SAND Project Self-managing Anycast Networks for the DNS ICANN 55 - - PowerPoint PPT Presentation

▶

Jan 20, 2023 167 likes •313 views

SAND Project Self-managing Anycast Networks for the DNS ICANN 55 TechDay 7 March, 2016 Ricardo de O. Schmidt SAND Project Bring autonomous management to anycast DNS M onitoring: system health, reachability, performance, resilience... A

SLIDE 1

SAND Project

Self-managing Anycast Networks for the DNS

ICANN 55 TechDay 7 March, 2016

Ricardo de O. Schmidt

SLIDE 2

SAND Project

Bring autonomous management to anycast DNS
Monitoring: system health, reachability, performance, resilience...
Analysis: is everything as expected?
Planning: reconfiguration decisions
Execution: reconfiguration enforcement
Knowledge: data gathered or produced

ICANN 55 TechDay 7 March, 2016 SAND Project Ricardo de O. Schmidt

Monitoring Knowledge base Decision making

Passive Active Stats

Passive DNS
ECS
dnscap
Probing
Distributed
Nagios
Icinga
SNMP

BGP DNS Cloud

SLIDE 3

Research Focus

Most of our research efforts are focused on
Monitoring the anycast infrastructure
How to use available tools and platforms
how to profit from upcoming technologies
Examples
Using worldwide vantage points (RIPE Atlas) to assess reachability

and performance of the anycast DNS

Use the anycast infrastructure itself for probing
Use ECS information for end user mapping

ICANN 55 TechDay 7 March, 2016 SAND Project Ricardo de O. Schmidt

SLIDE 4

Monitoring Reachability

ICANN 55 TechDay 7 March, 2016 SAND Project Ricardo de O. Schmidt

SLIDE 5

Monitoring Reachability

What is the origin of queries I see?

ICANN 55 TechDay 7 March, 2016 SAND Project Ricardo de O. Schmidt

Atlanta, US

SLIDE 6

Monitoring Reachability

What is the origin of queries I see?

ICANN 55 TechDay 7 March, 2016 SAND Project Ricardo de O. Schmidt

Singapore

SLIDE 7

Monitoring Performance

Does anycast give good absolute performance?

ICANN 55 TechDay 7 March, 2016 SAND Project Ricardo de O. Schmidt

0.2 0.4 0.6 0.8 1 50 100 150 200 250 300 350 CDF RTT (ms) C-root actual C-root optimal C-root mishit K-root actual K-root optimal K-root mishit

SLIDE 8

Monitoring Performance

Does location matter more than number of sites?

ICANN 55 TechDay 7 March, 2016 SAND Project Ricardo de O. Schmidt

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 50 100 150 200 250 300 350 CDF RTT (ms) C-root optimal CDG CDG + LAX CDG + LAX + JFK CDG + LAX + JFK + FRA

SLIDE 9

Visualization Helps!

ICANN 55 TechDay 7 March, 2016 SAND Project Ricardo de O. Schmidt

SLIDE 10

Lessons Learned

Fully autonomous is very challenging
Mainly due to BGP agreements for new instances
Semi-autonomous is definitely possible
Testing environment can be very useful
Measurements are very helpful
Uncover hidden problems and misconfigurations
Decide on best approaches
Major drawback: you have to implement them yourself
But not a real drawback, is it?

ICANN 55 TechDay 7 March, 2016 SAND Project Ricardo de O. Schmidt

SLIDE 11

Anycast Testbed

We are creating an anycast research testbed
Measurements, measurements, measurements...
We want to go as global as possible
Few sites already up and running
Traffic is research related and limited to eventual ICMP (pings),

traceroutes, and DNS requests

Resources allocated by SURFnet and RIPE
145.90.8.0/24
2001:678::d0::/48
ASN 1133 (temporary - University of Twente, NL)

ICANN 55 TechDay 7 March, 2016 SAND Project Ricardo de O. Schmidt

SLIDE 12

Anycast Testbed

Help us to build the testbed! The more the merrier!

ICANN 55 TechDay 7 March, 2016 SAND Project Ricardo de O. Schmidt

SYD NRT AMS IAD DEL LHR OSU MIA

SLIDE 13

SAND Project

Self-managing Anycast Networks for the DNS

Ricardo de O. Schmidt - r.schmidt@utwente.nl Wouter de Vries - w.b.devries@utwente.nl http://www.sand-project.nl/ Thank you!

SLIDE 14

Future

DNS Anycast Security (DAS) project
How to use anycast to prevent and mitigate DDoS
Pros and cons of approaches
...

ICANN 55 TechDay 7 March, 2016 SAND Project Ricardo de O. Schmidt