Infrastructure for Mining HostsLDNS Associations

1
Infrastructure for Mining Hosts/LDNS Associations

• ZhiHua Wen, Dan Liu, Kim Hyun

2
Agenda

• General Background
• Based on paper, A Precise and Efficient
  Evaluation of the Proximity between Web Clients
  and their Local DNS Servers
• Presentation of our proximity measurement model
• Simulation Demonstration
• Conclusion

3
Objective

• Devise and implement a novel technique to
  quantify the proximity between clients and their
  LDNS Servers
• Define metrics to measure proximity
• Analyze the system performance for each of
  proximity metrics
• Demonstrate improved system performance with
  implemented new DNS system

4
System Architecture
5
Considerations

• The provided approach has a limitation for
  clients
• that do not fetch inlined images
• that abort the page download before the DNS
  resolution is made.
• In the DNS hierarchy, outermost LDNS server
  selected to contact ADNS server

6
Measurement

• Study conducted during three months period with
  19 participating websites.
• Total of 4,253,157 unique client and LDNS
  associations collected.

7
Proximity Measurement Metrics

• AS clustering
• The size of AS vary significantly for each
  system coarse-grained metric
• Network clustering
• Longest prefix matching to map clients to network
  clusters fine-grained metric
• Traceroute divergence
• Longest prefix matching to map clients to network
  clusters fine-grained metric
• Roundtrip time correlation
• Correlation examination from a probe point to the
  client and its LDNS server.

8
Analysis Result

• AS Clustering
• 64 of Client IPs in the same AS network cluster
• Network Clustering
• 16 of Client IPs in the same local network
  cluster
• Traceroute
• At most 30 within traceroute divergence of 8
• Most clients are close to their LDNS
• Round-trip time correlation
• 44-75 depend on the two probe site locations
• Credibility in question

9
Associated Issues

• Improved LDNS Configuration
• When clusters using LDNS from different clusters
  use the LDNS in the same cluster
• Clients using multiple LDNS
• The more LDNS servers associated with a client,
  the lower chance of LDNS belonging in the same
  cluster
• 52 associated with single LDNS, but only 20 in
  the same cluster

10
Application Impact

• Experiment Methodology
• Measure percentage of clients redirected to
  servers in the same cluster
• Results
• Experiments show that majority of the clients are
  misdirected, i.e. directed to servers outside of
  the cluster
• For AS cluster, 50 of misdirected clients use
  LDNS outside of cluster
• For Network cluster, overwhelming majority of
  misdirected clients use LDNS outside of cluster

11
Their Conclusion

• Proposed a non-intrusive, fast accurate
  technique for quantifying proximity of clients
  and LDNS
• Based on results, evaluate the proximity between
  clients and LDNS using four metrics of AS
  clustering, Network clustering, Traceroute
  divergence and RTT Correlation.
• Most LDNS servers for network clusters are
  located outside of the clients cluster, but the
  sparse distribution of CDN servers reduce the
  impact
• CDNs can solve the originator problem by
  assigning client IP address in the URLs of the
  Web pages

12
our proximity measurement model
13
www.eecs.cwru.edu
GET speical2.jpg HTTP/1.0
129.22.150.242
GET zxw20/index.htm HTTP/1.0
HTTP/1.0 200 Document Follows
ltIMG height0 src"http//zhihualinux.case.edu678
9/special.jpg" width0 border0gt
Query69_215_234_117.ipl.eecs.cwru.edu
69.215.234.117
LDNS 66.73.20.40
GET special.jpg HTTP/1.0
HTTP/1.0 301 Moved Permanently Location69_215_234
_117.ipl.eecs.cwru.edu6789/special2.jpg
Answer 129.22.150.242
LDNS 66.73.20.40,Client 69.215.234.117, Samebits
5 01000010010010010001010000101000 010001011101011
11110101001110101 00000111100111101111111001011101
zhihualinux.case.edu
129.22.148.175 ADNS for ipl.eecs.cwru.edu
14
129.22.150.242 10000001, 00010110, 10010110,
11110010 129.22.4.3 10000001, 00010110,
00000100, 00000011 Samebits 16 129.22.150.242
10000001, 00010110, 10010110, 11110010 129.22.151.
240 10000001, 00010110, 10010111,
11110000 Samebits 23
LDNS 66.73.20.40,Client 69.215.234.117, Samebits
5 66.73.20.40 01000010,01001001,00010100,
00101000 69.215.234.117 01000101,11010111,11101
010,01110101 Ping time 10ms Traceroute hopcount
3
15
Traceroute A,B
30ms
C
Dist(C,A)2ms
Dist(C,B)10ms
32ms
A
40ms
Esitimate Dist(A,B)8 to 12ms
B
16

• Traceroute 66.73.20.40
• 1 129.22.150.1 (129.22.150.1) 0.692 ms 0.292
  ms 0.268 ms
• ..
• 19 bb2-p10-3.bcvloh.sbcglobal.net
  (151.164.41.194) 32.227 ms 31.012 ms 30.920 ms
• 20 dist1-vlan30.bcvloh.sbcglobal.net
  (66.73.20.97) 37.031 ms 31.236 ms
• 21 dns1.bcvloh.sbcglobal.net (66.73.20.40)
  33.233 ms 31.417 ms 31.114 ms

Traceroute 69.215.234.117 1 129.22.150.1
(129.22.150.1) 0.692 ms 0.292 ms 0.268
ms .. 19 bb2-p10-3.bcvloh.sbcglobal.net
(151.164.41.194) 31.165 ms 31.107 ms 31.210
ms 20 dist1-vlan40.bcvloh.sbcglobal.net
(66.73.20.113) 31.731 ms 32.023 ms 21
rback4-g1-0.bcvloh.sbcglobal.net (66.73.20.235)
32.314 ms 32.501 ms 32.047 ms 22
ppp-69-215-234-117.dsl.bcvloh.ameritech.net
(69.215.234.117) 41.367 ms 40.630 ms 39.722 ms
Traceroute 66.73.20.40 Dist(Hop 21 19)
31.921- 31.3860.535ms 69.215.234.117 Dist(Hop
22 -19) 40.573 - 31.160 9.413ms Ping time
from 69.215.234.117 to 66.73.20.40 10ms
17
Demo
18
Summary

• Objective
• Quantify the Proximity between Web Clients
  and their Local DNS Servers
• Approach
• Mapping Technique
• Log File Analysis
• Implementation Result

19
Improvement

• Limitation of Simulation Setup
• Enlarge the Experiment Scale
• Further Proximity Analysis
• Wireless Networks?

20
Acknowledgement

• Professor Michael Rabinovich
• Zhuoqing Morley Mao, Charles D. Cranor, Fred
  Douglis, Oliver Spatscheck, Jia Wang (ATT
  Labs-Research)

21
Questions?
22
Demo
23
Conclusion

• Objective
• Quantify the Proximity between Web Clients
  and their Local DNS Servers
• Approach
• Mapping Technique
• Log File Analysis
• Implementation Result

24
Improvement

• Limitation of Simulation Setup
• Enlarge the Experiment Scale
• Further Proximity Analysis
• Wireless Networks?

25
Acknowledgement

• Professor Michael Rabinovich
• Zhuoqing Morley Mao, Charles D. Cranor, Fred
  Douglis, Oliver Spatscheck, Jia Wang (ATT
  Labs-Research)

26
Questions?