CS615 - System Administration DNS; HTTP Department of Computer - - PowerPoint PPT Presentation

▶
cs615 system administration dns http
SMART_READER_LITE
LIVE PREVIEW

CS615 - System Administration DNS; HTTP Department of Computer - - PowerPoint PPT Presentation

Jun 05, 2023 982 likes •1.9k views

CS615 - System Administration Slide 1 CS615 - System Administration DNS; HTTP Department of Computer Science Stevens Institute of Technology Jan Schaumann jschauma@stevens-tech.edu https://stevens.netmeister.org/615/ DNS; HTTP March 9,

slide-1
SLIDE 1

CS615 - System Administration Slide 1

CS615 - System Administration DNS; HTTP

Department of Computer Science Stevens Institute of Technology Jan Schaumann jschauma@stevens-tech.edu https://stevens.netmeister.org/615/

DNS; HTTP March 9, 2020

slide-2
SLIDE 2

CS615 - System Administration Slide 2

Current Events

https://www.timeanddate.com/time/dst/events.html

DNS; HTTP March 9, 2020

slide-3
SLIDE 3

CS615 - System Administration Slide 3

Falsehoods Programmers Believe About Time:

  • 1. There are always 24 hours in a day.
  • 2. Months have either 30 or 31 days.
  • 3. Years have 365 days.
  • 4. February is always 28 days long.

http://FalsehoodsAboutTime.com https://azure.microsoft.com/en-us/blog/is-your-code-ready-for-the-leap-year/

DNS; HTTP March 9, 2020

slide-4
SLIDE 4

CS615 - System Administration Slide 4

In the beginning...

DNS; HTTP March 9, 2020

slide-5
SLIDE 5

CS615 - System Administration Slide 5

In the beginning...

DNS; HTTP March 9, 2020

slide-6
SLIDE 6

CS615 - System Administration Slide 6

In the beginning...

DNS; HTTP March 9, 2020

slide-7
SLIDE 7

CS615 - System Administration Slide 7

In the beginning...

DNS; HTTP March 9, 2020

slide-8
SLIDE 8

CS615 - System Administration Slide 8

In the beginning...

DNS; HTTP March 9, 2020

slide-9
SLIDE 9

CS615 - System Administration Slide 9

In the beginning...

https://is.gd/DdPNCo

DNS; HTTP March 9, 2020

slide-10
SLIDE 10

CS615 - System Administration Slide 10

In the beginning...

# Host Database # This file should contain the addresses and aliases # for local hosts that share this file. # 127.0.0.1 localhost localhost. # # RFC 1918 specifies that these networks are "internal". # 10.0.0.0 10.255.255.255 # 172.16.0.0 172.31.255.255 # 192.168.0.0 192.168.255.255 10.0.0.1 UCLA-TEST 10.0.0.2 SRI-SPRM 10.0.0.4 UTAH-CS

DNS; HTTP March 9, 2020

slide-11
SLIDE 11

CS615 - System Administration Slide 11

The Domain Name System

Computers like numbers. 10011011111101100101100110011111

DNS; HTTP March 9, 2020

slide-12
SLIDE 12

CS615 - System Administration Slide 12

The Domain Name System

Computers like numbers. 10011011 11110110 01011001 10011111 155 . 246 . 89 . 159

DNS; HTTP March 9, 2020

slide-13
SLIDE 13

CS615 - System Administration Slide 13

The Domain Name System

People like names. ash.cs.stevens-tech.edu

DNS; HTTP March 9, 2020

slide-14
SLIDE 14

CS615 - System Administration Slide 14

The Domain Name System

DNS; HTTP March 9, 2020

slide-15
SLIDE 15

CS615 - System Administration Slide 15

The New Phonebook is here!

https://is.gd/XXp2sC wget -q -O - https://is.gd/XXp2sC | grep -c "^HOST"

DNS; HTTP March 9, 2020

slide-16
SLIDE 16

CS615 - System Administration Slide 16

DNS: A distributed database

DNS; HTTP March 9, 2020

slide-17
SLIDE 17

CS615 - System Administration Slide 17

The Domain Name Space

The domain name space consists of a tree of domain names.

DNS; HTTP March 9, 2020

slide-18
SLIDE 18

CS615 - System Administration Slide 18

DNS: A hierarchical system

DNS; HTTP March 9, 2020

slide-19
SLIDE 19

CS615 - System Administration Slide 19

The Domain Name Space

The domain name space consists of a tree of domain names. A subtree divides into zones.

DNS; HTTP March 9, 2020

slide-20
SLIDE 20

CS615 - System Administration Slide 20

The Domain Name Space

The domain name space consists of a tree of domain names. A subtree divides into zones. Each node may contain resource records.

DNS; HTTP March 9, 2020

slide-21
SLIDE 21

CS615 - System Administration Slide 21

The Domain Name Space

DNS; HTTP March 9, 2020

slide-22
SLIDE 22

CS615 - System Administration Slide 22

Domain Names

ash.cs.stevens-tech.edu Domain Names are read from right to left and components separated by a “.”.

DNS; HTTP March 9, 2020

slide-23
SLIDE 23

CS615 - System Administration Slide 23

Domain Names

ash.cs.stevens-tech.edu. The root is known as “.”, but is usually left out.

DNS; HTTP March 9, 2020

slide-24
SLIDE 24

CS615 - System Administration Slide 24

Domain Names

ash.cs.stevens-tech.edu. There is a small number of top level domains.

DNS; HTTP March 9, 2020

slide-25
SLIDE 25

CS615 - System Administration Slide 25

Domain Names

ash.cs.stevens-tech.edu. There is a number of top level domains.

wget -O - ftp://rs.internic.net/domain/root.zone | \ grep "IN<tab>*NS<tab>" | awk ’{print $1}’ | sort -u | wc -l https://data.iana.org/TLD/tlds-alpha-by-domain.txt https://en.wikipedia.org/wiki/List_of_Internet_top-level_domains

DNS; HTTP March 9, 2020

slide-26
SLIDE 26

CS615 - System Administration Slide 26

Domain Names

ash.cs.stevens-tech.edu. Each domain can be divided into any number of sub domains.

DNS; HTTP March 9, 2020

slide-27
SLIDE 27

CS615 - System Administration Slide 27

Domain Names

ash.cs.stevens-tech.edu. Each domain can be divided into any number of sub domains.

DNS; HTTP March 9, 2020

slide-28
SLIDE 28

CS615 - System Administration Slide 28

Domain Names

ash.cs.stevens-tech.edu. The left-most component of a domain name may be a hostname.

DNS; HTTP March 9, 2020

slide-29
SLIDE 29

CS615 - System Administration Slide 29

Fully Qualified Domain Names

ash.cs.stevens-tech.edu. A hostname with a domain name is known as a FQDN.

DNS; HTTP March 9, 2020

slide-30
SLIDE 30

CS615 - System Administration Slide 30

The Original IANA

DNS; HTTP March 9, 2020

slide-31
SLIDE 31

CS615 - System Administration Slide 31

NIC and Network Solutions

Before the DNS, the Network Information Center (NIC) at Stanford Research Institute (SRI) allocated domain names. IANA (effectively: Jon Postel) assigned, NIC published. https://www.internic.net In 1991, this was contracted out to Network Solutions, Inc. (NSI), which held the monopoly on DNS registrations (within .com, .org, .mil, .gov, .edu, and .net) until around 1998.

DNS; HTTP March 9, 2020

slide-32
SLIDE 32

CS615 - System Administration Slide 32

Registries

IANA manages the root zone (.), arpa.; gTLD registries handle gTLDs, ccTLD registries handle ccTLDs. ICANN accredits domain name registries. Registries may function as a Domain Name Registrar may delegate Domain Name registration control policies of allocations can (and do) censor, revoke, change, ... entries (e.g. vb.ly) The domain name space is a tree; if you control one node, you control all the branches and subtrees.

DNS; HTTP March 9, 2020

slide-33
SLIDE 33

CS615 - System Administration Slide 33

DNS servers come in two flavors

Authoritative Recursive Nameservers Nameservers

DNS; HTTP March 9, 2020

slide-34
SLIDE 34

CS615 - System Administration Slide 34

Hostname resolution

Resolution on a recursive nameserver (aka resolver) involves a number

  • f queries:

$ nslookup ash.cs.stevens-tech.edu Server: 127.0.0.1 Address: 127.0.0.1#53 Non-authoritative answer: Name: ash.cs.stevens-tech.edu Address: 155.246.89.159 $

DNS; HTTP March 9, 2020

slide-35
SLIDE 35

CS615 - System Administration Slide 35

Hostname resolution

Resolution on a resolver involves a number of queries: IP panix.netmeister.org.62105 > i.root-servers.net.domain: 11585 [1au] A? ash.cs.stevens-tech.edu. (52) IP i.root-servers.net.domain > panix.netmeister.org.62105: 11585- 0/8/8 (494) IP panix.netmeister.org.53168 > a.gtld-servers.net.domain: 46575 [1au] A? ash.cs.stevens-tech.edu. (52) IP a.gtld-servers.net.domain > panix.netmeister.org.53168: 46575- 0/6/3 (609) IP panix.netmeister.org.41071 > nrac.stevens-tech.edu.domain: 24322 [1au] A? ash.cs.stevens-tech.edu. (52) IP nrac.stevens-tech.edu.domain > panix.netmeister.org.41071: 24322*- 1/2/3 A[|domain]

DNS; HTTP March 9, 2020

slide-36
SLIDE 36

CS615 - System Administration Slide 36

Hostname resolution

Resolution on a resolver involves a number of queries: $ host -t ns . . name server I.ROOT-SERVERS.NET. . name server D.ROOT-SERVERS.NET. . name server C.ROOT-SERVERS.NET. . name server M.ROOT-SERVERS.NET. . name server F.ROOT-SERVERS.NET. . name server A.ROOT-SERVERS.NET. . name server E.ROOT-SERVERS.NET. . name server L.ROOT-SERVERS.NET. . name server H.ROOT-SERVERS.NET. . name server J.ROOT-SERVERS.NET. . name server B.ROOT-SERVERS.NET. . name server G.ROOT-SERVERS.NET. . name server K.ROOT-SERVERS.NET. $

DNS; HTTP March 9, 2020

slide-37
SLIDE 37

CS615 - System Administration Slide 37

Hostname resolution

Resolution on a resolver involves a number of queries: $ dig -t ns edu. [...] ;; ANSWER SECTION: edu. 172800 IN NS l.edu-servers.net. edu. 172800 IN NS f.edu-servers.net. edu. 172800 IN NS c.edu-servers.net. edu. 172800 IN NS g.edu-servers.net. edu. 172800 IN NS a.edu-servers.net. edu. 172800 IN NS d.edu-servers.net. ;; ADDITIONAL SECTION: c.edu-servers.net. 36626 IN A 192.26.92.30 d.edu-servers.net. 13274 IN A 192.31.80.30 l.edu-servers.net. 36626 IN A 192.41.162.30 [...] $

DNS; HTTP March 9, 2020

slide-38
SLIDE 38

CS615 - System Administration Slide 38

Hostname resolution

Resolution on a resolver involves a number of queries: $ dig @c.edu-servers.net -t ns stevens.edu. [...] ;; AUTHORITY SECTION: stevens.edu. 172800 IN NS nrac.stevens-tech.edu. stevens.edu. 172800 IN NS sitult.stevens-tech.edu. ;; ADDITIONAL SECTION: nrac.stevens-tech.edu. 172800 IN A 155.246.1.21 sitult.stevens-tech.edu. 172800 IN A 155.246.1.20 [...] $

DNS; HTTP March 9, 2020

slide-39
SLIDE 39

CS615 - System Administration Slide 39

Hostname resolution

DNS; HTTP March 9, 2020

slide-40
SLIDE 40

CS615 - System Administration Slide 40

Hostname resolution

Resolution on a resolver involves a number of queries: $ nslookup ash.cs.stevens-tech.edu Server: 127.0.0.1 Address: 127.0.0.1#53 Non-authoritative answer: Name: ash.cs.stevens-tech.edu Address: 155.246.89.159 $

DNS; HTTP March 9, 2020

slide-41
SLIDE 41

CS615 - System Administration Slide 41

Hostname resolution

DNS; HTTP March 9, 2020

slide-42
SLIDE 42

CS615 - System Administration Slide 42

Hostname resolution

$ ftp -o - ftp.internic.net:/domain/db.cache | more https://www.internic.net/zones/named.root

DNS; HTTP March 9, 2020

slide-43
SLIDE 43

CS615 - System Administration Slide 43

Operation Global Blackout

https://pastebin.com/XZ3EGsbc

DNS; HTTP March 9, 2020

slide-44
SLIDE 44

CS615 - System Administration Slide 44

DNS: A distributed system

There are 13 root servers.

DNS; HTTP March 9, 2020

slide-45
SLIDE 45

CS615 - System Administration Slide 45

DNS: A distributed system

There are 13 root servers. Except... there are more.

DNS; HTTP March 9, 2020

slide-46
SLIDE 46

CS615 - System Administration Slide 46

DNS: A distributed system

There are 13 root authorities.

DNS; HTTP March 9, 2020

slide-47
SLIDE 47

CS615 - System Administration Slide 47

DNS: A distributed system

There are 13 root server addresses.

DNS; HTTP March 9, 2020

slide-48
SLIDE 48

CS615 - System Administration Slide 48

DNS: A distributed system

There are hundreds of root servers.

DNS; HTTP March 9, 2020

slide-49
SLIDE 49

CS615 - System Administration Slide 49

DNS: A distributed system

See e.g.: https://e.root-servers.org/

DNS; HTTP March 9, 2020

slide-50
SLIDE 50

CS615 - System Administration Slide 50

Operation Global Blackout

DNS; HTTP March 9, 2020

slide-51
SLIDE 51

CS615 - System Administration Slide 51

DNS: A distributed database

DNS; HTTP March 9, 2020

slide-52
SLIDE 52

CS615 - System Administration Slide 52

DNS Resource Records

More than just A and AAAA: CAA – certificate authority authorization CNAME – the canonical name for an alias MX – mail exchange NS – an authoritative name server SOA – marks the start of a zone of authority SRV – service locator (e.g. for kerberos) PTR – a domain name pointer TXT text strings ...

DNS; HTTP March 9, 2020

slide-53
SLIDE 53

CS615 - System Administration Slide 53

DNS Resource Records

You’ve all seen PTR records: $ host ash.cs.stevens-tech.edu ash.cs.stevens-tech.edu has address 155.246.89.159 ash.cs.stevens-tech.edu mail is handled by 0 guinness.cs.stevens-tech.edu. $ host 155.246.89.159 159.89.246.155.in-addr.arpa domain name pointer ash.cs.stevens-tech.edu. $ Stevens doesn’t have write access to the in-addr.arpa domain. How does this work?

DNS; HTTP March 9, 2020

slide-54
SLIDE 54

CS615 - System Administration Slide 54

DNS Security

$ tcpdump -t -n -r tcpdump.out udp port 53 reading from file tcpdump.out, link-type EN10MB (Ethernet) IP 10.183.114.37.53383 > 172.16.0.23.53: 20378+ A? www.yahoo.com. (31) IP 172.16.0.23.53 > 10.183.114.37.53383: 20378 5/0/0 CNAME atsv2-fp-shed.wg1.b.yahoo.com., A 72.30.35.9, A 72.30.35.10, A 98.138.219.231, A 98.138.219.232 (129) IP 10.183.114.37.10551 > 172.16.0.23.53: 60792+ AAAA? www.yahoo.com. (31) IP 172.16.0.23.53 > 10.183.114.37.10551: 60792 5/0/0 CNAME atsv2-fp-shed.wg1.b.yahoo. AAAA 2001:4998:58:1836::11, AAAA 2001:4998:44:41d::3, AAAA 2001:4998:44:41d::4, AAAA 2001:4998:58:1836::10 (177) How do we know 172.16.0.23 didn’t lie to us? How do we protect a MitM from observing this traffic?

DNS; HTTP March 9, 2020

slide-55
SLIDE 55

CS615 - System Administration Slide 55

DNS Security

Blue Team: DNS over HTTPs https://blog.mozilla.org/netpolicy/2020/02/25/the-facts-mozillas-dns-over-https-doh https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ https://www.zdnet.com/article/dns-over-https-causes-more-problems-than-it-solves-expe Black Team: DNS over TLS https://developers.cloudflare.com/1.1.1.1/dns-over-tls/ https://developers.google.com/speed/public-dns/docs/dns-over-tls https://android-developers.googleblog.com/2018/04/dns-over-tls-support-in-android-p.h

DNS; HTTP March 9, 2020

slide-56
SLIDE 56

CS615 - System Administration Slide 56

Creative uses of DNS Resource Records

identifying sources of SPAM (via e.g. an RBL) detect email spoofing (via e.g. SPF) find out if the internet is on fire: dig +short txt istheinternetonfire.com find ASN numbers by IP addresses: dig +short 159.89.246.155.origin.asn.cymru.com TXT check a resolver’s source port randomization (to help mitigate DNS Cache Poisoning attacks): dig +short porttest.dns-oarc.net TXT using DNS to publish SSH key fingerprints (RFC4255, ssh config(5) VerifyHostKeyDNS; for best results combine with DNSSEC)

DNS; HTTP March 9, 2020

slide-57
SLIDE 57

CS615 - System Administration Slide 57

DNS Implications

information from the DNS is used for authentication, authorization, and as a source of truth DNSSEC is not widely deployed and carries implementation challenges DNS traffic is ubiquitous, may escape ACLs and restrictions faulty information can lead to unexpected and difficult to troubleshoot failures TTLs and caches can prolong outages as you wait for propagation of changes if you pwn the DNS, you pwn the entire target (hey, let’s attack the registrar!) any time you outsource something, you lose control; any time you

  • wn solving a problem, you assert that you know how to solve this

better than others

DNS; HTTP March 9, 2020

slide-58
SLIDE 58

CS615 - System Administration Slide 58

Hooray! 5 Minute Break

DNS; HTTP March 9, 2020

slide-59
SLIDE 59

CS615 - System Administration Slide 59

Hypertext Transfer Protocol Today’s Universal Internet Pipe

DNS; HTTP March 9, 2020

slide-60
SLIDE 60

CS615 - System Administration Slide 60

HTTP: Hypertext

W W W “The World Wide Web is the only thing I know of whose shortened form takes three times longer to say than what it’s short for.” – Douglas Adams

DNS; HTTP March 9, 2020

slide-61
SLIDE 61

CS615 - System Administration Slide 61

HTTP: Hypertext

https://is.gd/JnZaN6

DNS; HTTP March 9, 2020

slide-62
SLIDE 62

CS615 - System Administration Slide 62

HTTP

Hypertext Transfer Protocol RFC2616

DNS; HTTP March 9, 2020

slide-63
SLIDE 63

CS615 - System Administration Slide 63

HTTP

HTTP is a request/response protocol.

DNS; HTTP March 9, 2020

slide-64
SLIDE 64

CS615 - System Administration Slide 64

The Hypertext Transfer Protocol

HTTP is a request/response protocol:

  • 1. client sends a request to the server
  • 2. server responds

DNS; HTTP March 9, 2020

slide-65
SLIDE 65

CS615 - System Administration Slide 65

The Hypertext Transfer Protocol

HTTP is a request/response protocol:

  • 1. client sends a request to the server

request method URI protocol version request modifiers client information

  • 2. server responds

DNS; HTTP March 9, 2020

slide-66
SLIDE 66

CS615 - System Administration Slide 66

HTTP: A client request

$ telnet www.google.com 80 Trying 173.194.75.147... Connected to www.google.com. Escape character is ’^]’. GET / HTTP/1.0

DNS; HTTP March 9, 2020

slide-67
SLIDE 67

CS615 - System Administration Slide 67

The Hypertext Transfer Protocol

HTTP is a request/response protocol:

  • 1. client sends a request to the server

request method URI protocol version request modifiers client information

  • 2. server responds

status line (including success or error code) server information entity metainformation content

DNS; HTTP March 9, 2020

slide-68
SLIDE 68

CS615 - System Administration Slide 68

HTTP: a server response

HTTP/1.0 200 OK Date: Mon, 09 Mar 2020 14:15:41 GMT Set-Cookie: 1P_JAR=2020-03-09-14; expires=Wed, 08-Apr-2020 14:15:41 GMT; path=/; domain=.google.com; Secure Content-Type: text/html; charset=ISO-8859-1 Server: gws <!doctype html><html itemscope="itemscope" itemtype="http://schema.org/WebPage"> <head><meta content="Search the...

DNS; HTTP March 9, 2020

slide-69
SLIDE 69

CS615 - System Administration Slide 69

The Hypertext Transfer Protocol

Server status codes: 1xx – Informational; Request received, continuing process 2xx – Success; The action was successfully received, understood, and accepted 3xx – Redirection; Further action must be taken in order to complete the request 4xx – Client Error; The request contains bad syntax or cannot be fulfilled 5xx – Server Error; The server failed to fulfill an apparently valid request

DNS; HTTP March 9, 2020

slide-70
SLIDE 70

CS615 - System Administration Slide 70

HTTP: A client request

$ telnet www.cs.stevens.edu 80 Trying 155.246.56.11... Connected to www.cs.stevens-tech.edu. Ecape character is ’^]’. GET / HTTP/1.0 HTTP/1.1 301 Moved Permanently Date: Mon, 09 Mar 2020 14:18:12 GMT Server: Apache Location: https://www.cs.stevens.edu/ Content-Length: 235 Connection: close Content-Type: text/html; charset=iso-8859-1

DNS; HTTP March 9, 2020

slide-71
SLIDE 71

CS615 - System Administration Slide 71

HTTP: A client request

$ printf "HEAD / HTTP/1.1\r\nHost: www.cs.stevens.edu\r\n\r\n" |

  • penssl s_client -quiet -ign_eof -connect www.cs.stevens.edu:443 2>/dev/null

HTTP/1.1 302 Found Date: Mon, 05 Mar 2018 20:53:38 GMT Server: Apache Location: https://www.stevens.edu/ses/cs Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1

DNS; HTTP March 9, 2020

slide-72
SLIDE 72

CS615 - System Administration Slide 72

HTTP: A client request

$ printf "HEAD /ses/cs HTTP/1.1\r\nHost: www.stevens.edu\r\n\r\n" |

  • penssl s_client -quiet -ign_eof -connect www.stevens.edu:443 2>/dev/null

HTTP/1.1 200 OK Date: Mon, 09 Mar 2020 14:26:48 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Set-Cookie: __cfduid=d6186e98e40e13f81b13ff7edac3d15af1583764008; expires=Wed, 08-Apr-20 14:26:48 GMT; path=/; domain=.stevens.edu; HttpOnly; SameSite=Lax X-Drupal-Cache: HIT X-Generator: Drupal 7 (http://drupal.org) Last-Modified: Mon, 09 Mar 2020 09:00:07 GMT Expires: Sun, 19 Nov 1978 05:00:00 GMT Via: varnish Server: cloudflare [...]

DNS; HTTP March 9, 2020

slide-73
SLIDE 73

CS615 - System Administration Slide 73

HTTP: A client request

DNS; HTTP March 9, 2020

slide-74
SLIDE 74

CS615 - System Administration Slide 74

HTTP - more than just text

HTTP is a Transfer Protocol – serving data, not any specific text format. Accept-Encoding client header can specify different formats such as gzip or deflate for compression etc. communications, etc. corresponding server headers: Content-Type and Content-Encoding

DNS; HTTP March 9, 2020

slide-75
SLIDE 75

CS615 - System Administration Slide 75

HTTP Evolution

invented around 1989 1991: HTTP 0.9 1996: HTTP 1.0 (RFC1945) 1997: HTTP 1.1 (RFC2068) 1999: HTTP 1.1 updates (RFC2616) 2012: QUIC (implemented; to become HTTP/3) 2015: HTTP/2 (RFC7540) 2018: HTTP/3 (IETF Draft)

DNS; HTTP March 9, 2020

slide-76
SLIDE 76

CS615 - System Administration Slide 76

HTTP/2

Red Team link: HTTP/2 protocol vulnerabilities https://www.imperva.com/docs/Imperva_HII_HTTP2.pdf

DNS; HTTP March 9, 2020

slide-77
SLIDE 77

CS615 - System Administration Slide 77

HTTP - more than just static data

HTTP is a Transfer Protocol – what is transferred need not be static; resources may generate different data to return based on many variables. CGI – resource is executed, needs to generate appropriate response headers server-side scripting (ASP , PHP , Perl, ...) client-side scripting (JavaScript/ECMAScript/JScript,...) applications based on HTTP , using: AJAX RESTful services JSON, XML, YAML to represent state and abstract information

DNS; HTTP March 9, 2020

slide-78
SLIDE 78

CS615 - System Administration Slide 78

HTTP Proxy Servers

HTTP traffic usually is very asymmetric a lot of the content is static network ACLs may restrict traffic flow

DNS; HTTP March 9, 2020

slide-79
SLIDE 79

CS615 - System Administration Slide 79

HTTP Overload

Ways to mitigate HTTP overload: DNS round-robin to many web servers load balancing web cache / accelerators (reverse proxies) content delivery networks These solutions depend on the location within the network and the scale

  • f the environment.

DNS; HTTP March 9, 2020

slide-80
SLIDE 80

CS615 - System Administration Slide 80

Load Balancing

Green Team Mission: nginx HTTP Load Balancing https://docs.nginx.com/nginx/admin-guide/load-balancer/http-load-balancer/

DNS; HTTP March 9, 2020

slide-81
SLIDE 81

CS615 - System Administration Slide 81

Load Balancing: Inbound

DNS; HTTP March 9, 2020

slide-82
SLIDE 82

CS615 - System Administration Slide 82

Load Balancing: Outbound

DNS; HTTP March 9, 2020

slide-83
SLIDE 83

CS615 - System Administration Slide 83

Load Balancing: Direct Server Return

DNS; HTTP March 9, 2020

slide-84
SLIDE 84

CS615 - System Administration Slide 84

Content Delivery Networks

DNS; HTTP March 9, 2020

slide-85
SLIDE 85

CS615 - System Administration Slide 85

Content Delivery Networks

cache content in strategic locations determine location to serve from via geomapping of IP addresses (beware IPv6 aggregation!)

  • ften uses a separate domain to distinguish small objects/large
  • bjects or dynamic content/static content

either out-sourced or in-house (if your organization is a Tier-1 or Tier-2 peering partner) request routing happens via Global Server Load Balancing, DNS-based request routing, anycasting etc. provides vast amounts of interesting data about your clients (see https://www.akamai.com/stateoftheinternet/)

DNS; HTTP March 9, 2020

slide-86
SLIDE 86

CS615 - System Administration Slide 86

CDN Implications

your CDN sees all your traffic your CDN controls your TLS certificate keys your CDN is a multi-tenant environment your CDN may impose restrictions on your clients separation of cache-able content may require multiple (second-level) domains

DNS; HTTP March 9, 2020

slide-87
SLIDE 87

CS615 - System Administration Slide 87

HTTP and DNS

Both HTTP and DNS are trivial to set up. Both HTTP and DNS are not trivial to get right.

DNS; HTTP March 9, 2020

slide-88
SLIDE 88

CS615 - System Administration Slide 88

HW4: Monitoring HTTP and DNS traffic

https://stevens.netmeister.org/615/s20-hw4.html

DNS; HTTP March 9, 2020

slide-89
SLIDE 89

CS615 - System Administration Slide 89

Reading

HTTP etc.: RFC 2616, 2818, 3875 https://httpd.apache.org/docs/ https://www.w3.org/Protocols/ REST: https://is.gd/leSvGa CDNs: https://is.gd/R5DoxA https://www.edgecast.com/ https://aws.amazon.com/cloudfront/ https://www.akamai.com/ https://www.limelight.com/ ... https://developer.yahoo.com/performance/rules.html

DNS; HTTP March 9, 2020