1. Evaluation of the Proximity between Web Clients and their Local DNS Servers Z. Morley Mao UC Berkeley (zmao@eecs.berkeley.edu) C. Cranor, M. Rabinovich, O. Spatscheck, and J. Wang AT&T Labs-Research F. Douglis IBM Research

2. Motivation Content Distribution Networks (CDNs) Attempt to deliver content from servers close to users Internet Clients Cache server Origin servers Cache server

3. DNS based server selection Originator problem Assumes that clients are close to their local DNS servers Verify the assumption that clients are close to their local DNS servers Client.myisp.net Local DNS Server ns.myisp.net Authoritative DNS server ns.service.com A.GTLD-SERVERS.NET www.service.com? ns.service.com www.service.com? Server IP address

4. Measurement setup Three components 1x1 pixel embedded transparent GIF image http://xxx.rd.example.com/tr.gif A specialized authoritative DNS server Allows hostnames to be wild-carded An HTTP redirector Always responds with “302 Moved Temporarily” Redirect to a URL with client IP address embedded www.att.com 1x1 transparent GIF

5. Embedded image request sequence Client [10.0.0.1] Redirector for xxx.rd.example.com Local DNS server Content server for the image Name server for *.cs.example.com 1. HTTP GET request for the image 2. HTTP redirect to IP10-0-0-1.cs.example.com 3. Request to resolve IP10-0-0-1.cs.example.com 4. Request to resolve IP10-0-0-1.cs.example.com 5. Reply: IP address of content server 6. Reply: content server IP address 7. HTTP GET request for the image 8. HTTP response

6. Measurement Data SiteParticipantImage hit count Duration 1att.com20,816,9272 months 2,3Personal pages (commercial domain)1,7433 months 4AT&T research212,8143 months 5-7University sites4,367,0763 months 8-19Personal pages (university domain)26,5633 months

7. Measurement statistics Data typeCount Unique client-LDNS associations4,253,157 HTTP requests25,425,123 Unique client IPs3,234,449 Unique LDNS IPs157,633 Client-LDNS associations where Client and LDNS have the same IP address56,086

8. Proximity metrics: AS clustering Network clustering Traceroute divergence Roundtrip time correlation

9. AS clustering Autonomous System (AS) A single administrative entity with unified routing policy Observes if client and LDNS belong to the same AS

10. Network clustering [Krishnamurthy,Wang sigcomm00] Based on BGP routing information using the longest prefix match Each prefix identifies a network cluster Observes if client and LDNS belong to the same network cluster

11. Traceroute divergence Probe machine client Local DNS server [Shaikh et al. infocom00] Use the last point of divergence Traceroute divergence: Max(3,4)=4 1 2 3 4 1 2 3 a b

12. Roundtrip time correlation Correlation between message roundtrip times from a probe site to the client and its LDNS server The probe site represents a potential cache server location A crude metric, highly dependent on the probe site

13. Aggregate statistics of AS/network clustering More than 13,000 ASes Close to 75% total ASes 440,000 unique prefixes Close to 25% of all possible network clusters  We have a representative data set Metrics# client clusters # LDNS clusters Total # clusters AS clustering9,2158,5909,570 Network clustering98,00153,321104,950

14. Proximity analysis: AS, network clustering MetricsClient IPsHTTP requests AS cluster64%69% Network cluster16%24% AS clustering: coarse-grained Network clustering: fine-grained Most clients not in the same routing entity as their LDNS Clients with LDNS in the same cluster slightly more active

15. Proximity analysis: Traceroute divergence Probe sites: NJ(UUNET), NJ(AT&T), Berkeley(Calren), Columbus(Calren) Sampled from top half of busy network clusters Median divergence: 4 Mean divergence: 5.8-6.2 Ratio of common to disjoint path length 72%-80% pairs traced have common path at least as long as disjoint path

16. Improved local DNS configuration For client-LDNS associations not in the same cluster, do we know a LDNS in the client’s cluster? MetricsOriginalImprovedOriginalImproved AS cluster64%88%69%92% Network cluster16%66%24%70% Client IPsHTTP requests

17. Impact on commercial CDNs Data set Client-LDNS associations LDNS-CDN associations Available CDN servers Client w/ CDN server in cluster Verifiable clients: w/ responsive LDNS Misdirected clients: directed to a cache not in client’s cluster Clients with LDNS not in same cluster

18. Impact on commercial CDNs AS clustering CDNCDN XCDN YCDN Z Clients with CDN server in cluster 1,679,5151,215,372618,897 Verifiable clients1,324,022961,382516,969 Misdirected clients (% of verifiable clients) 809,683 (60%) 752,822 (77%) 434,905 (82%) Clients with LDNS not in client’s cluster (% of misdirected clients) 443,394 (55%) 354,928 (47%) 262,713 (60%)

19. Impact on commercial CDNs Network clustering CDNCDN XCDN YCDN Z Clients with cache server in cluster 264,743156,507103,448 Verifiable clients221,440132,56790,264 Misdirected clients (% of verifiable clients) 154,198 (68%) 125,449 (94%) 87,486 (96%) Clients with LDNS not in client’s cluster (% of misdirected clients) 145,276 (94%) 116,073 (93%) 84,737 (97%) Less than 10% of all clients

20. Conclusion Novel technique for finding client and local DNS associations Fast, non-intrusive, and accurate DNS based server selection works well for coarse-grained load-balancing 64% associations in the same AS 16% associations in the same network cluster Server selection can be inaccurate if server density is high

21. Related work Measurement methodology 1. IBM (Shaikh et al.) Time correlation of DNS and HTTP requests from DNS and Web server logs 2. Univ of Boston (Bestavros et al.) Assigning multiple IP addresses to a Web server Differences from our work: Our methodology: efficient, accurate, nonintrusive 3. Web bugs Proximity metrics Cisco’s Boomerang protocol: uses latency from cache servers to the LDNS