[dnsext] measurements using the EDNS-Client-Subnet extension

Florian Streibelt <florian@inet.tu-berlin.de> Mon, 08 July 2013 08:42 UTC

Date: Mon, 08 Jul 2013 10:39:38 +0200
From: Florian Streibelt <florian@inet.tu-berlin.de>
To: dnsext@ietf.org
Message-ID: <20130708103938.0a685dfa@fls-nb.lan.streibelt.net>
Organization: FG INET, T-Labs
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: [dnsext] measurements using the EDNS-Client-Subnet extension
Precedence: list

My mail from Wed, 26 Jun 2013 18:01:31 +0200 did not came through:

Hello,

in our work with the EDNS-Client-Subnet extension we noticed that it offers unique measurement
opportunities. Below you find the abstract to our paper on "Unintended Consequences:
Exploring EDNS-Client-Subnet Adopters in your Free Time" where we used the client IP
extension to explore the mapping of client-IP's to server-IP's in CDNs including google and
edgcast.

We mentioned this to Ted Lemon and Andrew Sullivan, who suggested that this work may be of interest to
the wider audience of both DNS related working groups (sorry for cross posting).

As the next IETF meeting is in Berlin (and we are based in Berlin) I would be happy taking
the chance of presenting the paper at the upcoming meeting. Any comments?


cheers,
  Florian


Abstract of "Unintended Consequences: Exploring EDNS-Client-Subnet Adopters in your Free Time";

The recently proposed DNS extension, EDNS-Client-Subnet (ECS), has been quickly
adopted by major Internet companies such as Google to better assign user
requests to their servers and improve end-user experience.  
In this paper, we show that the adoption of ECS also offers unique, but likely
unintended, opportunities to uncover details about these companies' operational
practices at almost no cost.  A key observation is that ECS allows everyone to
resolve domain names of ECS adopters on behalf of any arbitrary IP/prefix in the
Internet. In fact, by utilizing only a single residential vantage point and
relying solely on publicly available information, we are able to (i) uncover
the global footprint of ECS adopters with very little effort, (ii) infer the
DNS response cacheability and end-user clustering of ECS adopters for an arbitrary
network in the Internet, and (iii) reveal the mapping of users to server
locations as practiced by major ECS adopters.  While pointing out such new
measurement opportunities, our work is also intended to make current and future
ECS adopters aware of which operational information gets exposed when utilizing
this recent DNS extension.


-- 
Florian Streibelt
Chair "Intelligent Networks" (INET)
TEL 16
Technische Universität Berlin
Ernst-Reuter-Platz 7
10587 Berlin
GERMANY

[dnsext] measurements using the EDNS-Client-Subne… Florian Streibelt