Importance of DNS measurements, tools and applications.

1. Internet/DNS
Measurements
Africa DNS Forum 2017
Josiah Chavula, Amreesh Phokeer
AFRINIC Ltd Research & Innovation

2. Overview
Internet Measurements
● Motivation for DNS Measurements
● RIPE Atlas measurements
● Tools, Techniques and Metrics
● Use Cases

3. Why Internet Measurements
● Monitor the performance of your network in real time from
thousands of vantage points
● Troubleshoot problems close to your customers
● Validate your peering strategies (e.g. TraceMON routing
anomalies)
● Plan your content distribution (e.g reachability and latency)
● Research (e.g. IPv6 and DNSSEC deployment and
performance)

4. • Large-scale monitoring of Authoritative DNS
(Roots, ccTLDs, etc…)
• automatically detect failures
• monitoring performance
• Determine which instances of a name server
clients/networks use
• assess the impact of issues with one or more root name
servers
DNS Measurements (Active Measurements)

5. Passive DNS Measurements
Analysis of zone files / resolvers’ data
• Prevalence of DNS Authoritative Name servers running V6
• DNS Resolvers: prevalence of resolvers requesting AAAA
records.
• DNS Queries: the distribution of actual IPv6-related DNS
queries.
Please share DNS data!

6. RIPE Atlas: Probes
•Global network of
"probes" to measure
Internet connectivity
•Monitor network
reachability from
hundreds of vantage
points
•Monitor
responsiveness of
DNS infrastructure,
such as root name
servers

7. RIPE Atlas: Anchors
•More powerful
probes, monitoring
regional
connectivity
•7 anchors in
Africa

8. Accessing Ripe Atlas: https://atlas.ripe.net

9. • Root Server Performance
• Server responsiveness
• Performance comparison between TCP and UDP
• Root Instances
• which root DNS server instance gets queried by clients
• Root server latencies
• compare response times for DNS SOA queries to all the
root DNS servers
DNS Measurements

10. DNSMON: monitoring root zone servers

11. DNSMON: monitoring root zone servers

12. DomainMON
- Up-to-date
performance
overview of your
DNS zone

13. DomainMON
- longitudinal
performance
overview of your
DNS zone

14. Root Server Performance
Performance
comparison between
TCP and UDP (ratio).

15. Which DNS root server instance is used by clients?
• measure "gravitational
radius" of root server
instances (for servers
employing anycasting)
• What is the latency of
different root server
instances?

16. Which root DNS server
instance is used by clients?
Example: Some South African client
experiences 482ms response time to
Sydney versus 39ms response time to
Cape Town

17. • Query for popular domain names to hit caches and local
resolvers where appropriate
Measuring end-user DNS experience?

18. DNS Latency
Visualization:
List latencies to a DNS
server per probe

19. DNS Latency
Visualization:
Latency-color-coded map of
probes

20. compare: 15ms versus 361ms DNS latency

21. • Compare multiple
latency trends to
resolvers
• Charts updated in
real time as data
is received from
the probes
LatencyMON

22. RIPE Atlas live streaming (https://atlas.ripe.net/docs/result-streaming/,
http://sg-pub.ripe.net/demo-area/atlas-stream/conn/ )
Receive measurement results as
soon as they are sent by the
probes
- Real-time connectivity monitoring
- Publish/subscribe through web
sockets
Three types of data:
- Measurement results
- Probe connection status events
- Measurements metadata

23. The Root Canary
• Measuring and monitoring the impact of the KSK rollover
• Track operational impact of the root KSK
• Measure validation during the KSK rollover from a global
perspective
• Gain immediate insight into which operators have
validation problems
• Monitor the state of DNSSEC validation from multiple
angles
• Ripe Atlas probes + test validation
• using signed and bogus records

24. Validation status based on RIPE Atlas probes that have
successfully executed tests (https://portal.rootcanary.org/rcmstats.html )

25. ~ 0.6% validation
failures

26. • Monitoring DNS Propagation Time / DNS Consistency
• monitoring SOA timestamp propagation time
• looking at the moment when a change is made by one of the registrars,
and following how quickly these changes propagate.
• DNS resolver hijack checker
• how do we protect from “bad actors” on the Internet? How do we know
that DNS resolution is coming from the “proper” place?
• use RIPE Atlas probes to query a pre-set DNS record on your own server,
and use a public DNS resolver with known IP addresses; match the
responses; mark the probes that show inconsistent responses.
• Reverse DNS statistics
• dig into reverse DNS data: what percentage of delegations has issues
(lame), latency in domain object creation, coverage of address space with
reverse delegations.
Other DNS Use Cases (From Ripe Atlas Hackathon:
https://labs.ripe.net/Members/becha/results-dns-measurements-hackathon )

27. Web Interface Measurements (https://atlas.ripe.net/measurements/form/ )

28. RIPE Atlas Cousteau
• A python wrapper around RIPE Atlas API
- https://github.com/RIPE-NCC/ripe-atlas-cousteau
- pip install ripe.atlas.cousteau
• Manage measurements:
- Create a measurement
- Stop a measurement - Change probes involved
• Fetch results from API, streaming and probes

29. RIPE Atlas
Cousteau
+ Python

30. More about Ripe Atlas
• Atlas Tools: https://atlas.ripe.net/measurements-and-tools/tools/
• RESTfulAPI –
https://atlas.ripe.net/docs/measurement-creation-api/
• Atlas API description – https://atlas.ripe.net/docs/rest/
• AtlasAPI tutorial –
https://atlas.ripe.net/docs/measurement-creation-api/
• Public measurements – https://atlas.ripe.net/measurements/
• Map of results – https://atlas.ripe.net/results/maps/
• List of probes – https://atlas.ripe.net/probes/
• Geographical mapsof probes –
https://atlas.ripe.net/results/maps/network-coverage/

31. AFRINIC-27
27 November to 2nd
December 2017
Lagos, Nigeria
AFRICOMM 2017
International Workshop on Internet
Measurements Research in Africa
DECEMBER 11–12, 2017 | LAGOS,
NIGERIA
http://africommconference.org/2017/show/IMRA
Upcoming Internet Measurements Workshops