DNS traffic analysis-- Issues of IPv6 and CDN -Kazunori Fujiwara”^, Akira Sato”, Kenichi Yoshida””University of Tsukuba^Japan Registry Services Co., Ltd (JPRS)
July 29, 2012 IEPG meeting at VancouverThis material comes fromK. Fujiwara, A. Sato”, K. Yoshida,“DNS traffic analysis -- Issues of IPv6 and CDN --”, Proceedings of 2012
IEEE/IPSJ 12th International Symposium on Applications and the Internet(SAINT- 2012), pp.129-137, July 2012.

1

Outline• Background• Related works and recent issues• DNS Traffic data at University of Tsukuba• Analysis results– Increase of AAAA queries– Cache hit rate and effect to authoritative DNS
servers• Conclusion

2

Background: DNS and Internet• The Internet has become a criticalinfrastructure• Domain Name System (DNS)– a key naming system of the Internet– Bridge domain names & IP addresses• DNS load is increasing3

Related works and recent issues• Related works– In 2002, Jaeyeon et al. reported on DNS
performance and the effectiveness ofcaching• Recent Issues from 2002
– IPv6 aware clients has been spread• They send both A (IPv4) and AAAA (IPv6)
queries– Content Delivery Networks (CDNs) use
complicated DNS configurations
4

CDN and Web service issues
1. Cache: DNS answers are cached for next query at
Full-resolvers–––

TTL: Cacheable time (in second)
Root, TLDs set 86400(1day) or 172800(2days)
CDN and large web services use small TTL value tocontrol their traffic (20, 30, 60, 300)

2. CNAME: Alias mechanism in DNS–

Full resolvers need to restart name resolution processfrom root when it confronts CNAME

3. Use of out-of-bailiwick DNS server name–DNS server name resolution
5

DNS Traffic data at Univ. of Tsukuba• Compared 2002 Jaeyeon’s data with recent
Tsukuba’s data
– Lookup rates are 20 times larger than MIT 10 years ago– Query names are 12 times increased– Number of clients are similar

Originjung2002dns jung2002dns

AuthorAuthorDate (from-to) 2000/12/04-11 2001/05/18-24 2010/11/1-30 2011/11/1-30
PlaceMIT
KAIST
Tsukuba
Tsukuba
366,489,49
lookups
4,160,954 4,339,473 234,308,393
9Queries/sec
6.88
8.37
90.40
141.39query names
302,032
219,144 3,375,088 4,015,966
clients
1,216
8,6056556
8815
query/sec/clients
0.013780.016036

DNS Data collection at Univ. of Tsukuba
Users’ traffic (Web, voices, videos, …)
Univ of TsukubaCampus network
Terminal rooms
Class rooms
WirelessDepartments
Laboratories
Dormitory

Internet:Firewall

Authoritative
DNS servers

DNS Queries
L2 switch

Full-Resolver
DNS server

Copy packets to Data collecting PC
Using port mirror
Data collecting DNS query information
PCAP format
PC

Academic Computing & Communication Center offers Full-Resolver
7
DNS servers for Campus network of Univ. of Tsukuba

Query types seen at A.DNS.JP
AAAA queries are increasing slightly(7%/2004 to 14%/2011)
10.8
0.6

AAAAA

0.4

2011/4/24

2010/4/24

2009/4/24

2008/4/24

2007/4/24

2006/4/24

2005/4/24

0

2004/4/24

0.2

8

Increase of AAAA queries
Query types from clientsPTR
8%• Recently, 29% of queries
are IPv6 address (AAAA)
querieseven if they don't have
IPv6 connectivity

AAAA
29%

AAAA
Only
3%

Both AandAAAA
53%

A Only35%

A
62%

Query types observed
by Full-resolver, Nov.20119

Num. of clients which send A & AAAA
CaseHosts[%]

Total Hosts

8815

100

Hosts, send A queries

8707

98.8

Hosts, send AAAA queries

7772

88.2

Hosts, send both A and AAAA

7720

87.6

send A before AAAA

6993

79.3

send AAAA before A

100

1.1

mix (undetermined)

627

7.1

• 88.2% of clients send AAAA queries even if they don't have
IPv6 connectivity• 79.3% of clients send A queries before AAAA queries.
10

79.3% of clients send A before AAAA
JP info is cachedexample.jp info is cachedNo AAAA query to Root,
TLDs
A and AAAA Full-Resolver
queries are
DNS server
observedat Full-resolver

Root

Only A query is observed atroot and TLD
JPAAAAA
example.jp

Both A and AAAA queries
are observed at example.jp

First query is A
second query is AAAA
results little increase of AAAA at JP 11

Answer types for clients
92.6% of AAAA answers: NO DATA
Query Type

Total

AAAAA

PTR

Other

Number ofqueries

366.5

225.7

106.6

31.1

3

[million]

100%

62%

29%

8%

1%Answer Type%%%%%

Server Failure

2.9

0.6

1.8

23.3

1.3

Name Error

11.5

8.1

3.4

59.1

67.7

00000.3

Normal Answer

57.2

89.3

2.0

17.4

17.1

No Data

27.5

0.7

92.6

0.1

12.2

Timeout

0.9

1.3

0.2

0.1

1.4

Refused12

Evaluation Indexes
1. Cache hit rate
– number of cache hit stub query / number of all stub query– Cache hit = no queries for authoritative

2. How many queries sent to authoritative DNS
servers does one stub query generates?
– Number of authoritative DNS server queries / Number ofstub queries– Root: root DNS server queries / Stub queries– TLD: TLD DNS server queries / Stub queries– All Auth: Authoritative queries / Stub queries

3. Latency to clients
13

Cache hit rate and effect to auth.
Ratio Cache Authoritative queries
Latency
devidedbyStubin the hit(ave)Casewhole rate
RootTLDs All
[ms]
[%]
[%]
ALL
100 75.1 0.00079 0.025 0.31
28
with CNAME
53.9 73.8
0.0007 0.025 0.34
30.4
without CNAME 43.2 76.7 0.00096 0.028 0.26
24.9
Normal Answer
57.2 72.3 0.00071 0.039 0.37
31.4
Error
42.8 78.90.0009 0.007 0.22
23.4
ServerFailure
2.9 77.8 0.00007 0.002 0.5489.5
NoData27.3 75.4 0.00006 0.007 0.24
23.4
NameError
11.5 93.5 0.00315 0.008 0.06
5.3
NameError
11.1 93.5 0.00008 0.008 0.06
5.3
(woTLDerror)
TLDerror
0.5 92.6 0.07303
0 0.07
5.4
TTL<=300
44 67.3 0.00033 0.021
0.4
31.7
TTL>300
56 81.3 0.00115 0.029 0.23
25.1

14

Cache hit rate and effect to auth.
Ratio Cache Authoritative queries
Latency
devidedbyStubin the hit
Case(ave)whole rate
RootTLDs All[ms][%][%]
ALL
100 75.1 0.00079 0.025 0.31
28
with CNAME
53.9 73.8
0.0007 0.025 0.34
30.4
The averageof all data
without CNAME 43.2
76.7 0.00096
0.028 0.26
24.9
Normal Answer
57.2 72.3 0.00071 0.039 0.37
31.4
Error
42.8 78.9
0.0009 0.007 0.22
23.4
ServerFailure
2.9 77.8 0.00007 0.002 0.54
89.5
NoData27.3 75.4 0.00006 0.007 0.24
23.4
NameError
11.5 93.5 0.00315 0.008 0.06
5.3
NameError
11.1 93.5 0.00008 0.008 0.06
5.3
(woTLDerror)
TLDerror
0.5 92.6 0.07303
0 0.07
5.4TTL<=300
44 67.3 0.00033 0.021
0.4
31.7
TTL>300
56 81.3 0.00115 0.029 0.23
25.115

Cache hit rate and effect to auth.
Ratio Cache Authoritative queries
Latency
devidedbyStubin the hit
Case(ave)whole rate
RootTLDs All[ms]
[%]
[%]
ALL
100 75.1 0.00079 0.025 0.31
28
with CNAME
53.9 73.8
0.0007 0.025 0.34
30.4
without CNAME 43.2 76.7 0.00096 0.028 0.26
24.9
Normal Answer
57.2 72.3 0.00071 0.039 0.37
31.4
Useof CNAME makes
slow (5.5ms) 0.22Error
42.8 response
78.9
0.00090.007
23.4
increases
queries130%(0.34/0.26)
ServerFailure
2.977.8 auth
0.00007
0.002
0.54
89.5
cache75.4
hit ratelow (3%)NoData27.3
0.00006
0.007 0.24
23.4
NameError
11.5 93.5 0.00315 0.008 0.06
5.3
NameError
11.1 93.5 0.00008 0.008 0.06
5.3
(woTLDerror)
TLDerror
0.5 92.6 0.07303
0 0.07
5.4
TTL<=300
44 67.3 0.00033 0.021
0.4
31.7
TTL>300
56 81.3 0.00115 0.029 0.23
25.1

16

Cache hit rate and effect to auth.
Ratio Cache Authoritative queries
Latency
devidedbyStubin the hit
Case(ave)whole rate[ms]
RootTLDs All[%][%]ALL
100 75.1 0.00079 0.025 0.31
28
with CNAME
53.9 73.8
0.0007 0.025 0.34
30.4
without CNAME 43.2 76.7 0.00096 0.028 0.26
24.9
Normal Answer
57.2 72.3 0.00071 0.039 0.37
31.4
Error
42.8 78.9
0.0009 0.007 0.22
23.4
ServerFailure
2.9 77.8 0.00007 0.002 0.54
89.5
NoData27.3 75.4 0.00006 0.007 0.24
23.4
NameError
11.5 93.5 0.00315 0.008 0.06
5.3
NameError
A lot of Errors, butand 0.008
latency0.06
are not bad
11.1cache
93.5hit rate
0.00008
5.3(woTLDerror)
Especially, 0.5
No Datacaused by AAAA
queries. 5.4
TLDerror
92.6 0.07303
0 0.07Well
low latency
TTL<=300
44 cached,67.3 0.00033
0.021
0.4
31.7
TTL>300
56 81.3 0.00115 0.029 0.23
25.1

17

Cache hit rate and effect to auth.
Ratio Cache Authoritative queries
Latency
devidedbyStubin the hitCase(ave)whole rate[ms]RootTLDs All[%][%]ALL
100 75.1 0.00079 0.025 0.31
28
with CNAME
53.9 73.8
0.0007 0.025 0.34
30.4
without CNAME 43.2 76.7 0.00096 0.028 0.26
24.9
Normal Answer
57.2 72.3 0.00071 0.039 0.37
31.4
Error
42.8 78.9
0.0009 0.007 0.22
23.4
ServerFailure
2.9 77.8 0.00007 0.002 0.54
89.5
NoData27.3 75.4 0.00006 0.007 0.24
23.4
NameError
11.5 93.5 0.00315 0.008 0.06
5.3
NameError
11.1 93.5 0.00008 0.008 0.06
5.3
(woTLDerror)
TLDerror
0.5 92.6 0.07303
0 0.07
5.4
TTL<=300
44 67.3 0.00033 0.021
0.431.745%
of root DNS 56
serverqueries are caused by TLD
TTL>300
81.3 0.00115 0.029 0.23
25.1

error which specifies non-existing TLDs. (Typos?)18

Cache hit rate and effect to auth.
Ratio Cache Authoritative queries
Latency
devidedbyStubin the hit
Case(ave)whole rate
RootTLDs All[ms][%][%]
ALL
100 75.1 0.00079 0.025 0.31
28
with CNAME
53.9 73.8
0.0007 0.025 0.34
30.4
without CNAME 43.2 76.7 0.00096 0.028 0.26
24.9
Normal Answer
57.2 72.3 0.00071 0.039 0.37
31.4
Error
42.8 78.9
0.0009 0.007 0.22
23.4
ServerFailure
2.9 77.8 0.00007 0.002 0.54
89.5
NoData27.3 75.4 0.00006 0.007 0.24
23.4
Use of small
cache
hit rate
low
NameError
11.5 TTLs
93.5makes
0.00315
0.008
0.06
5.3
NameErrorincreases queries to authoritative DNS servers
11.1 93.5 0.00008 0.008 0.06
5.3
(woTLDerror)
response slow
TLDerror
0.5 92.6 0.07303
0 0.07
5.4
TTL<=300
44 67.3 0.00033 0.021
0.4
31.7
TTL>300
56 81.3 0.00115 0.029 0.23
25.1

19

cumulative distribution of TTL values
1009080CDF[%]

706050Use of small TTL values have beenspread
6.4% of answers have TTL 20
6.8% of answers have TTL 30
45% of answers have TTL ≦ 300

4030
20
10020

6030300
1209001000

3600

43200 172800
86400

1e+06

TTL

The TTL value for each query is chosen as the minimal TTL value for the query

20Cache hit rate at given average frequency & TTL
Over 3/min
3/min~1/min
1/min~
1/hour1/hour~1/day
1/day orlessCache hit rate [%]1009080706050403020TTL

1002060300

9003600

43200 172800
86400

1e+0630 does120
Short TTLs
not mean low cache hit rate.
If frequent, small TTL is OK. But not,TTL
use longer TTL.

Frequency: numberof queries
for toeachqname & qtype
1/dayor less / period (1 month)
1/minute
3/minute
1/day to 1/hour

3/minute or more

21

Authoritative queries at given query frequency & CNAME
Queries 10to auth1Queries 0.1
to TLD0.01Queries
to Root 0.001

100with CNAME

Cache hit ratewith CNAME

with CNAME

80with CNAME

60

40

1e-04
1e-05

20
1e-06
1e-07

0
<=1/day

1/day-1/h

1/h-1/min 1/min-3/min

3/min<The use of CNAMEs lowers cache hit rate about 10%
increases queries to root & TLD DNS servers

22Cache hit rate and use of out-of-bailiwick names
Use of out-of-bailiwick name slow down responses
Case

Rate inthewhole[%]Cache Authoritative queries devided
by Stub queries
hitrateRootTLDs All[%]

Latency
toclients[ms]

Total/Average

100

75.1 0.0008

0.025 0.31

28

All servers are
In-bailiwick

27.5

78.1 0.0004

0.009 0.24

22.5

All servers are
Out-of-bailiwick(except.arpa)

60.1

71.5 0.0004

0.032 0.36

33.1

Some servers are
Out-of-bailiwick

3.7

69.4 0.0012

0.039

0.4

28.6.arpa

7.3

95.7 0.0004

0.006 0.07

6.1

Undetermined

1.5

81.2 0.0256

0.116 0.29

31.5
23

We observed• 29% of queries are AAAA （IPv6) queries
even if clients do not have IPv6 connectivity– Most of answers are No DATA, but well cached• CDNs and web services use low TTL values– It makes DNS cache hit rate low– High-frequency accesses hides this phenomenon.
– TTLs<31 is 14.0%, it creates significant DNS load.

• 45% of queries to the root DNS servers camefrom wrong name queries, 0.5% of all queries.
• 60% of DNS traffic uses out-of-bailiwick DNS
server names. Slows down the DNS response
from 22.5[ms] to 33.1[ms] on average.
24

Countermeasures against inefficient use• All of them are well known• Increasing TTL makes cache hit rate high.
• Small use of CNAME makes cache hit ratehigh• Changing out-of-bailiwick DNS server names
to in-bailiwick improves cache hit rate & delay• Reducing unnecessary AAAA (or A) queries
reduces queries at full-resolves.
– If they don’t have IPv6 or IPv4 connectivity.
25

Cｏｎｃｌｕｓｉｏｎ• Considering the recent deployment of IPv6and CDNs, we have analyzed current DNS
traffic and have revealed findings• We have discussed countermeasures forunnecessary AAAA queries, out-of-bailiwick
DNS server names, the use of CNAMEs andshort TTLs.

26

Future works• Analyze after World IPv6 Launch (2012/6/6)– Quick results• 20% of AAAA answers have IPv6 addresses• Increased from 2%(Nov 2011)• 72% of AAAA answers are still NODATA• Analyze effect of DNSSEC• More detailed CDNs and web service issues
27