PDF《Open Resolvers in COM/NET》

120 times in Oct

2013 survey! ??

1109 times in May

2014 survey! Verisign Public! Weirdness: R2 not from Target! ?? Sent query to x.x.x.x! ?? Got response from y.y.y.y! ! Prober! Auth! NS! Target! Forwarder! ?! Oct 2013! May 2014! IP'Changed' 2.1'%' 2.4'%' Verisign Public! Weirdness: Local Port Changed! ?? Query sent from port X! ?? Response sent to port Y! ??

1560 cases! ! Prober! Auth! NS! Target! Forwarder! X! Y! Oct 2013! May 2014! Local'Port' 1560' 4936' Verisign Public! Weirdness: Remote Port Changed! ?? Query to port 53! ?? Response from port != 53! ! Prober! Auth! NS! Target! Forwarder! 53! 12345! Oct 2013! May 2014! Remote'Port' 46.2'%' 46.7'%' Verisign Public! Weirdness: Q2 with RD=1! ?? Usually queries to Authoritative name servers have RD=0! ! Prober! Auth! NS! Target! Forwarder! RD=1! Oct 2013! May 2014! Q2'RD=1' 6079' 5186' Verisign Public! Weirdness: R2 with AA=1! ?? Usually responses from recursive name servers have AA=0! ! Prober! Auth! NS! Target! Forwarder! AA=1! Oct 2013! May 2014! R2'AA=1' 0.7'%' 0.8'%' Verisign Public! Intersection with ? COM/NET Queriers! Verisign Public! ?? Four Verisign "big" sites! ?? Only

4 of

13 gtld-servers.net letters! COM/NET Query Data! Site! Server! Amsterdam! h.gtld-servers.net! Wash DC! l.gtld-servers.net! New York! c.gtld-servers.net! San Francisco! g.gtld-servers.net! Verisign Public! ?? What percent of open resolver exit Ips appear in the COM/NET query data?! ?? Example: At Amsterdam, we see 64.3% of the open resolvers IPs in one day. This is 5.2% of all COM/NET IPs seen there. Those IPs are responsible for 51.7% of COM/ NET queries at the site.! Intersection of open resolvers and COM/NET? (Oct 2013)! Site! %OR IPs! %COM/NET IPs! %COM/NET Queries! Amsterdam! 64.3! 5.2! 51.7! Wash DC! 66.4! 5.5! 48.4! New York! 66.2! 5.2! 46.2! San Francisco! 64.6! 5.4! 45.2! Verisign Public! Percent of Open Resolver Exit IPs found in COM/NET Queries 10_28 10_29 10_30 10_31 11_01 11_02 11_03

0 10

20 30

40 50

60 70 ams1 iad3 nyc3 sfo1 Verisign Public! Percent of COM/NET query IPs found in Open Resolvers 10_28 10_29 10_30 10_31 11_01 11_02 11_03

0 1

2 3

4 5

6 ams1 iad3 nyc3 sfo1 Verisign Public! Percent of COM/NET queries coming from Open Resolver IPs 10_28 10_29 10_30 10_31 11_01 11_02 11_03

0 10

20 30

40 50

60 ams1 iad3 nyc3 sfo1 Verisign Public! Intersection of open resolvers and COM/NET? (May 2014)! Site! %OR IPs! %COM/NET IPs! %COM/NET Queries! Amsterdam (H)! 59.4! 4.8! 57.2! Wash DC (L)! 61.3! 4.8! 50.6! New York (C)! down for maintenance! San Francisco (G)! 59.2! 4.9! 47.4! Verisign Public! Geographic Distribution? ! Verisign Public! ?? Open resolvers are massively distributed! ??

232 countries (including special territories)! ?? 10,240 different cities! ?? 13,887 different organizations (including ISPs)! ?? 83,407 different networks (domains)! ! ?? All distributions are heavy tailed (city, org, net, country)! ! ?? Open resolvers/forwarder associations are distributed! ?? Includes across country associations! ?? Not only limited to well-understood applications, but includes service providers association without territory resolvers! Open Resolvers Geographical Distribution! Verisign Public! Open Resolvers Geographical Distribution! Verisign Public! ?? Per-user distribution is consistent with overall per-country, except in a few cases (small, hop countries)! Open Resolvers vs. Internet Usage! Verisign Public! Organization Level Distribution C Resolvers ! 0! 500000! 1000000! 1500000! 2000000! 2500000! 3000000! Verisign Public! Organization Level Distribution C Open Resolvers Per Forwarder! 0! 5000! 10000! 15000! 20000! 25000! 30000! Verisign Public! Organization Level Distribution - log10(Forwarders)! 0! 0.5! 1! 1.5! 2! 2.5! 3! 3.5! 4! 4.5! Verisign Public! Final Thoughts? ! Verisign Public! Key Points! ?? Still many millions of Open Resolvers on the Internet! ?? The trend is decreasing! ?? Most Open Resolvers forward to another recursive! ?? About half respond from the wrong port!! ?? Open Resolver forwarder IPs are strongly linked to COM/ NET queries.! ?? Responsible for 50% of the query traf?c! 42! Verisign Public! Questions?!