullivan, Dyn, Inc., stated that he's more interested in making sure that endpoints are using IPv6 and DNSSEC. He's less interested in ISPs doing the work. He wants OSs and browsers to look into supporting this, rather than ISPs. Peter Koch, WG co-chair, said that this was a topic for another panel. Patrik said that it was good to focus on the "low hanging fruit": the ISPs, and work from there. Lorenzo Colitti, Google, said that the panel was ignoring the problems beyond the initial setup and training costs such as CPU load and the lack of information available regarding the results in different environments. Roland said that the process used for IPv6 migration was one worth repeating, and advocated for some pioneering ISPs and/or big providers like Google, Facebook, and Yahoo to setup DNSSEC for other networks to test against. Patrik said that there was not enough information yet to prove that CPU consumption was significantly increased as a result of DNSSEC, and suggested looking at Sweden’s results, comparing average growth of DNS records and CPU load vs. growth of DNSSEC records and CPU load. Andrei said that the low-hanging fruit isn't very meaningful because there isn't much to validate. DNS - Session II 26 September 2012 - 14:00-15:30 F. Interop & New Protocols Knot DNS - Marek Vavrusa, CZ.NIC https://ripe65.ripe.net/presentations/183-knotdns-ripe65.pdf Sara Dickinson, Sinodun, asked whether the remote control utility they built was using a proprietary protocol. Marek answered that it was and that there are not yet any plans to publish it. Dane: Killer App for DNSSEC - Warren Kumari, Google https://ripe65.ripe.net/presentations/180-Kumari&Sury-DANE-RIPE65_1.pdf There were no questions. RESTful WHOIS – the IETF WEIRDS WG - Olaf Kolkman, NLnet Labs https://ripe65.ripe.net/presentations/213-RIPE65-WEIRDS-WG-DNS.pdf Stanislav Petr, HOSTING90, asked know why they needed this new protocol. Olaf replied that this was an entirely different dataset and requirements. G. DNSMON Future - Romeo Zwart, RIPE NCC https://ripe65.ripe.net/presentations/202-RIPE65_RomeoZwart_NCC_DNSMON_futu… Joao Damas, ISC, wanted to know if these features would be open to all members and wanted more specifics. Romeo said that they would be open to monitor domains for members that want their domains to be monitored. H. Operational Considerations and Recommendations for DNS Response Packet Sizes - Roland Van Rijswijk, SURFnet BV https://ripe65.ripe.net/presentations/167-20120926_-_RIPE65_-_Amsterdam_-_D… Rick van Rein, OpenFortress, asked if the problems he'd experienced were related to IPv4 or v6. Roland confirmed that the problem exists for both, but that it's much worse with IPv6. Joao commented that BIND was going to have a lot of work done on it soon and asked for Roland's opinion on best practice for DNS. He asked whether you compromise efficiency and performance for the sake of compatibility with poorly configured firewalls or do you leave people with broken networks with slower speeds. He asked if there was a middle ground. Roland referred to the differences between BIND and Unbound and how Unbound's method was more effective at getting a response faster for the user. He added that that, coupled with Geoff Huston's revelations from earlier that day that users are extremely impatient, meant that users are less likely to blame the zone operator for poor speeds, but rather they might blame the network operator who can't fix the problem. Joao asked if Roland, as a zone operator, was happy with the increase in TCP requests for DNS. Roland replied that that metric wasn't in the stats, but that they did monitor for an increase in TCP and there was no statistically significant increase for TCP fallback. Paul Vixie asked if the total number of UDP queries go up when he dropped the buffer size. Roland explained this was not monitored specifically, but that there were no spikes indicating an increase in extra queries. He added that they could look at it specifically. Paul said that he wrote RFC2671, and as the author he would like to apologise for mistakes he made in its initial writing. Lars-Johan Liman, Netnod, asked how the recommendations would be conveyed to the community. Roland replied that a draft RIPE Working Group recommendation is open to suggestions from this point. An audience speaker commented that DNS operators generally don't like being told how to run their servers. Jim Reid said that what was important was that there was something documented that could serve as an example. The speaker agreed and asked that this be considered in the decision process. Eric Osterweil, Verisign Labs, objected to the hard limits on either side of the equation and noted that establishing standards like this are a slippery slope leading to telling people how to write their code. Roland agreed, stating that a lot of people have limited understanding regarding how to configure their own resolver. I. Panel: DNS Amplification Attacks: BCP38, mitigation, reputation or what? Panelists: Olaf Kolkman (NLnetLabs), Paul Vixie (ISC), Andrew Sullivan (Dyn), Xander Jansen (Surfnet) Joao asked if the solution was something that couldn't come from the people in this room and whether it be meetspace law? Olaf said the problem was enforcement, the overhead in tracking as well as international treaties, as well as the "arms race" and RFC 3514. Paul said that it comes down to enforcement and that as a victim, you are either being used as an amplifier and reflector or you are being attacked by others. He encouraged anyone in the audience that may be a target of such attacks to contact him privately, as they have access to data that they can share about the attack. They would be contributing to a global effort to track down people conducting these sorts of attacks. Jim Reid noted that by the time the attacking packets have reached him, the perpetrator is already gone, and suggested that BCP38 may be the solution to this. He suggested that core internet exchanges might offer discounts or fatter pipes to ISPs implementing BCP38. Andrew Sullivan said he agreed because it reversed the equation of who has terrible bandwidth: people who act poorly suffer on lower network speeds, as opposed to people who are being attacked. He admits that this is not an ideal solution, but he wasn't sure of a better alternative. J. AOB Anand Buddhdev, RIPE NCC, announced that the RIPE NCC wanted to make the name server attribute mandatory in the RIPE Database, as well make some minor changes to the syntax. He encouraged everyone to look into the archives of the DNS Working Group mailing list and to comment there.

1 0