Re: [Doh] DoT and DoH at Cambridge

Hi,

Thanks for this experiment, I'd been hoping someone would run it! Of
specific interest in terms of CPU sizing is how long the TLS connection
stays open, if and how it resumes the TLS connection later on and perhaps
what algorithms you see in use.

We are attempting to convince millions of user scale deployments to turn
this on but we can't yet give any estimate on CPU load. Knowing how
efficient the actual connections are would be very good.

Can you see?

Fwiw, Firefox appears to eke out only a few DNS connections per TCP/IP
connection before reconnecting (at least on doh.powerdns.org).

	Bert

On Thu, Sep 06, 2018 at 11:32:51AM +0100, Tony Finch wrote:
> Erik Kline <ek=40google.com@dmarc.ietf.org> wrote:
> >
> > Ben Schwartz can comment further on whether there's an experiment
> > ongoing or not.  However, these kind of queries are also used by the
> > DoT code in Pie to help validate whether the DoT answering thing
> > actually speaks DNS (as opposed to someone's random webserver they
> > left running or whatnot). I wouldn't have necessarily expected the
> > disparity between dnsotls queries and actual subsequent DoT traffic.
> > Hmm...
> 
> Yes, I thought at first that they were "tap tap tap is this thing on?"
> queries but the lack of followup real queries made me think otherwise.
> 
> I'm looking again now and there's a lot more real traffic, so it must have
> been just the time of day (early evening) when I was examining the traffic
> yesterday so there was a misleadingly low volume of traffic.
> 
> I should not be so quick to make inferences from too little data :-)
> 
> At the moment there's a roughy 1:10 ratio of probe queries to real
> queries, typical TLS session is 30-40 milliseconds.
> 
> Thanks for prompting me to look again!
> 
> (X-proxied-for support would make this a bit easier...)
> 
> Tony.
> -- 
> f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/
> democracy, participation, and the co-operative principle
> 
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh