1. 2: Application Layer1 Chapter 2 Application Layer Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 Part 4: DNS

2. 2: Application Layer2 Chapter 2: Application layer r 2.1 Principles of network applications r 2.2 Web and HTTP r 2.3 FTP r 2.4 Electronic Mail  SMTP, POP3, IMAP r 2.5 DNS r 2.6 P2P applications r 2.7 Socket programming with UDP r 2.8 Socket programming with TCP

3. 2: Application Layer3 DNS: Domain Name System People: many identifiers:  SSN, name, passport # Internet hosts, routers:  IP address (32 bit) - used for addressing datagrams  “name”, e.g., ww.yahoo.com - used by humans Q: map between IP addresses and name ? Domain Name System: r distributed database implemented in hierarchy of many name servers r application-layer protocol host, routers, name servers to communicate to resolve names (address/name translation)  note: core Internet function, implemented as application-layer protocol  complexity at network’s “edge”

4. 2: Application Layer4 DNS Why not centralize DNS? r single point of failure r traffic volume r distant centralized database r maintenance A: doesn’t scale! DNS services r hostname to IP address translation r host aliasing  Canonical, alias names r mail server aliasing r load distribution  replicated Web servers: set of IP addresses for one canonical name

5. DNS lookups  nslookup command searches for IP address nslookup [-opt...] # interactive mode using default server nslookup [-opt...] – server # interactive mode using ‘server’ nslookup [-opt...] host # just look up ‘host’ using default server nslookup [-opt...] host server # just look up ‘host’ using ‘server’ 2: Application Layer5

6. DNS lookups r Examples: nslookup google.comgoogle.com Server:172.30.0.12 Address:172.30.0.12#53 Non-authoritative answer: Name:google.com Address: 173.194.121.39 Name:google.com Address: 173.194.121.41 Name:google.com Address: 173.194.121.35 Name:google.com … 2: Application Layer6 Addresses of the google servers Address of the DNS server There are lots more!

7. Name Service (DNS) Names translated into addresses, where the numbers 1–5 show the sequence of steps in the process how do you think this works?

8. r Domain Hierarchy  DNS implements a hierarchical name space for Internet objects. DNS names are processed from right to left and use periods as the separator. e.g. www.google.com is processed aswww.google.com –.com –google –www  the DNS hierarchy can be visualized as a tree, each node in the tree corresponds to a domain, the leaves in the tree correspond to the hosts being named. Infrastructure Services

9. r Domain Hierarchy Infrastructure Services Example of a domain hierarchy A domain is simply a context in which additional names can be defined.

10. r Name Servers  The complete domain name hierarchy exists only in the abstract.  partition the hierarchy into subtrees called zones. Each zone can be thought of as corresponding to some administrative authority that is responsible for that portion of the hierarchy. For example, the top level of the hierarchy forms a zone that is managed by the Internet Corporation for Assigned Names and Numbers (ICANN). Infrastructure Services Possible zones

11. r Name Servers  Corresponds to a zone  Fundamental unit of implementation in DNS  The information in each zone is implemented in two or more name servers  A server could contain information from several zones  Redundancy is good!  Each name server is a program that can be accessed over the internet  Clients query the server; server responds Could give the requested info Could contain a pointer to another server Infrastructure Services

12. DNS is really implemented by a hierarchy of name servers. DNS

13. r Name Servers  Each name server implements the zone information as a collection of resource records.  In essence, a resource record is a name-to-value binding, or more specifically a 5-tuple that contains the following fields: Infrastructure Services

14. 2: Application Layer14 Root DNS Servers com DNS servers org DNS serversedu DNS servers poly.edu DNS servers umass.edu DNS servers yahoo.com DNS servers amazon.com DNS servers pbs.org DNS servers Distributed, Hierarchical Database Client wants IP for www.amazon.com; 1 st approx: r client queries a root server to find.com DNS server r client queries.com DNS server to get amazon.com DNS server r client queries amazon.com DNS server to get IP address for www.amazon.com

15. 2: Application Layer15 DNS: Root name servers r contacted by local name server that can not resolve name r root name server:  contacts authoritative name server if name mapping not known  gets mapping  returns mapping to local name server 13 root name “servers” worldwide a. Verisign, Los Angeles CA (5 other sites) b. USC-ISI Marina del Rey, CA l. ICANN Los Angeles, CA (41 other sites) e. NASA Mt View, CA f. Internet Software C. Palo Alto, CA (and 48 other sites) i. Netnod, Stockholm (37 other sites) k. RIPE London (17 other sites) m. WIDE Tokyo (5 other sites) c. Cogent, Herndon, VA (5 other sites) d. U Maryland College Park, MD h. ARL Aberdeen, MD j. Verisign, Dulles VA (69 other sites ) g. US DoD Columbus, OH (5 other sites)

16. 2: Application Layer16 TLD and Authoritative Servers r Top-level domain (TLD) servers:  responsible for com, org, net, edu, etc, and all top-level country domains uk, fr, ca, jp.  Network Solutions maintains servers for.com TLD  Educause for.edu TLD r Authoritative DNS servers:  organization’s DNS servers, providing authoritative hostname to IP mappings for organization’s servers (e.g., Web, mail).  can be maintained by organization or service provider

17. 2: Application Layer17 Local Name Server r does not strictly belong to hierarchy r each ISP (residential ISP, company, university) has one.  also called “default name server” r when host makes DNS query, query is sent to its local DNS server  acts as proxy, forwards query into hierarchy

18. 2: Application Layer18 requesting host cis.poly.edu gaia.cs.umass.edu root DNS server local DNS server dns.poly.edu 1 2 3 4 5 6 authoritative DNS server dns.cs.umass.edu 7 8 TLD DNS server DNS name resolution example r Host at cis.poly.edu wants IP address for gaia.cs.umass.edu iterated query: r contacted server replies with name of server to contact r “I don’t know this name, but ask this server”

19. 2: Application Layer19 requesting host cis.poly.edu gaia.cs.umass.edu root DNS server local DNS server dns.poly.edu 1 2 4 5 6 authoritative DNS server dns.cs.umass.edu 7 8 TLD DNS server 3 recursive query: r puts burden of name resolution on contacted name server r heavy load at upper level of hierarchy? DNS name resolution example

20. 2: Application Layer20 DNS: caching and updating records r once (any) name server learns mapping, it caches mapping  cache entries timeout (disappear) after some time  TLD servers typically cached in local name servers Thus root name servers not often visited r cached entries may be out-of-date (best effort name-to- address translation!)  if name host changes IP address, may not be known Internet- wide until all TTLs expire r update/notify mechanisms under design by IETF  RFC 2136  http://www.ietf.org/html.charters/dnsind-charter.html

21. 2: Application Layer21 DNS records DNS: distributed db storing resource records (RR) r Type=NS  name is domain (e.g. foo.com)  value is hostname of authoritative name server for this domain RR format: (name, value, type, ttl) r Type=A  name is hostname  value is IP address r Type=CNAME  name is alias name for some “canonical” (the real) name www.ibm.com is really servereast.backup2.ibm.com  value is canonical name r Type=MX  value is name of mailserver associated with name

22. 2: Application Layer22 DNS protocol, messages DNS protocol : query and reply messages, both with same message format msg header r identification: 16 bit # for query, reply to query uses same # r flags:  query or reply  recursion desired  recursion available  reply is authoritative

23. 2: Application Layer23 DNS protocol, messages Name, type fields for a query RRs in response to query records for authoritative servers additional “helpful” info that may be used

24. 2: Application Layer24 Inserting records into DNS r example: new startup “Network Utopia” r register name networkuptopia.com at DNS registrar (e.g., Network Solutions)  provide names, IP addresses of authoritative name server (primary and secondary)  registrar inserts two RRs into com TLD server: (networkutopia.com, dns1.networkutopia.com, NS) (dns1.networkutopia.com, 212.212.212.1, A) r create authoritative server Type A record for www.networkuptopia.com; Type MX record for networkutopia.com r How do people get IP address of your Web site?

25. Attacking DNS DDoS attacks r Bombard root servers with traffic  Not successful to date  Traffic Filtering  Local DNS servers cache IPs of TLD servers, allowing root server bypass r Bombard TLD servers  Potentially more dangerous Redirect attacks  Man-in-middle  Intercept queries  DNS poisoning  Send bogus relies to DNS server, which caches Exploit DNS for DDoS  Send queries with spoofed source address: target IP  Requires amplification Application Layer 2- 25