DNSSECトラフィック解析
where and how many?
福 田 健 介 (国立情報学研究所)
佐 藤 新 太 (JPRS)
三 田 村 健 史 (JPRS)

1

今日のメッセージ• JPサーバでのパッシブ計測とアクティブ計測結果• DNSSECクエリを出すホスト数 (DNSSECホスト)/AS数は増加傾向• 重複したDSクエリが多い• オープンリゾルバでの実験結果から，DNSSECホストのうち実際に検証を行うホストは70%程度• 残りはエンドホストでの検証2

データセット• パッシブ計測• JPサーバでの48時間DNSパケットトレース (7 servers andmany replications)• 計測時期: 2011.06, 2011.12, 2012.04• “DS xxx.jp”に着目• アクティブ計測• DNSSECクエリをパッシブトレース中のDNSSECホストへ送信• オープンリゾルバでのバリデーション状況を調査
3

JP server

Validating caching resolver(3) "DNSKEY .jp""DS example.jp"(1) DO = 1
Clientトラフィック内訳(5) validation

Auth server: example.jp(6) AD = 1(4) "DNSKEY example.jp"• DNSSECクエリを送信したホスト/AS数• 0.4->1.1% for IP addrs (hosts)• 5.9->11.1% for ASes
C. Dataset• ちゃんと増えている :)Fig. 1.

DNSSEC validation by validating caching resolver

TABLE IT RAFFIC BREAKDOWN
Data
201106201112
201204

IP addrs
2150958
2081826
1904610

Total
ASes
28722
29600
29334

Countries
215
217
216

IP addrs
9629
14085
21238

DNSSEC
ASes Countries
1705
105
2490
1193295136

Characterization of DNSSEC traffic requires the collectionof all queries related to DNSSEC as well as the original query.

validating caching resolon the other hand, mean
with stub validators (orclients.
III. DYNAMIC

A. DNSSEC related hos

We first show the bas
The three packet traces
IP addresses respectively
the smaller number of a
failure at one replicationof this server to be 0.
of the numbers for theof ASes and countries r
the routeviews data [22Out of these, the numbsending DS and/or DNS
14085 in 201112 and 2
for 0.4%, 0.7%, and 1We will refer to an IP athough one IP address dthe existence of middle
The total numberof DN
4and 3295, respectively,

shed light on the following DS/DNSKEY query patterns ofDNSSEC hosts: (1) redundant DS queries, (2) ratio of DS
queries to other queries, (3) co-occurrence of DS queries
and original queries, and (4) inter-arrival period of DNSKEYqueries.

receive a small fract
number of validatorslarge number of nonplots for the number
queries per host in Fig
1010201106
and DS-DNSKEY, (b201112201204
10
DS-only, (c) the non
1010
DNSKEY, and (d) th
10
DS-only. The plots fo
10
concentrated along the1010
a positive correlation
1010validators explicitly se
1010101010101010101010
Total number of DS queries per hostDuplication ratio
other hand, the behav
Fig. 3. (a) Total number of DS queries and the number of unique DS queries, is more complicated tand (b) Cumulative distribution of duplication ratio per hostbe distinguished along
them are widely sprea
1) Redundant DS queries: We first examine the duplication to a larger number o
ほとんどのDSクエリは重複
of DS queries from the original traces. Considering the default DS queries. The form
TTL (24h) of DS queries, we suppose that there are no and small non-validati
有効なクエリは20-30%
duplicate DS queries per host within 24 hours after the first validators and a few e
DS query arrives, due to the cache at the host. From the plots that has a few validatof the number of DS queries and the number of unique DS forwarder. Thus, thisDSが登録されていないゾーンに対するネガティブキャッシュ
queries per host within 24 hours in Figure 3 (a), however, we validating caching res(15min)の影響=> hosts
DS登録数を増やせば減る?
can see that many
had duplicate DS queries, as shown by words, it is hard to d
the deviations of the plots from the diagonal line. Specifically, resolver and a non-val
for a larger number of DS queries, the plots are closer to in this case. 5The latte

DSクエリの傾向
04

Cumulative distribution

Number of unique DS queries per host

5

3

2

1-2-30-40•
•
•

-1

12

3

4

5

60

1

23

DNSSEC検証を行うホスト• Validating caching resolver• DNSSEC検証を行うキャッシュリゾルバ
• Stub validator• クライアントでDNSSEC検証• e.g., web plugins• キャッシュリゾルバは単にDNSSECクエリ

VCaching resolver

Caching resolver

VClientClient(A) Validating caching resolver

ClientClient(B) Stub validator

をやりとりするのみ

6

オープンリゾルバでのDNSSEC検証
4

ASes had a large number of hosts. Indeed, 90% of the ASes
had less than 10 DNSSEC hosts while the biggest AS had
more than 1000 DNSSEC hosts. Next, Figure 2 (b) shows therelationship between the number of DNS and DNSSEC hosts
per AS. Plots below a horizontal dotted line indicate the ASes
that have no DNSSEC hosts and accounted for approximately
90% of all ASes. The diagonal line represents ASes in which
all DNS hosts sent at least one DNSSEC query. Currently,
the number of such ASes were quite low and also they had
a few number of DNS hosts (less than ten). It is noted thatplots more than 100 DNS hosts are roughly scattered on aline; the number of DNS hosts was 100 times greater thanthat of DNSSEC hosts. This represents that roughly 1% ofthe DNS hosts were DNSSEC available in an AS with many
DNS hosts.

TABLE III
VALIDATING AND NON - VALIDATING CACHING RESOLVERS• トレース中のDNSSECホストにDNSSECクエリを送信(dig .
@xxx +dnssec)• DNSSECホストの10%がオープン
リゾルバ• そのうち38-50%が実際に検証している

TABLE II# DNSSEC RELATED HOSTS

DS-DNSKEY
DS-only
DNSKEY-only
total

201106
5652
2745
697
9094

201112
8679
3286
1123
13088

201204
13360
5672
1155
20187

201106
DS-DNSKEY
DS-only
DNSKEY-only
total

validator
276 (52%)
48 (18%)7 (11%)331 (38%)

non-validator
257 (48%)226 (82%)
63 (89%)546 (62%)

total
533
274
70
887

201112
DS-DNSKEY
DS-only
DNSKEY-only
total

validator
546 (61%)109 (34%)
26 (16%)681 (50%)

non-validator
343 (39%)208 (66%)
133 (84%)684 (50%)

total
889
317
159
1365

201204
DS-DNSKEY
DS-only
DNSKEY-only
totalvalidator
891 (64%)125 (17%)
13 (11%)1029 (46%)

non-validator
510 (36%)602 (83%)
109 (89%)
1221 (54%)

total
1401
727
122
2250

resolvers that are the same as the previous one.
Moreover, 3788 hosts commonly appeared in the threetraces. Out of these, 2692 hosts (68%) were categorized as the7same type in the three traces; There were 2115 DS-DNSKEY
hosts, 290 DS-only hosts, and 158 DNSKEY-only hosts.

検証を行うキャッシュリゾルバ数の推定• キーアイディア (詳細は省略)• ホスト単位でのオリジナルクエリ数とDSクエリ数の比 (近似だけど計算が大変じゃない)• 検証を行わないキャッシュリゾルバ => 比が小さい• 検証を行うキャッシュリゾルバ => 比が大きい• オープンリゾルバでの精度は85%8accuracy

precision

recallf-measuree identified
201106
0.82
0.71
0.95
0.81
of validating
201112
0.85
0.81
0.95
0.87
viewed as a
201204
0.85
0.78
0.95
0.86
search field.
ch data item
TABLE VI
on methods
N UMBER OF ESTIMATED VALIDATORS
n proposed
n-tree-based
fication and(DS-DNSKEY & DS-only)
201106201112201204
DSR > 0.04
5903 (70%) 9043 (76%) 13830 (73%)
n tree [21])DSR ≤ 0.04
2494 (30%) 2922 (24%)
5201(27%)
ate the rules
total8397
11965
19031
e results. We
orithms: theWe estimated the number of validators by using the DSR
queries, theDNSSECホストの約70%が検証を行うキャッシュリゾルバと推定
queries, the and the original three traces. As shown in Table VI, the ratio ofe maximum validating caching resolvers was consistent among the traces
DNSSECホストが属するASのうち15-20%には検証を行うキャッthe outputs (70, 76, and 73%, respectively). Furthermore, In the AS level,
we concluded that 15-20% of the ASes sending DNSSEC-validations シュリゾルバはいなさそう
lassification
1 We obtained similar results by using the number of unique DS queries
hus, we will instead of the number of DS queries for DSR.

検証を行うキャッシュリゾルバ数の推定••

9se czEstimated ratio of validators

10.8

dejp
us

0.6
0.4
0.2
0
1

10
100
1000
Number of DNSSEC IP addrs

国別

10000

#Estimated DNSSEC hosts per AS

国別およびAS別推定リゾルバ数
103

102

101

no validator

100100121010#DNSSEC hosts per AS

103

AS別• 推定リゾルバが少ないASの一部はpublic DNS サーバを運用
10

結論• パッシブ＆アクティブ計測によるDNSSECホストの解析• DNSSEC hosts数は増加傾向• ホストレベル:1.1%, ASレベル:10%• 正しいDSクエリは20%程度• DSと他のクエリの比によって検証を行うリゾルバを推定• ホストレベル: 30%, ASレベル:15-20%はエンドホストによる影響

11