Chapter 2, Section 4: DNS (Domain Name System)
type=CNAME
name is alias name for some "canonical" (the real) name value is canonical name
type=NS
name is domain (ex. foo.com) value is hostname of authoritative name server for this domain
DNS: caching,updating records
once (any) name server learns mapping,it caches mapping-cache entries timeout (disappear) after some time (TTL) TLD servers typically cached in local name servers.-thus root name servers not often visited cached entries may be out-of-date (best effort name-to-address translation!)- if name host changes IP address,may not be known internet-wide until all TTLs expire update/notify mechanisms proposed IETF standard :RFC 2136
DNS Records
distributed database storing resource records (RR)
Local DNS name server
does not strictly belong to hierarchy each ISP (residential ISP,company,university) has one. also called "default name server" when host makes DNS query,query is sent to its local DNS server has local cache of recent name-to-address translation pairs(but may be out of date!) acts as proxy,forwards query into hierarchy
Authoritative DNS servers:
organization's own DNS server(s) ,providing authoritative hostname to IP mappings for organization's named hosts can be maintained by organization or service provider
Recursive query
puts burden of name resolution on contacted name server heavy load at upper levels of hierarchy
DNS protocol messages
query and reply messages both with same message format
Top-level domain (TLD) servers:
responsible for com,org,net,edu, aero, jobs, museums, and all top-level country domains, ex.:uk, fr,ca, jp Network Solutions maintains servers for .com TLD Educause for .edu TLD.
Exploit DNS for DDoS
send queries with spoofed source address: target IP requires amplification
why not centralize DNS?
single point of failure. traffic volume. distant centralized database. maintenance.
type=A
name is hostname value is IP address
redirect attacks
man-in-middle: intercept queries DNS poisoning: send bogus relies to DNS server ,caches
Domain Name System:
Distributed database implemented in hierarchy of many name servers application-layer protocol:hosts,name servers communicate to resolve names (address/name translation) - core Internet function,implemented as application-layer protocol. complexity at network's "edge"
DDoS attacks
bombard root servers with traffic: not successful to date traffic filtering local DNS servers cache IPs of TLD servers,allowing root server bypass bombard TLD servers: potentially more dangerous
Iterated query
contacted server replies with name of server to contact
DNS Services
hostname to IP address translation. host aliasing-canonical,alias names mail server aliasing load distribution replicated web servers: many IP addresses correspond to one name.
type=MX
value is name of mailserver associated wit name