SlideShare a Scribd company logo

Introduction to DNS

Download as ODP, PDF
J
Jonathan Oxer

The document provides an extensive overview of the Domain Name System (DNS), describing its functions such as directory services, identity mechanisms, and mapping hostnames to IP addresses. It discusses the structure of DNS, including zones and record types, as well as security issues such as DNS cache poisoning and various attack vectors. Additionally, it covers the roles of registries, registrars, and the management of domain names under ICANN's oversight.

Technology
1 of 146
Downloaded 2,072 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
Introduction To DNS everything you never wanted to know about IP directory services Linux Users Victoria, April 3 rd 2007 Jonathan Oxer <jon@ivt.com.au>
what is the domain name system anyway? Introduction To DNS Jonathan Oxer < [email_address] >
it's like a phone book ...kinda Introduction To DNS Jonathan Oxer < [email_address] >
DNS is (1) a directory service Introduction To DNS Jonathan Oxer < [email_address] >
DNS is (2) an identity mechanism Introduction To DNS Jonathan Oxer < [email_address] >
DNS is (3) a namespace structure Introduction To DNS Jonathan Oxer < [email_address] >
DNS is (4) an abstraction layer Introduction To DNS Jonathan Oxer < [email_address] >
think of the phone book... Introduction To DNS Jonathan Oxer < [email_address] >
maps hostnames to IP addresses Introduction To DNS Jonathan Oxer < [email_address] >
maps jon.oxer.com.au to 221.133.213.151 Introduction To DNS Jonathan Oxer < [email_address] >
forward vs reverse Introduction To DNS Jonathan Oxer < [email_address] >
maps jon.oxer.com.au to 221.133.213.151 Introduction To DNS Jonathan Oxer < [email_address] >
maps 221.133.213.151 to jon.oxer.com.au Introduction To DNS Jonathan Oxer < [email_address] >
simple beginnings: hosts.txt Introduction To DNS Jonathan Oxer < [email_address] >
...but phone books Introduction To DNS Jonathan Oxer < [email_address] >
...but phone books don't Introduction To DNS Jonathan Oxer < [email_address] >
...but phone books don't Introduction To DNS Jonathan Oxer < [email_address] > scale
so modern DNS is managed like a distributed phone book Introduction To DNS Jonathan Oxer < [email_address] >
DNS is (5) delegation of authority Introduction To DNS Jonathan Oxer < [email_address] >
a “zone” defines an area of authority Introduction To DNS Jonathan Oxer < [email_address] >
think of it as an inverted tree Introduction To DNS Jonathan Oxer < [email_address] >
Introduction To DNS Jonathan Oxer < [email_address] >
anatomy of a host name Introduction To DNS Jonathan Oxer < [email_address] >
(a host name is a record inside a domain name) Introduction To DNS Jonathan Oxer < [email_address] >
read right to left: jon.oxer.com.au. Introduction To DNS Jonathan Oxer < [email_address] >
yes, it really ends in a dot! Introduction To DNS Jonathan Oxer < [email_address] >
root zone: jon.oxer.com.au . Introduction To DNS Jonathan Oxer < [email_address] >
top level domain: jon.oxer.com .au . Introduction To DNS Jonathan Oxer < [email_address] >
2nd level zone: jon.oxer .com .au. Introduction To DNS Jonathan Oxer < [email_address] >
3rd level zone: jon .oxer .com.au. Introduction To DNS Jonathan Oxer < [email_address] >
host name: jon .oxer.com.au. Introduction To DNS Jonathan Oxer < [email_address] >
back to that dot: jon.oxer.com.au . Introduction To DNS Jonathan Oxer < [email_address] >
“ ICANN's 13” : the A to M root servers Introduction To DNS Jonathan Oxer < [email_address] >
root.hints Introduction To DNS Jonathan Oxer < [email_address] >
“ There can be only 13” Introduction To DNS Jonathan Oxer < [email_address] >
(UDP packets limited to 512B) Introduction To DNS Jonathan Oxer < [email_address] >
A response with more than 13 entries > 512B Introduction To DNS Jonathan Oxer < [email_address] >
root servers replicated globally using anycast Introduction To DNS Jonathan Oxer < [email_address] >
Introduction To DNS Jonathan Oxer < [email_address] >
root servers delegate ccTLDs, gTLDs, and iTLDs Introduction To DNS Jonathan Oxer < [email_address] >
so what is this “ delegation” of which you speak? Introduction To DNS Jonathan Oxer < [email_address] >
registries, registrars, resellers, registrants, InterNIC, ICANN, OpenSRS, oh my! Introduction To DNS Jonathan Oxer < [email_address] >
Introduction To DNS Jonathan Oxer < [email_address] >
ICANN controls the registries Introduction To DNS Jonathan Oxer < [email_address] >
registries control the registrars Introduction To DNS Jonathan Oxer < [email_address] >
registrars control delegations Introduction To DNS Jonathan Oxer < [email_address] >
domain allocation policies Introduction To DNS Jonathan Oxer < [email_address] >
own or lease? Introduction To DNS Jonathan Oxer < [email_address] >
trademarks and disputes Introduction To DNS Jonathan Oxer < [email_address] >
Introduction To DNS Jonathan Oxer < [email_address] >
alt roots (alternative DNS roots) Introduction To DNS Jonathan Oxer < [email_address] >
DNS works because we agree to let it work Introduction To DNS Jonathan Oxer < [email_address] >
alt roots are just alternative agreements Introduction To DNS Jonathan Oxer < [email_address] >
Introduction To DNS Jonathan Oxer < [email_address] >
critical concept alert! Introduction To DNS Jonathan Oxer < [email_address] >
authoritative vs recursive servers Introduction To DNS Jonathan Oxer < [email_address] >
authoritative servers answer questions about zones they own Introduction To DNS Jonathan Oxer < [email_address] >
recursive resolvers query other servers on your behalf Introduction To DNS Jonathan Oxer < [email_address] >
recursive lookups require multiple queries Introduction To DNS Jonathan Oxer < [email_address] >
Introduction To DNS Jonathan Oxer < [email_address] >
 
 
 
 
 
 
 
 
 
 
 
caching good! Introduction To DNS Jonathan Oxer < [email_address] >
caching bad! Introduction To DNS Jonathan Oxer < [email_address] >
beware the cache Introduction To DNS Jonathan Oxer < [email_address] >
caching: in the recursive DNS resolver Introduction To DNS Jonathan Oxer < [email_address] >
(Big Pond bad! Bad, I say!) Introduction To DNS Jonathan Oxer < [email_address] >
caching: in your OSs resolver library Introduction To DNS Jonathan Oxer < [email_address] >
caching: directly inside applications Introduction To DNS Jonathan Oxer < [email_address] >
(IE very bad too!) Introduction To DNS Jonathan Oxer < [email_address] >
internationalisation Introduction To DNS Jonathan Oxer < [email_address] >
anatomy of a zone[file] Introduction To DNS Jonathan Oxer < [email_address] >
; zone file for example.com. $TTL 2d ; 172800 TTL @ IN SOA ns1.example.com. hostmaster.example.com. ( 2007040304 ; serial 12h ; refresh 15m ; retry 3w ; expiry 3h ; minimum ) IN NS ns1.myprovider.com. IN NS ns1.example.com. IN MX 10 mail.example.net. homer IN A 192.168.254.3 marge IN A 192.168.12.15 www IN CNAME homer vpn IN CNAME marge Introduction To DNS Jonathan Oxer < [email_address] >
types of DNS records Introduction To DNS Jonathan Oxer < [email_address] >
“ A” (address) links names and IPv4 addresses Introduction To DNS Jonathan Oxer < [email_address] >
“ AAAA” (address) links names and IPv6 addresses Introduction To DNS Jonathan Oxer < [email_address] >
“ CNAME” (canonical name) aliases names to other names Introduction To DNS Jonathan Oxer < [email_address] >
“ MX” (mail exchange) name of machine for mail delivery Introduction To DNS Jonathan Oxer < [email_address] >
“ NS” (name server) name of DNS server for a zone Introduction To DNS Jonathan Oxer < [email_address] >
“ TXT” (text) arbitrary text string Introduction To DNS Jonathan Oxer < [email_address] >
“ NAPTR” (naming auth pointer) fun with regex Introduction To DNS Jonathan Oxer < [email_address] >
“ SOA” (start of authority) controls inter-server data synchronisation Introduction To DNS Jonathan Oxer < [email_address] >
SOA (Start Of Authority) Introduction To DNS Jonathan Oxer < [email_address] >
SOA sets TTL (Time To Live) Introduction To DNS Jonathan Oxer < [email_address] >
TTL says how long data may be cached Introduction To DNS Jonathan Oxer < [email_address] >
SOA parameters Serial : identifies version of SOA Introduction To DNS Jonathan Oxer < [email_address] >
SOA parameters Refresh : seconds between updates Introduction To DNS Jonathan Oxer < [email_address] >
SOA parameters Retry : seconds to wait after failure Introduction To DNS Jonathan Oxer < [email_address] >
SOA parameters Expire : seconds before data flushed Introduction To DNS Jonathan Oxer < [email_address] >
SOA parameters Minimum : used now for negative caching Introduction To DNS Jonathan Oxer < [email_address] >
circular dependencies: self-delegation Introduction To DNS Jonathan Oxer < [email_address] >
the solution: glue records Introduction To DNS Jonathan Oxer < [email_address] >
breaking your brain: reverse DNS Introduction To DNS Jonathan Oxer < [email_address] >
Let's look up 1.2.3.4! Introduction To DNS Jonathan Oxer < [email_address] >
4.3.2.1.in-addr.arpa. Introduction To DNS Jonathan Oxer < [email_address] >
security Introduction To DNS Jonathan Oxer < [email_address] >
DNS cache poisoning Introduction To DNS Jonathan Oxer < [email_address] >
Introduction To DNS Jonathan Oxer < [email_address] >
Practical example: Dr Evil wants to take over “ www.bigbank.com” Introduction To DNS Jonathan Oxer < [email_address] >
Dr Evil attack vector #1 redirecting the target domain's nameserver Introduction To DNS Jonathan Oxer < [email_address] >
(1) Dr Evil creates a sub-zone of a zone he controls, such as “ bigbank.dr-evil.com” Introduction To DNS Jonathan Oxer < [email_address] >
(2) Dr Evil delegates his evil zone to “ www.bigbank.com” Introduction To DNS Jonathan Oxer < [email_address] >
(3) Dr Evil configures his DNS server to return the wrong IP address for “www.bigbank.com” Introduction To DNS Jonathan Oxer < [email_address] >
(4) Dr Evil issues a DNS lookup for “ bigbank.dr-evil.com” to your DNS resolver Introduction To DNS Jonathan Oxer < [email_address] >
(5) Your DNS server caches the evil IP and uses it for future requests for “ www.bigbank.com” Introduction To DNS Jonathan Oxer < [email_address] >
what happened? request: bigbank.dr-evil.com. IN A response: Answer: (no response) Authority section: bigbank.dr-evil.com. 3600 IN NS www.bigbank.com. Additional section: www.bigbank.com. IN A 1.2.3.4 Introduction To DNS Jonathan Oxer < [email_address] >
what happened? request: bigbank.dr-evil.com. IN A response: Answer: (no response) Authority section: bigbank.dr-evil.com. 3600 IN NS www.bigbank.com. Additional section: www.bigbank.com. IN A 1.2.3.4 Introduction To DNS Jonathan Oxer < [email_address] >
what happened? request: bigbank.dr-evil.com. IN A response: Answer: (no response) Authority section: bigbank.dr-evil.com. 3600 IN NS www.bigbank.com. Additional section: www.bigbank.com. IN A 1.2.3.4 Introduction To DNS Jonathan Oxer < [email_address] >
what happened? request: bigbank.dr-evil.com. IN A response: Answer: (no response) Authority section: bigbank.dr-evil.com. 3600 IN NS www.bigbank.com. Additional section: www.bigbank.com. IN A 1.2.3.4 Introduction To DNS Jonathan Oxer < [email_address] >
Introduction To DNS Jonathan Oxer < [email_address] >
Dr Evil attack vector #2 redirect the NS record of the target domain Introduction To DNS Jonathan Oxer < [email_address] >
compare this with... request: bigbank.dr-evil.com. IN A response: Answer: (no response) Authority section: bigbank.dr-evil.com. 3600 IN NS www.bigbank.com. Additional section: www.bigbank.com. IN A 1.2.3.4 Introduction To DNS Jonathan Oxer < [email_address] >
...alternative attack request: bigbank.dr-evil.com. IN A response: Answer: (no response) Authority section: bigbank.com. 3600 IN NS ns.dr-evil.com. Additional section: ns.dr-evil.com. IN A 1.2.3.4 Introduction To DNS Jonathan Oxer < [email_address] >
Dr Evil attack vector #3 DNS forgery: respond before the real nameserver Introduction To DNS Jonathan Oxer < [email_address] >
not as easy as it sounds! Introduction To DNS Jonathan Oxer < [email_address] >
do a “ birthday attack” against the nonce value Introduction To DNS Jonathan Oxer < [email_address] >
Introduction To DNS Jonathan Oxer < [email_address] > Start with the Taylor series approximation to the probability of a “nonce” value collision where “n” is the number of attempts and “H” is the number of unique outputs: Invert the expression: Now assigning a 0.5 probability of collision: So it's obvious that for a 16 bit hash there are 65536 outputs, ie: only 301 attempts are required to generate a collision by brute force!
Introduction To DNS Jonathan Oxer < [email_address] > Start with the Taylor series approximation to the probability of a “nonce” value collision where “n” is the number of attempts and “H” is the number of unique outputs: Invert the expression: Now assigning a 0.5 probability of collision: So it's obvious that for a 16 bit hash there are 65536 outputs, ie: only 301 attempts are required to generate a collision by brute force!
Introduction To DNS Jonathan Oxer < [email_address] > Start with the Taylor series approximation to the probability of a “nonce” value collision where “n” is the number of attempts and “H” is the number of unique outputs: Invert the expression: Now assigning a 0.5 probability of collision: So it's obvious that for a 16 bit hash there are 65536 outputs, ie: only 301 attempts are required to generate a collision by brute force!
301 attempts against 2 x16 hash Introduction To DNS Jonathan Oxer < [email_address] >
secure zone transfers Introduction To DNS Jonathan Oxer < [email_address] >
(mis?)using DNS Introduction To DNS Jonathan Oxer < [email_address] >
TCP-over-DNS Introduction To DNS Jonathan Oxer < [email_address] >
dynamic DNS Introduction To DNS Jonathan Oxer < [email_address] >
SPF Introduction To DNS Jonathan Oxer < [email_address] >
useful tools nslookup Introduction To DNS Jonathan Oxer < [email_address] >
useful tools nslookup Introduction To DNS Jonathan Oxer < [email_address] >
useful tools whois Introduction To DNS Jonathan Oxer < [email_address] >
useful tools dig Introduction To DNS Jonathan Oxer < [email_address] >
DNS server software Introduction To DNS Jonathan Oxer < [email_address] >
authoritative and recursive: BIND, MaraDNS Introduction To DNS Jonathan Oxer < [email_address] >
authoritative: MyDNS, tinydns Introduction To DNS Jonathan Oxer < [email_address] >
recursive: dnscache Introduction To DNS Jonathan Oxer < [email_address] >
master vs slave Introduction To DNS Jonathan Oxer < [email_address] >
firewall issues port 53 UDP and TCP Introduction To DNS Jonathan Oxer < [email_address] >
Introduction To DNS Jonathan Oxer < [email_address] >
Introduction to DNS Thankyou :-) questions? Slid es: jon.oxer.com.au/talks Contact: Jonathan Oxer < [email_address] > We're hiring! www.ivt.com.au/jobs

More Related Content

PPT
ospf routing protocol
Ameer Agel
 
PPT
Dhcp presentation 01
maverick4489
 
PPTX
Rip presentation
Ebrahim AlRahawe
 
PPSX
ARP
selvakumar_b1985
 
PDF
VPN - Virtual Private Network
Peter R. Egli
 
PPTX
A very good introduction to IPv6
Syed Arshad
 
DOC
How to configure dns server(2)
Amandeep Kaur
 
PPTX
Cn ipv4 addressing
SangeethaSasi1
 
ospf routing protocol
Ameer Agel
 
Dhcp presentation 01
maverick4489
 
Rip presentation
Ebrahim AlRahawe
 
ARP
selvakumar_b1985
 
VPN - Virtual Private Network
Peter R. Egli
 
A very good introduction to IPv6
Syed Arshad
 
How to configure dns server(2)
Amandeep Kaur
 
Cn ipv4 addressing
SangeethaSasi1
 

What's hot (20)

PPTX
Domain name system
Siddharth Chandel
 
PDF
Presentation on Domain Name System
Chinmay Joshi
 
PDF
hpsr-2020-srv6-tutorial
Stefano Salsano
 
PDF
IPv6
Peter R. Egli
 
PPSX
Lesson 6: Dynamic Host Configuration Protocol A
Mahmmoud Mahdi
 
PPSX
DHCP
selvakumar_b1985
 
PDF
Ipv4 & ipv6
kamran_share
 
DOCX
Classful and classless addressing
Sourav Jyoti Das
 
PPTX
Bgp protocol
Smriti Tikoo
 
PPTX
Domain Name System DNS
Akshay Tiwari
 
PPTX
Presentation on arp protocol
Mohd. Ahmad Siddiqi
 
PDF
Ospf.ppt
Edgardo Scrimaglia
 
PPT
IP Addressing and subnetting
Ali Nezhad
 
PPTX
Dhcp
Sandeep Kamath
 
PPTX
Presentation on dns
Anand Grewal
 
PPTX
Advanced RF Design & Troubleshooting
Aruba, a Hewlett Packard Enterprise company
 
PDF
Transport layer services
Melvin Cabatuan
 
PPTX
Dns server
Subrata Kumer Paul
 
PPTX
Routing information protocol
Saranya Parthasarathy
 
PPT
Ch21
Wayne Jones Jnr
 
Domain name system
Siddharth Chandel
 
Presentation on Domain Name System
Chinmay Joshi
 
hpsr-2020-srv6-tutorial
Stefano Salsano
 
IPv6
Peter R. Egli
 
Lesson 6: Dynamic Host Configuration Protocol A
Mahmmoud Mahdi
 
DHCP
selvakumar_b1985
 
Ipv4 & ipv6
kamran_share
 
Classful and classless addressing
Sourav Jyoti Das
 
Bgp protocol
Smriti Tikoo
 
Domain Name System DNS
Akshay Tiwari
 
Presentation on arp protocol
Mohd. Ahmad Siddiqi
 
Ospf.ppt
Edgardo Scrimaglia
 
IP Addressing and subnetting
Ali Nezhad
 
Dhcp
Sandeep Kamath
 
Presentation on dns
Anand Grewal
 
Advanced RF Design & Troubleshooting
Aruba, a Hewlett Packard Enterprise company
 
Transport layer services
Melvin Cabatuan
 
Dns server
Subrata Kumer Paul
 
Routing information protocol
Saranya Parthasarathy
 
Ch21
Wayne Jones Jnr
 
Ad

Viewers also liked (20)

PPT
Remote Login
guest095022
 
PPT
Chap24
Waqas !!!!
 
PPTX
Osi model vs TCP/IP
Mannu Khani
 
PDF
DNS - Domain Name System
Peter R. Egli
 
PDF
I Have the Power(View)
Will Schroeder
 
PDF
PostgreSQL DBA Neler Yapar?
Gulcin Yildirim Jelinek
 
PDF
TTĂś Geeky Weekly
Gulcin Yildirim Jelinek
 
PPTX
150928 - Verisign Public DNS
Michael Kaczmarek
 
PPTX
OpenDNS Enterprise Web Content Filtering
OpenDNS
 
PDF
Managing Postgres with Ansible
Gulcin Yildirim Jelinek
 
PPTX
Remediating Violated Customers
Barry Greene
 
PPTX
DNS for Developers - NDC Oslo 2016
Maarten Balliauw
 
PPT
Indusrty Strategy For Action
Barry Greene
 
PDF
Are you ready for the next attack? reviewing the sp security checklist (apnic...
Barry Greene
 
PDF
Creating Domain Specific Languages in Python
Siddhi
 
PDF
Query-name Minimization and Authoritative Server Behavior
Shumon Huque
 
PDF
IoT Security in Action - Boston Sept 2015
Eurotech
 
PPTX
Approaches to application request throttling
Maarten Balliauw
 
PPTX
IDNOG - 2014
Barry Greene
 
PPT
DNS and Troubleshooting DNS issues in Linux
Konkona Basu
 
Remote Login
guest095022
 
Chap24
Waqas !!!!
 
Osi model vs TCP/IP
Mannu Khani
 
DNS - Domain Name System
Peter R. Egli
 
I Have the Power(View)
Will Schroeder
 
PostgreSQL DBA Neler Yapar?
Gulcin Yildirim Jelinek
 
TTĂś Geeky Weekly
Gulcin Yildirim Jelinek
 
150928 - Verisign Public DNS
Michael Kaczmarek
 
OpenDNS Enterprise Web Content Filtering
OpenDNS
 
Managing Postgres with Ansible
Gulcin Yildirim Jelinek
 
Remediating Violated Customers
Barry Greene
 
DNS for Developers - NDC Oslo 2016
Maarten Balliauw
 
Indusrty Strategy For Action
Barry Greene
 
Are you ready for the next attack? reviewing the sp security checklist (apnic...
Barry Greene
 
Creating Domain Specific Languages in Python
Siddhi
 
Query-name Minimization and Authoritative Server Behavior
Shumon Huque
 
IoT Security in Action - Boston Sept 2015
Eurotech
 
Approaches to application request throttling
Maarten Balliauw
 
IDNOG - 2014
Barry Greene
 
DNS and Troubleshooting DNS issues in Linux
Konkona Basu
 
Ad

Similar to Introduction to DNS (20)

PPT
Domain name system advanced power point presentation
rituchouhan1508
 
PPTX
DNS for Developers - ConFoo Montreal
Maarten Balliauw
 
PDF
Hands-on DNSSEC Deployment
Bangladesh Network Operators Group
 
PDF
Alternative Dns Servers Choice And Deployment And Optional Sql Ldap Backends ...
zemedaryely
 
PDF
2 technical-dns-workshop-day1
DNS Entrepreneurship Center
 
PDF
Dns
julien pauli
 
PDF
Domain Name System (DNS) Fundamentals
WebSniffer
 
PDF
Lets talk dns
Abhinav Mehta
 
PPTX
Introduction to DNS
MifrazMurthaja
 
PDF
DNS Fundamentals Presentation_PANDI-2022.pdf
roemahtoedjoeh
 
PDF
DNS (Domain Name System)
Shashidhara Vyakaranal
 
PPTX
DNS & SITES-SERVICES OF Active Directory.pptx
Dorcask3
 
PDF
DNS/DNSSEC by Nurul Islam
MyNOG
 
PPT
Lecture 6
webhostingguy
 
PPT
Lecture 6
webhostingguy
 
PPTX
Domain name system presentation
Anchit Dhingra
 
PPT
Introduction
hajafaarukh
 
PDF
Dns On Windows 2000 Second Matt Larson Cricket Liu
noukuikakoro
 
DOC
70 640
alokfit
 
PDF
Chapter4 configuringandmanagingthednsserverrole-140520003253-phpapp01
velimamedov
 
Domain name system advanced power point presentation
rituchouhan1508
 
DNS for Developers - ConFoo Montreal
Maarten Balliauw
 
Hands-on DNSSEC Deployment
Bangladesh Network Operators Group
 
Alternative Dns Servers Choice And Deployment And Optional Sql Ldap Backends ...
zemedaryely
 
2 technical-dns-workshop-day1
DNS Entrepreneurship Center
 
Dns
julien pauli
 
Domain Name System (DNS) Fundamentals
WebSniffer
 
Lets talk dns
Abhinav Mehta
 
Introduction to DNS
MifrazMurthaja
 
DNS Fundamentals Presentation_PANDI-2022.pdf
roemahtoedjoeh
 
DNS (Domain Name System)
Shashidhara Vyakaranal
 
DNS & SITES-SERVICES OF Active Directory.pptx
Dorcask3
 
DNS/DNSSEC by Nurul Islam
MyNOG
 
Lecture 6
webhostingguy
 
Lecture 6
webhostingguy
 
Domain name system presentation
Anchit Dhingra
 
Introduction
hajafaarukh
 
Dns On Windows 2000 Second Matt Larson Cricket Liu
noukuikakoro
 
70 640
alokfit
 
Chapter4 configuringandmanagingthednsserverrole-140520003253-phpapp01
velimamedov
 

More from Jonathan Oxer (13)

PDF
OSDcLang On Mobile Devices
Jonathan Oxer
 
PDF
Geek My Ride
Jonathan Oxer
 
PDF
Debian Package Caching Solutions
Jonathan Oxer
 
PDF
Software Freedom: Pragmatic Idealism?
Jonathan Oxer
 
PDF
Encrypted password storage
Jonathan Oxer
 
PDF
How to grow your eBusiness and build an online community
Jonathan Oxer
 
PDF
Self-Healing Databases
Jonathan Oxer
 
PDF
How To Build A Website And Stay Sane
Jonathan Oxer
 
PDF
Managing Source Code With Subversion
Jonathan Oxer
 
PDF
Large Scale PHP
Jonathan Oxer
 
PDF
PHP On Steroids
Jonathan Oxer
 
PDF
PHP Performance Profiling
Jonathan Oxer
 
PDF
Compiling kernels the Debian way
Jonathan Oxer
 
OSDcLang On Mobile Devices
Jonathan Oxer
 
Geek My Ride
Jonathan Oxer
 
Debian Package Caching Solutions
Jonathan Oxer
 
Software Freedom: Pragmatic Idealism?
Jonathan Oxer
 
Encrypted password storage
Jonathan Oxer
 
How to grow your eBusiness and build an online community
Jonathan Oxer
 
Self-Healing Databases
Jonathan Oxer
 
How To Build A Website And Stay Sane
Jonathan Oxer
 
Managing Source Code With Subversion
Jonathan Oxer
 
Large Scale PHP
Jonathan Oxer
 
PHP On Steroids
Jonathan Oxer
 
PHP Performance Profiling
Jonathan Oxer
 
Compiling kernels the Debian way
Jonathan Oxer
 

Recently uploaded (20)

PDF
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
PPTX
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
ReZa AdineH
 
PDF
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
SHREYAS PHANSE
 
PDF
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
PDF
Dropbox Q2 2025 Financial Results & Investor Presentation
Dropbox
 
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
PDF
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
IAESIJAI
 
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
PDF
Encapsulation theory and applications.pdf
gurumoop
 
PDF
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
PDF
CIFDAQ's Market Insight: SEC Turns Pro Crypto
CIFDAQ
 
PDF
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
PDF
Modernizing your data center with Dell and AMD
Principled Technologies
 
PPTX
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
PDF
Spectral efficient network and resource selection model in 5G networks
IAESIJAI
 
PDF
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
DOCX
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
PPTX
Cloud computing and distributed systems.
kkkkkhan
 
PPTX
A Presentation on Artificial Intelligence
memembruh336
 
How UI/UX Design Impacts User Retention in Mobile Apps.pdf
SynapseIndia
 
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
ReZa AdineH
 
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
SHREYAS PHANSE
 
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
Dropbox Q2 2025 Financial Results & Investor Presentation
Dropbox
 
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
IAESIJAI
 
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
Encapsulation theory and applications.pdf
gurumoop
 
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
CIFDAQ's Market Insight: SEC Turns Pro Crypto
CIFDAQ
 
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
Modernizing your data center with Dell and AMD
Principled Technologies
 
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
Spectral efficient network and resource selection model in 5G networks
IAESIJAI
 
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
Cloud computing and distributed systems.
kkkkkhan
 
A Presentation on Artificial Intelligence
memembruh336
 

Introduction to DNS

  • 1. Introduction To DNS everything you never wanted to know about IP directory services Linux Users Victoria, April 3 rd 2007 Jonathan Oxer <jon@ivt.com.au>
  • 2. what is the domain name system anyway? Introduction To DNS Jonathan Oxer < [email_address] >
  • 3. it's like a phone book ...kinda Introduction To DNS Jonathan Oxer < [email_address] >
  • 4. DNS is (1) a directory service Introduction To DNS Jonathan Oxer < [email_address] >
  • 5. DNS is (2) an identity mechanism Introduction To DNS Jonathan Oxer < [email_address] >
  • 6. DNS is (3) a namespace structure Introduction To DNS Jonathan Oxer < [email_address] >
  • 7. DNS is (4) an abstraction layer Introduction To DNS Jonathan Oxer < [email_address] >
  • 8. think of the phone book... Introduction To DNS Jonathan Oxer < [email_address] >
  • 9. maps hostnames to IP addresses Introduction To DNS Jonathan Oxer < [email_address] >
  • 10. maps jon.oxer.com.au to 221.133.213.151 Introduction To DNS Jonathan Oxer < [email_address] >
  • 11. forward vs reverse Introduction To DNS Jonathan Oxer < [email_address] >
  • 12. maps jon.oxer.com.au to 221.133.213.151 Introduction To DNS Jonathan Oxer < [email_address] >
  • 13. maps 221.133.213.151 to jon.oxer.com.au Introduction To DNS Jonathan Oxer < [email_address] >
  • 14. simple beginnings: hosts.txt Introduction To DNS Jonathan Oxer < [email_address] >
  • 15. ...but phone books Introduction To DNS Jonathan Oxer < [email_address] >
  • 16. ...but phone books don't Introduction To DNS Jonathan Oxer < [email_address] >
  • 17. ...but phone books don't Introduction To DNS Jonathan Oxer < [email_address] > scale
  • 18. so modern DNS is managed like a distributed phone book Introduction To DNS Jonathan Oxer < [email_address] >
  • 19. DNS is (5) delegation of authority Introduction To DNS Jonathan Oxer < [email_address] >
  • 20. a “zone” defines an area of authority Introduction To DNS Jonathan Oxer < [email_address] >
  • 21. think of it as an inverted tree Introduction To DNS Jonathan Oxer < [email_address] >
  • 22. Introduction To DNS Jonathan Oxer < [email_address] >
  • 23. anatomy of a host name Introduction To DNS Jonathan Oxer < [email_address] >
  • 24. (a host name is a record inside a domain name) Introduction To DNS Jonathan Oxer < [email_address] >
  • 25. read right to left: jon.oxer.com.au. Introduction To DNS Jonathan Oxer < [email_address] >
  • 26. yes, it really ends in a dot! Introduction To DNS Jonathan Oxer < [email_address] >
  • 27. root zone: jon.oxer.com.au . Introduction To DNS Jonathan Oxer < [email_address] >
  • 28. top level domain: jon.oxer.com .au . Introduction To DNS Jonathan Oxer < [email_address] >
  • 29. 2nd level zone: jon.oxer .com .au. Introduction To DNS Jonathan Oxer < [email_address] >
  • 30. 3rd level zone: jon .oxer .com.au. Introduction To DNS Jonathan Oxer < [email_address] >
  • 31. host name: jon .oxer.com.au. Introduction To DNS Jonathan Oxer < [email_address] >
  • 32. back to that dot: jon.oxer.com.au . Introduction To DNS Jonathan Oxer < [email_address] >
  • 33. “ ICANN's 13” : the A to M root servers Introduction To DNS Jonathan Oxer < [email_address] >
  • 34. root.hints Introduction To DNS Jonathan Oxer < [email_address] >
  • 35. “ There can be only 13” Introduction To DNS Jonathan Oxer < [email_address] >
  • 36. (UDP packets limited to 512B) Introduction To DNS Jonathan Oxer < [email_address] >
  • 37. A response with more than 13 entries > 512B Introduction To DNS Jonathan Oxer < [email_address] >
  • 38. root servers replicated globally using anycast Introduction To DNS Jonathan Oxer < [email_address] >
  • 39. Introduction To DNS Jonathan Oxer < [email_address] >
  • 40. root servers delegate ccTLDs, gTLDs, and iTLDs Introduction To DNS Jonathan Oxer < [email_address] >
  • 41. so what is this “ delegation” of which you speak? Introduction To DNS Jonathan Oxer < [email_address] >
  • 42. registries, registrars, resellers, registrants, InterNIC, ICANN, OpenSRS, oh my! Introduction To DNS Jonathan Oxer < [email_address] >
  • 43. Introduction To DNS Jonathan Oxer < [email_address] >
  • 44. ICANN controls the registries Introduction To DNS Jonathan Oxer < [email_address] >
  • 45. registries control the registrars Introduction To DNS Jonathan Oxer < [email_address] >
  • 46. registrars control delegations Introduction To DNS Jonathan Oxer < [email_address] >
  • 47. domain allocation policies Introduction To DNS Jonathan Oxer < [email_address] >
  • 48. own or lease? Introduction To DNS Jonathan Oxer < [email_address] >
  • 49. trademarks and disputes Introduction To DNS Jonathan Oxer < [email_address] >
  • 50. Introduction To DNS Jonathan Oxer < [email_address] >
  • 51. alt roots (alternative DNS roots) Introduction To DNS Jonathan Oxer < [email_address] >
  • 52. DNS works because we agree to let it work Introduction To DNS Jonathan Oxer < [email_address] >
  • 53. alt roots are just alternative agreements Introduction To DNS Jonathan Oxer < [email_address] >
  • 54. Introduction To DNS Jonathan Oxer < [email_address] >
  • 55. critical concept alert! Introduction To DNS Jonathan Oxer < [email_address] >
  • 56. authoritative vs recursive servers Introduction To DNS Jonathan Oxer < [email_address] >
  • 57. authoritative servers answer questions about zones they own Introduction To DNS Jonathan Oxer < [email_address] >
  • 58. recursive resolvers query other servers on your behalf Introduction To DNS Jonathan Oxer < [email_address] >
  • 59. recursive lookups require multiple queries Introduction To DNS Jonathan Oxer < [email_address] >
  • 60. Introduction To DNS Jonathan Oxer < [email_address] >
  • 61.  
  • 62.  
  • 63.  
  • 64.  
  • 65.  
  • 66.  
  • 67.  
  • 68.  
  • 69.  
  • 70.  
  • 71.  
  • 72. caching good! Introduction To DNS Jonathan Oxer < [email_address] >
  • 73. caching bad! Introduction To DNS Jonathan Oxer < [email_address] >
  • 74. beware the cache Introduction To DNS Jonathan Oxer < [email_address] >
  • 75. caching: in the recursive DNS resolver Introduction To DNS Jonathan Oxer < [email_address] >
  • 76. (Big Pond bad! Bad, I say!) Introduction To DNS Jonathan Oxer < [email_address] >
  • 77. caching: in your OSs resolver library Introduction To DNS Jonathan Oxer < [email_address] >
  • 78. caching: directly inside applications Introduction To DNS Jonathan Oxer < [email_address] >
  • 79. (IE very bad too!) Introduction To DNS Jonathan Oxer < [email_address] >
  • 80. internationalisation Introduction To DNS Jonathan Oxer < [email_address] >
  • 81. anatomy of a zone[file] Introduction To DNS Jonathan Oxer < [email_address] >
  • 82. ; zone file for example.com. $TTL 2d ; 172800 TTL @ IN SOA ns1.example.com. hostmaster.example.com. ( 2007040304 ; serial 12h ; refresh 15m ; retry 3w ; expiry 3h ; minimum ) IN NS ns1.myprovider.com. IN NS ns1.example.com. IN MX 10 mail.example.net. homer IN A 192.168.254.3 marge IN A 192.168.12.15 www IN CNAME homer vpn IN CNAME marge Introduction To DNS Jonathan Oxer < [email_address] >
  • 83. types of DNS records Introduction To DNS Jonathan Oxer < [email_address] >
  • 84. “ A” (address) links names and IPv4 addresses Introduction To DNS Jonathan Oxer < [email_address] >
  • 85. “ AAAA” (address) links names and IPv6 addresses Introduction To DNS Jonathan Oxer < [email_address] >
  • 86. “ CNAME” (canonical name) aliases names to other names Introduction To DNS Jonathan Oxer < [email_address] >
  • 87. “ MX” (mail exchange) name of machine for mail delivery Introduction To DNS Jonathan Oxer < [email_address] >
  • 88. “ NS” (name server) name of DNS server for a zone Introduction To DNS Jonathan Oxer < [email_address] >
  • 89. “ TXT” (text) arbitrary text string Introduction To DNS Jonathan Oxer < [email_address] >
  • 90. “ NAPTR” (naming auth pointer) fun with regex Introduction To DNS Jonathan Oxer < [email_address] >
  • 91. “ SOA” (start of authority) controls inter-server data synchronisation Introduction To DNS Jonathan Oxer < [email_address] >
  • 92. SOA (Start Of Authority) Introduction To DNS Jonathan Oxer < [email_address] >
  • 93. SOA sets TTL (Time To Live) Introduction To DNS Jonathan Oxer < [email_address] >
  • 94. TTL says how long data may be cached Introduction To DNS Jonathan Oxer < [email_address] >
  • 95. SOA parameters Serial : identifies version of SOA Introduction To DNS Jonathan Oxer < [email_address] >
  • 96. SOA parameters Refresh : seconds between updates Introduction To DNS Jonathan Oxer < [email_address] >
  • 97. SOA parameters Retry : seconds to wait after failure Introduction To DNS Jonathan Oxer < [email_address] >
  • 98. SOA parameters Expire : seconds before data flushed Introduction To DNS Jonathan Oxer < [email_address] >
  • 99. SOA parameters Minimum : used now for negative caching Introduction To DNS Jonathan Oxer < [email_address] >
  • 100. circular dependencies: self-delegation Introduction To DNS Jonathan Oxer < [email_address] >
  • 101. the solution: glue records Introduction To DNS Jonathan Oxer < [email_address] >
  • 102. breaking your brain: reverse DNS Introduction To DNS Jonathan Oxer < [email_address] >
  • 103. Let's look up 1.2.3.4! Introduction To DNS Jonathan Oxer < [email_address] >
  • 104. 4.3.2.1.in-addr.arpa. Introduction To DNS Jonathan Oxer < [email_address] >
  • 105. security Introduction To DNS Jonathan Oxer < [email_address] >
  • 106. DNS cache poisoning Introduction To DNS Jonathan Oxer < [email_address] >
  • 107. Introduction To DNS Jonathan Oxer < [email_address] >
  • 108. Practical example: Dr Evil wants to take over “ www.bigbank.com” Introduction To DNS Jonathan Oxer < [email_address] >
  • 109. Dr Evil attack vector #1 redirecting the target domain's nameserver Introduction To DNS Jonathan Oxer < [email_address] >
  • 110. (1) Dr Evil creates a sub-zone of a zone he controls, such as “ bigbank.dr-evil.com” Introduction To DNS Jonathan Oxer < [email_address] >
  • 111. (2) Dr Evil delegates his evil zone to “ www.bigbank.com” Introduction To DNS Jonathan Oxer < [email_address] >
  • 112. (3) Dr Evil configures his DNS server to return the wrong IP address for “www.bigbank.com” Introduction To DNS Jonathan Oxer < [email_address] >
  • 113. (4) Dr Evil issues a DNS lookup for “ bigbank.dr-evil.com” to your DNS resolver Introduction To DNS Jonathan Oxer < [email_address] >
  • 114. (5) Your DNS server caches the evil IP and uses it for future requests for “ www.bigbank.com” Introduction To DNS Jonathan Oxer < [email_address] >
  • 115. what happened? request: bigbank.dr-evil.com. IN A response: Answer: (no response) Authority section: bigbank.dr-evil.com. 3600 IN NS www.bigbank.com. Additional section: www.bigbank.com. IN A 1.2.3.4 Introduction To DNS Jonathan Oxer < [email_address] >
  • 116. what happened? request: bigbank.dr-evil.com. IN A response: Answer: (no response) Authority section: bigbank.dr-evil.com. 3600 IN NS www.bigbank.com. Additional section: www.bigbank.com. IN A 1.2.3.4 Introduction To DNS Jonathan Oxer < [email_address] >
  • 117. what happened? request: bigbank.dr-evil.com. IN A response: Answer: (no response) Authority section: bigbank.dr-evil.com. 3600 IN NS www.bigbank.com. Additional section: www.bigbank.com. IN A 1.2.3.4 Introduction To DNS Jonathan Oxer < [email_address] >
  • 118. what happened? request: bigbank.dr-evil.com. IN A response: Answer: (no response) Authority section: bigbank.dr-evil.com. 3600 IN NS www.bigbank.com. Additional section: www.bigbank.com. IN A 1.2.3.4 Introduction To DNS Jonathan Oxer < [email_address] >
  • 119. Introduction To DNS Jonathan Oxer < [email_address] >
  • 120. Dr Evil attack vector #2 redirect the NS record of the target domain Introduction To DNS Jonathan Oxer < [email_address] >
  • 121. compare this with... request: bigbank.dr-evil.com. IN A response: Answer: (no response) Authority section: bigbank.dr-evil.com. 3600 IN NS www.bigbank.com. Additional section: www.bigbank.com. IN A 1.2.3.4 Introduction To DNS Jonathan Oxer < [email_address] >
  • 122. ...alternative attack request: bigbank.dr-evil.com. IN A response: Answer: (no response) Authority section: bigbank.com. 3600 IN NS ns.dr-evil.com. Additional section: ns.dr-evil.com. IN A 1.2.3.4 Introduction To DNS Jonathan Oxer < [email_address] >
  • 123. Dr Evil attack vector #3 DNS forgery: respond before the real nameserver Introduction To DNS Jonathan Oxer < [email_address] >
  • 124. not as easy as it sounds! Introduction To DNS Jonathan Oxer < [email_address] >
  • 125. do a “ birthday attack” against the nonce value Introduction To DNS Jonathan Oxer < [email_address] >
  • 126. Introduction To DNS Jonathan Oxer < [email_address] > Start with the Taylor series approximation to the probability of a “nonce” value collision where “n” is the number of attempts and “H” is the number of unique outputs: Invert the expression: Now assigning a 0.5 probability of collision: So it's obvious that for a 16 bit hash there are 65536 outputs, ie: only 301 attempts are required to generate a collision by brute force!
  • 127. Introduction To DNS Jonathan Oxer < [email_address] > Start with the Taylor series approximation to the probability of a “nonce” value collision where “n” is the number of attempts and “H” is the number of unique outputs: Invert the expression: Now assigning a 0.5 probability of collision: So it's obvious that for a 16 bit hash there are 65536 outputs, ie: only 301 attempts are required to generate a collision by brute force!
  • 128. Introduction To DNS Jonathan Oxer < [email_address] > Start with the Taylor series approximation to the probability of a “nonce” value collision where “n” is the number of attempts and “H” is the number of unique outputs: Invert the expression: Now assigning a 0.5 probability of collision: So it's obvious that for a 16 bit hash there are 65536 outputs, ie: only 301 attempts are required to generate a collision by brute force!
  • 129. 301 attempts against 2 x16 hash Introduction To DNS Jonathan Oxer < [email_address] >
  • 130. secure zone transfers Introduction To DNS Jonathan Oxer < [email_address] >
  • 131. (mis?)using DNS Introduction To DNS Jonathan Oxer < [email_address] >
  • 132. TCP-over-DNS Introduction To DNS Jonathan Oxer < [email_address] >
  • 133. dynamic DNS Introduction To DNS Jonathan Oxer < [email_address] >
  • 134. SPF Introduction To DNS Jonathan Oxer < [email_address] >
  • 135. useful tools nslookup Introduction To DNS Jonathan Oxer < [email_address] >
  • 136. useful tools nslookup Introduction To DNS Jonathan Oxer < [email_address] >
  • 137. useful tools whois Introduction To DNS Jonathan Oxer < [email_address] >
  • 138. useful tools dig Introduction To DNS Jonathan Oxer < [email_address] >
  • 139. DNS server software Introduction To DNS Jonathan Oxer < [email_address] >
  • 140. authoritative and recursive: BIND, MaraDNS Introduction To DNS Jonathan Oxer < [email_address] >
  • 141. authoritative: MyDNS, tinydns Introduction To DNS Jonathan Oxer < [email_address] >
  • 142. recursive: dnscache Introduction To DNS Jonathan Oxer < [email_address] >
  • 143. master vs slave Introduction To DNS Jonathan Oxer < [email_address] >
  • 144. firewall issues port 53 UDP and TCP Introduction To DNS Jonathan Oxer < [email_address] >
  • 145. Introduction To DNS Jonathan Oxer < [email_address] >
  • 146. Introduction to DNS Thankyou :-) questions? Slid es: jon.oxer.com.au/talks Contact: Jonathan Oxer < [email_address] > We're hiring! www.ivt.com.au/jobs