How DNS Misnaming Distorts Internet Topology Mapping Ming Zhang, Microsoft Research Yaoping Ruan, IBM Research Vivek Pai, Jennifer Rexford, Princeton University

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC2 June 3, 2006 Basic Traceroute % traceroute -n ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms ms

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC3 June 3, 2006 Reverse DNS Lookups % traceroute 1 ignition ( ) ms 2 targe ( ) ms 3 csgate ( ) ms 4 gigagate1.Princeton.EDU ( ) ms 5 vgate1.Princeton.EDU ( ) ms 6 tcggate.Princeton.EDU ( ) ms ( ) ms 8 tbr2-p n54ny.ip.att.net ( ) ms 9 ggr3-g90.n54ny.ip.att.net ( ) ms 10 0.so BR1.NYC4.ALTER.NET ( ) ms 11 0.so XL1.NYC4.ALTER.NET ( ) ms 12 0.so XL1.SFO4.ALTER.NET ( ) ms 13 POS4-0.XR1.SFO4.ALTER.NET ( ) ms ATM7-0.GW4.SFO4.ALTER.NET ( ) ms 15 usenix-gw.customer.alter.net ( ) ms n54ny.ip.att XL1.SFO4.ALTER tbr2-p n54ny.ip.att.net ggr3-g90.n54ny.ip.att.net 0.so BR1.NYC4.ALTER.NET 0.so XL1.NYC4.ALTER.NET 0.so XL1.SFO4.ALTER.NET POS4-0.XR1.SFO4.ALTER.NET 191.ATM7-0.GW4.SFO4.ALTER.NET

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC4 June 3, 2006 Network Debugging & Research DNS now a critical tool, errors problematic For humans  annoying  Assuming you can detect it For mapping  small problems  Relatively contained For derived data  magnified problems  “Worst” problems can be fictional

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC5 June 3, 2006 Automating the Process Generate large number of traceroutes  e.g., use PlanetLab and/or ScriptRoute Extract geography from names  undns tool from RocketFuel  Understands conventions for tons of ISPs Merge cities into POPs Now, reverse-engineer paths, peering decisions, routing, etc.

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC6 June 3, 2006 DNS Misnaming Problems Reverse DNS names not critical for ISP  Especially in routers – debugging tool  Often no forward DNS mapping Reasons for misnaming  Router gets moved  Linecards swapped (IP per linecard)  Reuse old IP addresses  Peering ISPs share IP addresses

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC7 June 3, 2006 POP Loops & False Edges

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC8 June 3, 2006 Extra Inter-POP Links

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC9 June 3, 2006 Data Collection In-house version of traceroute 132 nodes on PlanetLab 259,343 routable address blocks  From all prefixes in current BGP tables 20 hours on March 30, 2005 Data parsing: IP address DNS lookup DNS names POP names Geo location undns rules Yahoo maps

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC10 June 3, 2006 Resolving POP-level loop Greedy algorithm:  Get all fishy IPs  Pick IP that Resolves most loops Rarely appears good  Remove IP’s loops, report IP  Repeat The correct location of a misnamed IP is decided by voting based on its neighbors

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC11 June 3, 2006 Heuristics: 01/10 Rule IP1 Boston IP3 x.x.x.149 St Louis IP2 SF IP4 x.x.x.150 New York IP5 New York IP6 New York Given IP1, IP2, and IP3 Infer IP4 from IP3 If POPs for IP4, IP2 disagree: Vote among interfaces on same router (IP4, IP5, and IP6)

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC12 June 3, 2006 Case Study Results Large ISP, 100+ POPs 1,957 POP-level loops  IP1, 2, 3, 4 Router level discrepancy  IP5, 6 Missed  IP7, 8 9  Small POPs with 1 neighbor

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC13 June 3, 2006 Impact on Previous Work Impact on topology mapping  11% of inferred edges are false edges  More reliable than speed-of-light only approach Impact on path inflation studies

Zhang, Ruan, Pai, Rexford - USENIX 2006 ATC14 June 3, 2006 Conclusion DNS misnaming can be serious for network researchers We study two heuristics to identify and fix the wrong names Case study confirms the effectiveness of our approach