what is all that crap
play

What is all that crap? Analysis of DNS root server bogus queries - PowerPoint PPT Presentation

Apr 28, 2023 •471 likes •959 views

RIPE Network Coordination Centre What is all that crap? Analysis of DNS root server bogus queries Authors: Danil Snchez & Joost Pijnaker Education: System & Network Engineering Supervisors: Cees de Laat (UvA) Daniel

  1. RIPE Network Coordination Centre “What is all that crap?” Analysis of DNS root server bogus queries Authors: Daniël Sánchez & Joost Pijnaker Education: System & Network Engineering Supervisors: Cees de Laat (UvA) Daniel Karrenberg (RIPE NCC) Date: 07-02-2007 14:00 http://www.ripe.net

  2. RIPE Network Coordination Centre Agenda ● Organisation ● Project introduction ● Research ● Conclusion ● Questions http://www.ripe.net

  3. RIPE Network Coordination Centre Agenda ● Organisation ● Project introduction ● Research ● Conclusion ● Questions http://www.ripe.net

  4. RIPE Network Coordination Centre Organisation: RIPE NCC http://www.ripe.net http://www.ripe.net

  5. RIPE Network Coordination Centre Organisation: K-Root server http://k.root-servers.org http://www.ripe.net

  6. RIPE Network Coordination Centre Organisation: DNS Root server http://faq.oneandone.co.uk http://www.ripe.net

  7. RIPE Network Coordination Centre Agenda ● Organisation ● Project introduction ● Research ● Conclusion ● Questions http://www.ripe.net

  8. RIPE Network Coordination Centre Agenda ● Organisation ● Project introduction ● Research ● Conclusion ● Questions http://www.ripe.net

  9. RIPE Network Coordination Centre Project introduction ● Problem definition ● Research question ● Research scope ● Capture data ● Tools http://www.ripe.net

  10. RIPE Network Coordination Centre Project introduction: Capture data http://www.ripe.net

  11. RIPE Network Coordination Centre Project introduction: Tools ● Tcpdump ● Ethereal ● dnstop ● Scripts (awk, Ruby) http://www.ripe.net

  12. RIPE Network Coordination Centre Agenda ● Organisation ● Project introduction ● Research ● Conclusion ● Questions http://www.ripe.net

  13. RIPE Network Coordination Centre Agenda ● Organisation ● Project introduction ● Research ● Conclusion ● Questions http://www.ripe.net

  14. RIPE Network Coordination Centre Research ● Determine bogus categories ● Filter capture data ● Statistics ● Determine possible causes ● Determine possible solutions http://www.ripe.net

  15. RIPE Network Coordination Centre Research ● Determine bogus categories ● Filter capture data ● Statistics ● Determine possible causes ● Determine possible solutions http://www.ripe.net

  16. RIPE Network Coordination Centre Research: Bogus categories ● A for A queries ● Private IP reverse queries ● Reserved IP reverse queries ● Local domain queries ● Invalid TLD queries ● Identical query IDs queries ● Repeated queries ● TLD not cached queries http://www.ripe.net

  17. RIPE Network Coordination Centre A for A queries A? x.y.80.66. http://www.ripe.net

  18. RIPE Network Coordination Centre Private IP reverse queries PTR? 1.0.0.127.in-addr.arpa. http://www.ripe.net

  19. RIPE Network Coordination Centre Reserved IP reverse queries PTR? 192.168.253.241.in-addr.arpa. http://www.ripe.net

  20. RIPE Network Coordination Centre Local domain queries A? svr004.network.local. http://www.ripe.net

  21. RIPE Network Coordination Centre Invalid TLD queries A? Maschult1.Speedport_W_700V. http://www.ripe.net

  22. RIPE Network Coordination Centre Same query IDs queries id 5134, A? www.google.com. id 5134, A? www.os3.nl. http://www.ripe.net

  23. RIPE Network Coordination Centre Repeated queries IP x.y.96.200 A? www.os3.nl. IP x.y.96.200 A? www.os3.nl. IP x.y.96.200 A? www.os3.nl. IP x.y.96.200 A? www.os3.nl. http://www.ripe.net

  24. RIPE Network Coordination Centre TLD not cached queries IP x.y.96.200 A? www.os3.nl. IP x.y.96.200 A? www.google.nl. http://www.ripe.net

  25. RIPE Network Coordination Centre Research ● Determine bogus categories ● Filter capture data ● Statistics ● Determine possible causes ● Determine possible solutions http://www.ripe.net

  26. RIPE Network Coordination Centre Research ● Determine bogus categories ● Filter capture data ● Statistics ● Determine possible causes ● Determine possible solutions http://www.ripe.net

  27. RIPE Network Coordination Centre Research: Filter capture data http://www.ripe.net

  28. RIPE Network Coordination Centre Research: Filter capture data 17:10:34.283465 A? A-1FREEMAN.COM.INBOUND10.MXLOGIC.NET. 17:10:34.933914 A? A-1FREEMAN.COM.INBOUND10.MXLOGIC.NET. 17:10:35.203961 A? A-1FREEMAN.COM.INBOUND10.MXLOGIC.NET. 17:10:35.498391 A? A-1FREEMAN.COM.INBOUND10.MXLOGIC.NET. 17:10:34.283465 A? A-1FREEMAN.COM.INBOUND10.MXLOGIC.NET. http://www.ripe.net

  29. RIPE Network Coordination Centre Research ● Determine bogus categories ● Filter capture data ● Statistics ● Determine possible causes ● Determine possible solutions http://www.ripe.net

  30. RIPE Network Coordination Centre Research ● Determine bogus categories ● Filter capture data ● Statistics ● Determine possible causes ● Determine possible solutions http://www.ripe.net

  31. RIPE Network Coordination Centre Research: Statistics http://www.ripe.net

  32. RIPE Network Coordination Centre Research: Statistics http://www.ripe.net

  33. RIPE Network Coordination Centre Research: Statistics http://www.ripe.net

  34. RIPE Network Coordination Centre Research ● Determine bogus categories ● Filter capture data ● Statistics ● Determine possible causes ● Determine possible solutions http://www.ripe.net

  35. RIPE Network Coordination Centre Research ● Determine bogus categories ● Filter capture data ● Statistics ● Determine possible causes ● Determine possible solutions http://www.ripe.net

  36. RIPE Network Coordination Centre Research: Causes ● Software bugs • A for A, Private IP reverse ● Not updated software • A for A ● Misconfigured software • Private IP reverse, TLD not cached ● Firewalls • Repeated http://www.ripe.net

  37. RIPE Network Coordination Centre Research ● Determine bogus categories ● Filter capture data ● Statistics ● Determine possible causes ● Determine possible solutions http://www.ripe.net

  38. RIPE Network Coordination Centre Research ● Determine bogus categories ● Filter capture data ● Statistics ● Determine possible causes ● Determine possible solutions http://www.ripe.net

  39. RIPE Network Coordination Centre Research: Solutions “Client” side: ● Install and use stable software ● Update software ● Configure software appropriatly http://www.ripe.net

  40. RIPE Network Coordination Centre Research: Solutions “Server” side: ● Access lists ● u(RPF) ● Contact software vendors ● Contact the owners of “big” sources ● Add additional servers http://www.ripe.net

  41. RIPE Network Coordination Centre Agenda ● Organisation ● Project introduction ● Research ● Conclusion ● Questions http://www.ripe.net

  42. RIPE Network Coordination Centre Agenda ● Organisation ● Project introduction ● Research ● Conclusion ● Questions http://www.ripe.net

  43. RIPE Network Coordination Centre Conclusion Statistics: ● Total % of bogus: AMS-IX: 80.70% NAP: 14.65% ● Top 10 IP addresses responsible: AMS-IX: 10.75% NAP: 42.40% ● Sources: 3 or 4 octets? http://www.ripe.net

  44. RIPE Network Coordination Centre Conclusion Solutions: ● Contact software vendors ● Contact owners big sources ● Add additional servers http://www.ripe.net

  45. RIPE Network Coordination Centre Agenda ● Organisation ● Project introduction ● Research ● Conclusion ● Questions http://www.ripe.net

  46. RIPE Network Coordination Centre Agenda ● Organisation ● Project introduction ● Research ● Conclusion ● Questions http://www.ripe.net

  47. RIPE Network Coordination Centre Questions? http://www.ripe.net

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

CRAP Solar A CAUTIONARY TALE In Australia out of 1.7 million solar installations, too many are in

CRAP Solar A CAUTIONARY TALE In Australia out of 1.7 million solar installations, too many are in

CRAP Solar A CAUTIONARY TALE In Australia out of 1.7 million solar installations, too many are in the category of crap solar. Crap solar is a system that under-performs or is simply dead sometimes without the owners knowledge.

395 views • 14 slides
ES6, ES7, WHERE DO I START??? OH CRAP J AVA S C R I P T C H A N G E D A G A I N ! HI, I'M

ES6, ES7, WHERE DO I START??? OH CRAP J AVA S C R I P T C H A N G E D A G A I N ! HI, I'M

ES6, ES7, WHERE DO I START??? OH CRAP J AVA S C R I P T C H A N G E D A G A I N ! HI, I'M RAYMOND! Developer Advocate for IBM Focused on Node, API, Serverless, and Enterprise Cat Demos Blogging at www.raymondcamden.com

602 views • 39 slides
Meltdown or "Holy Crap: How did we do this to ourselves" Abstract Meltdown

Meltdown or "Holy Crap: How did we do this to ourselves" Abstract Meltdown

Meltdown or "Holy Crap: How did we do this to ourselves" Abstract Meltdown exploits side effects of out-of-order execution to read arbitrary kernel- memory locations Breaks all security assumptions given by address space

159 views • 13 slides
SPECIAL REPORT: WATCH OUT FOR CRAP! CURRENCY CHANGE Y/Y Heavy

SPECIAL REPORT: WATCH OUT FOR CRAP! CURRENCY CHANGE Y/Y Heavy

INDUSTRIAL RESEARCH March 13, 2014 SPECIAL REPORT: WATCH OUT FOR CRAP! CURRENCY CHANGE Y/Y Heavy snowfall will likely affect 1Q results while weak resource currencies - Canada,

352 views • 11 slides
If It's Not Deterministic, It's Crap: Deterministic Machine Learning and Molecular Dynamics

If It's Not Deterministic, It's Crap: Deterministic Machine Learning and Molecular Dynamics

If It's Not Deterministic, It's Crap: Deterministic Machine Learning and Molecular Dynamics Spoilers GPUs/FPGAs/CPUs/ASICs ad nauseum AMBER Molecular Dynamics Determinism Matters Multi-GPU Servers Neural Networks

1.04k views • 68 slides
Feeding the Barbarian Running your Onan generator on propane or todays crap gas at the flip of a

Feeding the Barbarian Running your Onan generator on propane or todays crap gas at the flip of a

Feeding the Barbarian Running your Onan generator on propane or todays crap gas at the flip of a switch Text and photos by Jerry Work GMCWS rally Coos Bay, Oregon, 2016 Todays gasoline is killing our Onans as surely as if we filled the

565 views • 28 slides
The Rhetorics of Web Pages By: Jerika McConnell, Imani Harris, Katelyn Thompson, Mallari Miller

The Rhetorics of Web Pages By: Jerika McConnell, Imani Harris, Katelyn Thompson, Mallari Miller

The Rhetorics of Web Pages By: Jerika McConnell, Imani Harris, Katelyn Thompson, Mallari Miller and Pearl Arrieta Damnit, Jim, Im a Writer, Not a Graphic Designer! (Or, Who Gives a CRAP?) - Basic Design Principles (CRAP) a. Contrast-

388 views • 16 slides
Crap4J Nigel talking crap as usual .... Code Complexity Metric McCabes Cyclomatic

Crap4J Nigel talking crap as usual .... Code Complexity Metric McCabes Cyclomatic

Crap4J Nigel talking crap as usual .... Code Complexity Metric McCabes Cyclomatic Complexity measures number of paths through the source code Measured using static analysis Studies have shown CC >10 has higher risk of defects

884 views • 11 slides
Processed Foods and Food Processing the crap we eat and how we make it By: Patrick Colp Outline

Processed Foods and Food Processing the crap we eat and how we make it By: Patrick Colp Outline

Processed Foods and Food Processing the crap we eat and how we make it By: Patrick Colp Outline Processed foods Food processing Food additives Processed Foods Ground Beef Beef finely chopped in a meat grinder Different

768 views • 32 slides
G R A P H I C D E S I G N MPA 635: Data Visualization September 11, 2018 P L A N F O R T O D

G R A P H I C D E S I G N MPA 635: Data Visualization September 11, 2018 P L A N F O R T O D

G R A P H I C D E S I G N MPA 635: Data Visualization September 11, 2018 P L A N F O R T O D A Y Truth, beauty, stories, design Technical details CRAP T R U T H , B E A U T Y, S TO R I E S , D E S I G N S O U R C E S O F T R U T H

659 views • 44 slides
WHAT WILL WE TALK ABOUT? Why your presentation sucks YOUR Its all about you! PRESENTATION

WHAT WILL WE TALK ABOUT? Why your presentation sucks YOUR Its all about you! PRESENTATION

4/10/2013 WHAT WILL WE TALK ABOUT? Why your presentation sucks YOUR Its all about you! PRESENTATION Classic blunders SUCKS. Make your HERES WHY... presentation CRAP Approximately Weve all been there... 20,800 PowerPoint presentations are

378 views • 21 slides
the Unix Philosophy still matters Make you think markus schnalke <meillo@marmaro.de>

the Unix Philosophy still matters Make you think markus schnalke <meillo@marmaro.de>

Goals of this talk Introduce the Unix Phil Show that most modern software is crap Explain why the Unix Phil leads to good/better software Why Convince you that good software is of matter the Unix Philosophy still matters

536 views • 9 slides
The flow of ITMOs Preparing for the flow I: Descr cribe the aspect cts of your NDC that the

The flow of ITMOs Preparing for the flow I: Descr cribe the aspect cts of your NDC that the

The flow of ITMOs Preparing for the flow I: Descr cribe the aspect cts of your NDC that the cooperative approach ch will be de deliveri ring ng ITMO MOs for r (in n the the CARP/CRAP/CAD): A target level representing the level of

91 views • 8 slides
the Unix Philosophy still matters markus schnalke <meillo@marmaro.de> Goals of this talk

the Unix Philosophy still matters markus schnalke <meillo@marmaro.de> Goals of this talk

Why the Unix Philosophy still matters markus schnalke <meillo@marmaro.de> Goals of this talk Introduce the Unix Phil Show that most modern software is crap Explain why the Unix Phil leads to good/better software

520 views • 36 slides
Todd D. Ommen Managing Attorney Pace Environmental Litigation Clinic Pace Environmental

Todd D. Ommen Managing Attorney Pace Environmental Litigation Clinic Pace Environmental

Todd D. Ommen Managing Attorney Pace Environmental Litigation Clinic Pace Environmental Litigation Clinic All the Legal Crap You Have to Deal With Statutory and Regulatory Framework Federal Statutes and Regulations State Statutes and

207 views • 20 slides
Modern Apprenticeship Paul Pagel paul@8thlight.com CEO - 8th Light @paulwpagel Agile Conference

Modern Apprenticeship Paul Pagel paul@8thlight.com CEO - 8th Light @paulwpagel Agile Conference

Modern Apprenticeship Paul Pagel paul@8thlight.com CEO - 8th Light @paulwpagel Agile Conference 2008 Craftsmanship over crap! Software Craftsmanship Summit Libertyville, IL 2008 SC Manifesto Not only working

1.61k views • 45 slides
Vol., No., Article Title Authors Date Journal/Conference Name

Vol., No., Article Title Authors Date Journal/Conference Name

Vol., No., Article Title Authors Date Journal/Conference Name / Pages Vol. 2 , Password Memorability and Security A. Blackwell, R. Anderson, Sept.-Oct. 1 2020/06/01 Issue 5 , 25 - IEEE Security

342 views • 3 slides
Detection of peer-to-peer botnets Matthew Steggink, Igor Idziejczak February 6, 2008 1 / 17

Detection of peer-to-peer botnets Matthew Steggink, Igor Idziejczak February 6, 2008 1 / 17

Outline Introduction & theory Research question Peacomm case study Detection Conclusion & future work Detection of peer-to-peer botnets Matthew Steggink, Igor Idziejczak February 6, 2008 1 / 17 Outline Introduction & theory

570 views • 17 slides
$ Circumventing Forensic Live-acquisition Tools > Rootkits for

$ Circumventing Forensic Live-acquisition Tools > Rootkits for

$ Circumventing Forensic Live-acquisition Tools > Rootkits for dubious defensive purposes > Yonne de Bruijn (yonne.debruijn@os3.nl) Digital Forensics $ retrieve

304 views • 27 slides
Countering Kernel Rootkits with Lightweight Hook Protection Michal Sekletar College of

Countering Kernel Rootkits with Lightweight Hook Protection Michal Sekletar College of

Countering Kernel Rootkits with Lightweight Hook Protection Michal Sekletar College of Engineering and Computer Science Orlando, FL April 2, 2012 Michal Sekletar (University of Central Florida) April 2, 2012 1 / 14 Acknowledgment

177 views • 14 slides
Technology Neutrality, Technology Sovereignty and the Architect of Technology of 21st Century

Technology Neutrality, Technology Sovereignty and the Architect of Technology of 21st Century

Technology Neutrality, Technology Sovereignty and the Architect of Technology of 21st Century (High Level) Policy Dialogue Technology and Innovation Policy in the Age of Global Value Chain International Institute for Trade and Development

840 views • 22 slides
By growing in exports, we grow our ho.ME Nata a ukanovi CMO, Domain.Me 1000000

By growing in exports, we grow our ho.ME Nata a ukanovi CMO, Domain.Me 1000000

By growing in exports, we grow our ho.ME Nata a ukanovi CMO, Domain.Me 1000000 1200000 200000 400000 600000 800000 0 1/Apr/08 1/Jul/08 1/Oct/08 1/Jan/09 1/Apr/09 1/Jul/09 1/Oct/09 1/Jan/10 1/Apr/10 1/Jul/10 1/Oct/10

258 views • 25 slides
Resource Management in VMware ESX Server 3 Mark Fei Technical Instructor, VMware Objectives To

Resource Management in VMware ESX Server 3 Mark Fei Technical Instructor, VMware Objectives To

Resource Management in VMware ESX Server 3 Mark Fei Technical Instructor, VMware Objectives To understand: How resource pools allow you to define resource policies that are enforceable regardless of server heterogeneity or VMotion activity

547 views • 25 slides
Provably secure compilation of side-channel countermeasures: the case of cryptographic

Provably secure compilation of side-channel countermeasures: the case of cryptographic

Provably secure compilation of side-channel countermeasures: the case of cryptographic constant-time Gilles Barthe Benjamin Grgoire Vincent Laporte CSF18, 2018-07-12 Vincent Laporte et alii Provably secure compilation of

501 views • 25 slides

More recommend