DNS

Computer
Networking: A Top
Down Approach
6th edition
Jim Kurose, Keith Ross
Addison-Wesley
March 2012

Application Layer 2-1

‫‪DNS‬‬

‫شبكات الكمبيوتر‪ :‬نهج‬

‫من أعلى إلى أسفل‪،‬‬
‫الطبعة السادسة جيم‬
‫كوروز‪ ،‬كيث روس‬
‫أديسون ويسلي مارس‬
‫‪2012‬‬

‫‪Application Layer 2-2‬‬

DNS: domain name system

people: many identifiers: Domain Name System:

▪ SSN, name, passport # ❖ distributed database
Internet hosts, routers: implemented in hierarchy of
▪ IP address (32 bit) - many name servers
used for addressing ❖ application-layer protocol:
datagrams hosts, name servers
▪ “name”, e.g., communicate to resolve
www.yahoo.com - names (address/name
used by humans translation)
note: core Internet function,
Q: how to map between IP implemented as application-layer
address and name, and protocol
vice versa ?
▪ complexity at network’s
“edge”

2-3
‫نظام اسم المجال ‪DNS:‬‬
‫األشخاص‪ :‬العديد من المعرفات‪:‬‬
‫‪▪ SSN, name, passport‬‬
‫مضيفي اإلنترنت وأجهزة التوجيه‪:‬‬
‫‪IP address (32 bit) -‬‬
‫تستخدم لمعالجة مخططات‬
‫البيانات‬
‫‪▪ “name”, e.g.,‬‬
‫‪www.yahoo.com -‬‬
‫‪used by humans‬‬
‫س ‪ :‬كيفية التعيين بين عنوان ‪IP‬‬
‫واالسم‪ ،‬والعكس؟‬
‫نظام اسم المجال ‪:‬‬
‫قاعدة البيانات الموزعة‬ ‫❖‬
‫يتم تنفيذها في التسلسل الهرمي للعديد من‬
‫خوادم األسماء‬
‫❖ بروتوكول طبقة التطبيق‪:‬‬
‫المضيفين‪ ،‬تتواصل خوادم األسماء لحل‬
‫األسماء (ترجمة العنوان‪/‬االسم)‬
‫ملحوظة‪ :‬وظيفة اإلنترنت األساسية‪ ،‬يتم‬
‫تنفيذها كبروتوكول طبقة التطبيق‪.‬‬
‫▪ التعقيد على "حافة" الشبكة‬
‫‪2-4‬‬
DNS: services, structure
DNS services why not centralize DNS?
❖ hostname to IP address single point of failure
translation ❖ traffic volume distant
❖ host aliasing canonical, alias centralized database
names maintenance
❖ mail server aliasing
❖ load distribution
▪ replicated Web servers: A: doesn’t scale!
many IP addresses
correspond to one
name

2-5
‫الخدمات والهيكل ‪DNS:‬‬
‫خدمات ‪DNS‬‬ ‫لماذا ال مركزية ‪DNS‬؟‬
‫اسم المضيف لترجمة عنوان ‪IP‬‬ ‫❖‬ ‫نقطة فشل واحدة‬
‫المضيف االسم المستعار الكنسي‪،‬‬ ‫❖‬ ‫❖ حجم حركة المرور البعيدة صيانة‬
‫األسماء المستعارة‬ ‫قاعدة البيانات المركزية‬
‫االسم المستعار لخادم البريد‬ ‫❖‬
‫توزيع الحمل‬ ‫❖‬
‫▪ خوادم الويب المنسوخة‪ :‬تتوافق‬
‫العديد من عناوين ‪ IP‬مع اسم واحد‬ ‫ال مقياس! ‪A:‬‬

‫‪2-6‬‬
DNS: a distributed, hierarchical database
Root DNS Servers

… …

com DNS servers org DNS servers edu DNS servers

pbs.org poly.edu umass.edu

yahoo.com amazon.com
DNS servers DNS serversDNS servers
DNS servers DNS servers

client wants IP for www.amazon.com; 1st approx:

❖ client queries root server to find com DNS server
❖ client queries .com DNS server to get amazon.com DNS server
❖ client queries amazon.com DNS server to get IP address for
www.amazon.com

2-7
DNS: ‫قاعدة بيانات موزعة وهرمية‬
Root DNS Servers

… …

com DNS servers org DNS servers edu DNS servers

pbs.org poly.edu umass.edu

yahoo.com amazon.com
DNS servers DNS serversDNS servers
DNS servers DNS servers

:‫؛ التقريبية األولى‬www.amazon.com ‫ لموقع‬IP ‫يريد العميل عنوان‬

com DNS ‫يستفسر العميل عن خادم الجذر للعثور على خادم‬ ❖
Amazon.com DNS ‫ للحصول على خادم‬DNS .com ‫يستفسر العميل عن خادم‬ ❖
‫ للحصول على‬amazon.com ‫ الخاص بـ‬DNS ‫عن خادم‬DNSclient ‫يستعلم‬ ❖
www.amazon.com ‫الخاص بـ‬IP ‫عنوان‬

2-8
 DNS: root name servers
❖ contacted by local name server that can not resolve name
❖ root name server:
▪ contacts authoritative name server if name mapping not known
▪ gets mapping returns mapping to local name server

c. Cogent, Herndon, VA (5 other sites)

d. U Maryland College Park, MD k. RIPE London (17 other sites)
h. ARL Aberdeen, MD
j. Verisign, Dulles VA (69 other sites ) i. Netnod, Stockholm (37 other sites)

e. NASA Mt View, CA m. WIDE Tokyo

f. Internet Software C. (5 other sites)
Palo Alto, CA (and 48 other
sites)

a. Verisign, Los Angeles CA 13 root name

(5 other sites)
b. USC-ISI Marina del Rey, CA
“servers”
l. ICANN Los Angeles, CA worldwide
(41 other sites)
g. US DoD Columbus,
OH (5 other sites)

Application Layer 2-9

 DNS: ‫خوادم األسماء الجذرية‬

contacted by local name server that can not resolve name ❖

root name server: ❖
contacts authoritative name server if name mapping not known ▪
gets mapping returns mapping to local name server ▪

c. Cogent, Herndon, VA (5 other sites)

d. U Maryland College Park, MD k. RIPE London (17 other sites)
h. ARL Aberdeen, MD
j. Verisign, Dulles VA (69 other sites ) i. Netnod, Stockholm (37 other sites)

e. NASA Mt View, CA m. WIDE Tokyo

f. Internet Software C. (5 other sites)
Palo Alto, CA (and 48 other
sites)

a. Verisign, Los Angeles CA 13 root name

(5 other sites)
b. USC-ISI Marina del Rey, CA
“servers”
l. ICANN Los Angeles, CA worldwide
(41 other sites)
g. US DoD Columbus,
OH (5 other sites)

Application Layer 2-10

TLD, authoritative servers
top-level domain (TLD) servers:
▪ responsible for com, org, net, edu, aero, jobs, museums,
and all top-level country domains, e.g.: uk, fr, ca, jp
▪ Network Solutions maintains servers for .com TLD
▪ Educause for .edu TLD
authoritative DNS servers:
▪ organization’s own DNS server(s), providing
authoritative hostname to IP mappings for organization’s
named hosts
▪ can be maintained by organization or service provider

Application Layer 2-11

Local DNS name server
❖ does not strictly belong to hierarchy
❖ each ISP (residential ISP, company, university)
has one
▪ also called “default name server”
❖ when host makes DNS query, query is sent to its
local DNS server
▪ has local cache of recent name-to-address translation
pairs (but may be out of date!)
▪ acts as proxy, forwards query into hierarchy

Application Layer 2-12

DNS name root DNS server
resolution example
2
❖ host at cis.poly.edu 3
TLD DNS server
wants IP address for 4
gaia.cs.umass.edu
5

iterated query: local DNS server

dns.poly.edu
❖ contacted server 7 6
1 8
replies with name of
server to contact
authoritative DNS server
❖ “I don’t know this dns.cs.umass.edu
name, but ask this requesting host
server” cis.poly.edu

gaia.cs.umass.edu

Application Layer 2-13

DNS name root DNS server
resolution example
2 3
recursive query: 7
6
❖ puts burden of name TLD DNS
server
resolution on
contacted name local DNS server
server dns.poly.edu 5 4

❖ heavy load at upper 1 8

levels of hierarchy?
authoritative DNS server
dns.cs.umass.edu
requesting host
cis.poly.edu

gaia.cs.umass.edu

Application Layer 2-14

DNS: caching, updating records
❖ once (any) name server learns mapping, it caches
mapping
▪ cache entries timeout (disappear) after some time (TTL)
▪ TLD servers typically cached in local name servers
• thus root name servers not often visited
❖ cached entries may be out-of-date (best effort
name-to-address translation!)
▪ if name host changes IP address, may not be known
Internet-wide until all TTLs expire
❖ update/notify mechanisms proposed IETF standard
▪ RFC 2136

Application Layer 2-15

DNS records (*)
DNS: distributed db storing resource records (RR)
RR format: (name, ttl, class, type, value,)

Application Layer 2-16

DNS records (*)

type=A type=CNAME
▪ name is hostname ▪ name is alias name for some
▪ value is IP address “canonical” (the real) name
(www.ibm.com is really
type=NS
servereast.backup2.ibm.com
▪ name is domain (e.g.,
foo.com) ▪ value is canonical name
▪ value is hostname of )(www.ibm.com)
authoritative name type=MX
server for this domain
▪ Name: domain
name(gmail.com)
▪ Value(Maile1.gmail.com) is
name of mailserver associated
with name gmail.com
2-17
DNS records (*)

❖ 1D: one day ❖ Type: the of returned

❖ IN: internet value
❖ NS: name server ❖ Value: the returned
❖ Time to live: record value
age
❖ Class: the class of
record 2-18
DNS protocol, messages (*)
❖ query and reply messages, both with same message
format 2 bytes 2 bytes

msg header identification flags

❖ identification: 16 bit # for # questions # answer RRs

query, reply to query uses
# authority RRs # additional RRs
same #
❖ flags: questions (variable # of questions)
▪ query or reply
▪ recursion desired answers (variable # of RRs)
▪ recursion available
▪ reply is authoritative authority (variable # of RRs)

additional info (variable # of RRs)

Application Layer 2-19

DNS protocol, messages (*)

2 bytes 2 bytes

identification flags

# questions # answer RRs

# authority RRs # additional RRs

name, type fields

questions (variable # of questions)
for a query
RRs in response answers (variable # of RRs)
to query
records for
authority (variable # of RRs)
authoritative servers
additional “helpful” additional info (variable # of RRs)
info that may be used
Application Layer 2-20
Inserting records into DNS (*)
❖ example: new startup “Network Utopia”
❖ register name networkuptopia.com at DNS registrar
(e.g., Network Solutions)
▪ provide names, IP addresses of authoritative name server
(primary and secondary)
▪ registrar inserts two RRs into .com TLD server:
(networkutopia.com, dns1.networkutopia.com, NS)
(dns1.networkutopia.com, 212.212.212.1, A)
❖ create authoritative server type A record for
www.networkuptopia.com; type MX record for
networkutopia.com

Application Layer 2-21

 Attacking DNS (*)
DDoS attacks (distributed DOS) Redirect attacks
❖ Man-in-middle
❖ Bombard root servers with
traffic ▪ Intercept queries
▪ Not successful to date ❖ DNS poisoning
▪ Local DNS servers cache IPs ▪ Send bogus relies to
of TLD servers, allowing DNS server, which
root server bypass caches
❖ Bombard TLD servers Exploit DNS for DDoS
▪ Potentially more dangerous Send queries with
spoofed source
address: target IP
❖ Requires amplification

Application Layer 2-22