A Look at the ECS Behavior of DNS Resolvers

Al-Dalky, Rami; Rabinovich, Michael; Schomp, Kyle

doi:10.1145/3355369.3355586

Cited by 15 publications

(8 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The recursive resolver also uses the scope netmask to help with caching an answer; based on the documentation, the answer from an ECS query with a scope netmask indicates the scope under which the answer is valid, and the recursive can proceed with caching the answer for the clients under the specified netmask. The caching behavior and the potential issues that can arise from it are further discussed in [7]. Finally, the discovery process of ECS authorities by the resolvers varies but usually relies on the recursive resolver sending ECS enabled queries and observing if the authority responds with a scope netmask, in most cases.…”

Section: A Evolution Of Dns With Ecsmentioning

confidence: 99%

“…Streibelt et al [43] demonstrate how one could utilize ECS-enabled authorities to uncover details about the infrastructure of an ECS-enabled zone and how it is being used by the owner. Recently, Al-Dalky et al [7] study a more specific aspect of ECS that has to do with the caching behavior of DNS resolvers when it comes to ECS enabled answers and the variety of different caching behaviors that can be examined. Our work focuses on a long-term study of the behavior and adoption of ECS.…”

Section: Related Workmentioning

confidence: 99%

“…In step (1), a stub resolver, located at the client, sends a request to a recursive DNS server, often simply referred to as the "recursive." If a cached answer is not available, the recursive iteratively queries other servers in the DNS hierarchy until it reaches the authoritative DNS server (referred to as authority throughout the paper) that can answer the current request, as seen in steps (2) to (7). Finally, in step (8), the recursive forwards the response from the authority to the stub resolver and caches the response for a period of time dictated by the response's time-to-live field.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Understanding the Growth and Security Considerations of ECS

Kountouras

Kintis

Avgetidis³

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

The Domain Name System (DNS) is fundamental to communication on the Internet. Therefore, any proposed changes or extensions to DNS can have profound consequences on network communications. In this paper, we explore the implications of a recent extension to DNS called EDNS Client Subnet (ECS). This extension extends the visibility of client information to more domain operators by providing a prefix of a client's IP address to DNS nameservers above the recursive nameserver. This raises numerous questions about the impact of such changes on network communications that rely on DNS. In this paper, we present the results of a longitudinal study that measures the deployment of ECS using several DNS vantage points. We show that, despite being an optional extension, ECS has seen steady adoption over time-even for sites that do not benefit from its use. Additionally, we observe that the client subnet provided by ECS may provide less privacy than originally thought, with most subnets corresponding to a /24 CIDR or smaller. Lastly, we observe several positive and negative consequences resulting from the introduction of DNS. For example, DNS can help aid security efforts when analyzing DNS data above the recursive due to the addition of client network information. However, that same client information has the potential to exacerbate existing security issues like DNS leakage. Ultimately, this paper discusses how small changes to fundamental protocols can result in unintended consequences that can be both positive and negative.

show abstract

Section: A Evolution Of Dns With Ecsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Understanding the Growth and Security Considerations of ECS

Kountouras

Kintis

Avgetidis³

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Typically, this server selection is done when the client issues the DNS request for resolving the hostname to an IP. Thus, the Hypergiant can use information about the client, i.e., via the source IP address of the DNS request or the client prefix contained in the EDNS Client Subnet (ECS) extension [1,5,14,17,21].…”

Section: Introductionmentioning

confidence: 99%

Enabling Multi-hop ISP-Hypergiant Collaboration

Munteanu

Gasser

Poese³

et al. 2023

Proceedings of the Applied Networking Research Workshop

View full text Add to dashboard Cite

Today, there is an increasing number of peering agreements between Hypergiants and networks that benefit millions of end-user. However, the majority of Autonomous Systems do not currently enjoy the benefit of interconnecting directly with Hypergiants to optimally select the path for delivering Hypergiant traffic to their users.In this paper, we develop and evaluate an architecture that can help this long tail of networks. With our proposed architecture, a network establishes an out-of-band communication channel with Hypergiants that can be two or more AS hops away and, optionally, with the transit provider. This channel enables the exchange of network information to better assign requests of end-users to appropriate Hypergiant servers. Our analysis using operational data shows that our architecture can optimize, on average, 15% of Hypergiants' traffic and 11% of the overall traffic of networks that do not interconnect with Hypergiants. The gains are even higher during peak hours when available capacity can be scarce, up to 46% for some Hypergiants.

show abstract

“…A detailed study of the ECS behavior [61] warns careful use of the mapping system as it could worsen the performance in certain situations. [62] proposes a hybrid scheme in which a DNS redirection scheme is used only for clients that suffer from poor anycast routing.…”

Section: Performance Of Content Delivery Networkmentioning

confidence: 99%

Understanding the internet AS topology and its applications

Kabala¹

View full text Add to dashboard Cite

show abstract

A Look at the ECS Behavior of DNS Resolvers

Cited by 15 publications

References 14 publications

Understanding the Growth and Security Considerations of ECS

Understanding the Growth and Security Considerations of ECS

Enabling Multi-hop ISP-Hypergiant Collaboration

Understanding the internet AS topology and its applications

Contact Info

Product

Resources

About