DNS latency is a concern for many service operators: CDNs exist to
reduce service latency to end-users but must rely on global DNS for
reachability and load-balancing. Today, DNS latency is monitored by
active probing from distributed platforms like RIPE Atlas, with
Verfploeter, or with commercial services. While Atlas coverage is
wide, its 10k sites see only a fraction of the Internet. In this
paper we show that passive observation of TCP handshakes can measure
\emph{live DNS latency, continuously, providing good coverage of
current clients of the service}. Estimating RTT from TCP is an old
idea, but its application to DNS has not previously been studied
carefully. We show that there is sufficient TCP DNS traffic today to
provide good operational coverage (particularly of IPv6), and very
good temporal coverage (better than existing approaches), enabling
near-real time evaluation of DNS latency from \emph{real clients}. We
also show that DNS servers can optionally solicit TCP to broaden
coverage. We quantify coverage and show that estimates of DNS latency
from TCP is consistent with UDP latency. Our approach finds
previously unknown, real problems: \emph{DNS polarization} is a new
problem where a hypergiant sends global traffic to one anycast site
rather than taking advantage of the global anycast deployment.
Correcting polarization in Google DNS cut its latency from 100ms to
10ms; and from Microsoft Azure cut latency from 90ms to 20ms.
We also show other instances of routing problems that add 100--200ms
latency. Finally, \emph{real-time} use of our approach for a European
country-level domain has helped detect and correct a BGP routing
misconfiguration that detoured European traffic to Australia. We have
integrated our approach into several open source tools: Entrada, our
open source data warehouse for DNS, a monitoring tool (ANTS), which
has been operational for the last 2 years on a country-level top-level
domain, and a DNS anonymization tool in use at a root server since
March 2021.
more »
« less
MAnycast2: Using Anycast to Measure Anycast
Anycast addressing - assigning the same IP address to multiple, distributed devices - has become a fundamental approach to improving the resilience and performance of Internet services, but its conventional deployment model makes it impossible to infer from the address itself that it is anycast. Existing methods to detect anycast IPv4 prefixes present accuracy challenges stemming from routing and latency dynamics, and efficiency and scalability challenges related to measurement load. We review these challenges and introduce a new technique we call "MAnycast2" that can help overcome them. Our technique uses a distributed measurement platform of anycast vantage points as sources to probe potential anycast destinations. This approach eliminates any sensitivity to latency dynamics, and greatly improves efficiency and scalability. We discuss alternatives to overcome remaining challenges relating to routing dynamics, suggesting a path toward establishing the capability to complete, in under 3 hours, a full census of which IPv4 prefixes in the ISI hitlist are anycast.
more »
« less
- NSF-PAR ID:
- 10204793
- Date Published:
- Journal Name:
- IMC '20: Proceedings of the ACM Internet Measurement Conference
- Page Range / eLocation ID:
- 456 to 463
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
The key to optimizing the performance of an anycast-based sys- tem (e.g., the root DNS or a CDN) is choosing the right set of sites to announce the anycast prefix. One challenge here is predicting catchments. A naïve approach is to advertise the prefix from all subsets of available sites and choose the best-performing subset, but this does not scale well. We demonstrate that by conducting pairwise experiments between sites peering with tier-1 networks, we can predict the catchments that would result if we announce to any subset of the sites. We prove that our method is effective in a simplified model of BGP, consistent with common BGP routing policies, and evaluate it in a real-world testbed. We then present AnyOpt, a system that predicts anycast catchments. Using AnyOpt, a network operator can find a subset of anycast sites that minimizes client latency without using the naïve approach. In an experiment using 15 sites, each peering with one of six transit providers, AnyOpt predicted site catchments of 15,300 clients with 94.7% accuracy and client RTTs with a mean error of 4.6%. AnyOpt identified a subset of 12 sites, announcing to which lowers the mean RTT to clients by 33ms compared to a greedy approach that enables the same number of sites with the lowest average unicast latency.more » « less
-
IP anycast is used for services such as DNS and Content Delivery Networks (CDN) to provide the capacity to handle Distributed Denial-of-Service (DDoS) attacks. During a DDoS attack service operators redistribute traffic between anycast sites to take advantage of sites with unused or greater capacity. Depending on site traffic and attack size, operators may instead concentrate attackers in a few sites to preserve operation in others. Operators use these actions during attacks, but how to do so has not been described systematically or publicly. This paper describes several methods to use BGP to shift traffic when under DDoS, and shows that a \emph{response playbook} can provide a menu of responses that are options during an attack. To choose an appropriate response from this playbook, we also describe a new method to estimate true attack size, even though the operator's view during the attack is incomplete. Finally, operator choices are constrained by distributed routing policies, and not all are helpful. We explore how specific anycast deployment can constrain options in this playbook, and are the first to measure how generally applicable they are across multiple anycast networks.more » « less
-
We investigate the problem of dynamic routing and spectrum assignment for advance reservation anycast requests using a novel algorithm called Delayed Spectrum Allocation (DSA) which delays allocation of resources until immediately before transmission begins. We evaluate the flexible window STSD (demands that specify start-time and duration) to further improve request blocking. Through extensive simulation results, we show that anycast with flexible STSD using DSA approach can significantly reduce blocking probability of anycast and unicast requests compared to traditional Immediate Spectrum Allocation (ISA). The improvement is up to 50 percent in unicast traffic and even higher in anycasting. We also propose balanced routing for anycast algorithms to reduce the blocking.more » « less
-
IP addresses are commonly used to identify hosts or properties of hosts. The address assigned to a host may change, however, and the extent to which these changes occur in time as well as in the address space is currently unknown, especially in IPv6. In this work, we take a first step towards understanding the dynamics of IPv6 address assignments in various networks around the world and how they relate to IPv4 dynamics. We present fine-grained observations of dynamics using data collected from over 3,000 RIPE Atlas probes in dual-stack networks. RIPE Atlas probes in these networks report both their IPv4 and their IPv6 address, allowing us to track changes over time and in the address space. To corroborate and extend our findings, we also use a dataset containing 32.7 billion IPv4 and IPv6 address associations observed by a major CDN. Our investigation of temporal dynamics with these datasets shows that IPv6 assignments have longer durations than IPv4 assignments---often remaining stable for months---thereby allowing the possibility of long-term fingerprinting of IPv6 subscribers. Our analysis of spatial dynamics reveals IPv6 address-assignment patterns that shed light on the size of the address pools network operators use in domestic networks, and provides preliminary results on the size of the prefixes delegated to home networks. Our observations can benefit many applications, including host reputation systems, active probing methods, and mechanisms for privacy preservation.more » « less
- Free Publicly Accessible Full Text
-
Accepted Manuscript1.0
- Conference Paper:
- https://doi.org/10.1145/3419394.3423646
