Transcript Lecture #1 - Wayne State University

Overview of Internet and
Network Services
ECE7610/ECE7650
Network Services
1-1
Network Services
1-2
What’s the Internet: “nuts and bolts” view
 millions of connected
computing devices: hosts
= end systems
 running network apps
 communication links



router
server
workstation
mobile
local ISP
fiber, copper, radio,
satellite
transmission rate =
regional ISP
bandwidth
routers: forward packets
(chunks of data)
company
network
Network Services
1-3
What’s the Internet: a service view

Distributed applications:


Web, email, games, e-commerce,
file sharing
Network protocols: used by
applications to control sending,
receiving of msgs:


TCP, IP, HTTP, FTP, PPP
Internet standards
• RFC: Request for comments
• IETF: Internet Engineering Task
Force

Communication services
provided to apps:


Connectionless unreliable
connection-oriented reliable
Network Services
1-4
A closer look at network structure:
 network edge:
applications and
hosts
 network core:
routers
 network of
networks

 access networks,
physical media:
communication links
Network Services
1-5
The network edge:
 end systems (hosts):



run application programs
e.g. Web, email
at “edge of network”
 Programs in end-systems use the
serivce of the Internet to send msgs
to each other
 client/server model
• client host requests, receives service from
always-on server; e.g. web, email

peer-peer model:
• minimal (or no) use of dedicated servers
• e.g. Gnutella, KaZaA, Skype, BitTorrent
Network Services
1-6
The Network Core
 Physical connectivity of
local area networks

mesh of interconnected
routers
 Logical connectivity: how
is data transferred
through net?
Network Services
1-7
Internet structure: network of networks
 “Tier-2” ISPs: smaller (often regional) ISPs
 Connect to one or more tier-1 ISPs, possibly other tier-2 ISPs
NAPs (Network Access Points) are complex high-speed switching networks often
concentrated at a single building. Operated by 3rd party telecom or Internet backbone ISP-1.
 PoPs (Points of Presence) are private group of routers within each ISP and used to connect it
(peer it) with other up/down/equal ISPs and is the new trend in connectivity.
Tier-2 ISPs also
peer privately with
each other,
Tier-2 ISP
Tier-2 ISP pays
Tier-2 ISP
interconnect at
tier-1 ISP for
public NAPs or
connectivity to
private POPs.

rest of Internet,
tier-2 ISP is
customer of
tier-1 provider
Tier 1 ISP
Tier 1 ISP
Tier-2 ISP
NAP
Tier 1 ISP
Tier-2 ISP
Tier-2 ISP
Network Services
1-8
Internet structure: network of networks
 “Tier-3” ISPs and local ISPs
 last hop (“access”) network (closest to end systems)
local
ISP
Local and tier3 ISPs are
customers of
higher tier
ISPs
connecting
them to rest
of Internet
Tier 3
ISP
Tier-2 ISP
local
ISP
local
ISP
local
ISP
Tier-2 ISP
Tier 1 ISP
Tier 1 ISP
Tier-2 ISP
local
local
ISP
ISP
NAP
Tier 1 ISP
Tier-2 ISP
local
ISP
Tier-2 ISP
local
ISP
Network Services
1-9
Tier-1 ISP: e.g., Sprint
Sprint US backbone network
DS3 (45 Mbps)
OC3 (155 Mbps)
OC12 (622 Mbps)
OC48 (2.4 Gbps)
Seattle
Tacoma
Stockton
San Jose
Cheyenne
Kansas City
Chicago
Roachdale
New York
Pennsauken
Relay
Wash. DC
Anaheim
Atlanta
Fort Worth
Orlando
Network Services
1-10
ATT Global Backbone IP Network
From http://www.business.att.com
Network Services
1-11
MichNet: Statewide Backbone
 Nation’s longest-
running regional
network
 An 2.5 Gigabit
(OC48c) backbone,
with 24 backbone
nodes
 Two diverse 2.5
gigabit (2x OC48) to
chicago
 www.merit.edu/mn
Network Services
1-12
Internet protocol stack
 application: supporting network
applications

FTP, SMTP, HTTP
 transport: process-process data
transfer

TCP, UDP
 network: host-host data transfer
 IP
 link: data transfer between
neighboring network elements

application
transport
network
link
physical
PPP, Ethernet
 physical: bits “on the wire”
Network Services
1-13
source
message
segment Ht
datagram Hn Ht
frame
Hl Hn Ht
M
M
M
M
Encapsulation
application
transport
network
link
physical
Hl Hn Ht
M
link
physical
Hl Hn Ht
M
switch
destination
M
Ht
M
Hn Ht
Hl Hn Ht
M
M
application
transport
network
link
physical
Hn Ht
Hl Hn Ht
M
M
network
link
physical
Hn Ht
Hl Hn Ht
M
M
router
Network Services
1-14
Characteristics of Layering
 Layering positives:
Each layer relies on services from layer below
and exports services to layer above
 Interface defines interaction
 Hides implementation - layers can change
without disturbing other layers (black box)

 Layering negatives: duplicate functionality and
inter-dependency.
Network Services
1-15
Examples of Network Services
 E-mail
 Internet telephone
 Web
 Real-time video
 Instant messaging
 Remote login
 P2P file sharing
conference
 Massive parallel
computing
 Multi-user network
games
 Streaming stored
video clips
Network Services
16
Creating a network app
Write programs that



run on different end
systems and
communicate over a
network.
e.g., Web: Web server
software communicates
with browser software
little software written for
devices in network core


network core devices do
not run user application
code
application on end systems
allows for rapid app
development, propagation
application
transport
network
data link
physical
application
transport
network
data link
physical
application
transport
network
data link
physical
Network Services
17
Application architectures
 Appl arch is designed by appl developers
and dictates how the appl is organized over
various end-systems
 Types of organizations:
Client-server (thin vs thick client)
 Peer-to-peer (P2P)
 Hybrid of client-server and P2P

Network Services
18
Client-server architecture
server:
Client/Server




waits to be contacted
always-on
have permanent IP
address
server farms for scaling
clients:


Client/Client/Server
Web Server
(e.g. IIS,Apache)
Database Server
(e.g. DB2, Oracle)
Application Server
(e.g. WebSphere)



initiates communication
can be thin (browser-only)
or thick (need more than a
browser)
not always-on
may have dynamic IP
addresses
do not communicate
directly with each other
Network Services
19
Google Data Centers
 Estimated cost of data center: $600M
 Google spent $2.4B in 2007 on new data
centers
 Each data center uses 50-100 megawatts
of power
Network Services
1-20
Pure P2P architecture
 server is not always-on
 arbitrary end systems
directly communicate,
without passing through
special servers
 peers are intermittently
connected and change IP
addresses
 examples: Gnutella, KaZaa,
Bitorrent
Highly scalable
But difficult to manage
P2P file sharing accounts for
a major portion of all traffic
Network Services
21
Hybrid of client-server and P2P
Napster  Bitorrent
File transfer P2P
 File search centralized:

• Peers register content at central server
• Peers query same central server to locate content
Instant messaging
Chatting between two users is P2P
 Presence detection/location centralized:

• User registers its IP address with central server
when it comes online
• User contacts central server to find IP addresses of
buddies
Network Services
22
Processes communicating
Process: program running within a host.
 within same host, two processes communicate
using inter-process communication (IPC) (defined
by OS).
 processes in different hosts communicate by
exchanging messages
 A network appl consists of pairs of processes
that send messages to each other over a network

The process initiating the comm is labeled as client, and
the other waiting to be connected as server
 Applications with P2P architectures have client
processes & server processes

A process assumes client and server roles in diff time
Network Services
23
Sockets
 process sends/receives
messages to/from its socket
 socket analogous to door



sending process shoves msg out
door
sending process relies on
transport infrastructure on
other side of door which brings
message to socket at receiving
process
Interface between the appl and
transport layer within a host
host or
server
host or
server
process
controlled by
app developer
process
socket
socket
TCP with
buffers,
variables
Internet
TCP with
buffers,
variables
controlled
by OS
 Socket API available for developers: (1) choice of transport protocol; (2)
ability to fix a few parameters. Everything else handled by the OS
 Process naming: host IP addr + port number.
Network Services
24
Application layer protocol defines
 Types of messages
exchanged, e.g., request
& response messages
 Syntax of message
types: what fields in
messages & how fields
are delineated
 Semantics of the
fields, i.e., meaning of
information in fields
 Rules for when and how
processes send &
respond to messages
Public-domain protocols:
 defined in RFCs
 allows for
interoperability
 e.g., HTTP, SMTP
Proprietary protocols:
 e.g., KaZaA
Appl-layer protocol is one piece
of a network appl.
Network Services
25
What services does an application need?
Data loss (Reliable transfer)
 some apps (e.g., audio) can
tolerate some loss
 other apps (e.g., file transfer,
telnet) require 100% reliable
data transfer
Timing
 some apps (e.g., Internet
telephony, interactive
games) require low delay to
be “effective” (hard realtime)
 Examples: no real-time
(soft real-time)?
Bandwidth
 some apps (e.g.,
multimedia, bw-sensitive
appl) require minimum
amount of bandwidth to be
“effective”
 other apps (“elastic apps”)
make use of whatever
bandwidth they get.
Exampes ??
Network Services
26
Service requirements of common apps
Data loss
Bandwidth
Time Sensitive
file transfer
e-mail
Web documents
real-time audio/video
no loss
no loss
no loss
loss-tolerant
no
no
no
yes, 100’s msec
stored audio/video
interactive games
instant messaging
loss-tolerant
loss-tolerant
no loss
elastic
elastic
elastic
audio: 5kbps-1Mbps
video:10kbps-5Mbps
same as above
few kbps up
elastic
Application
yes, few secs
yes, 100’s msec
yes and no
Network Services
27
Internet transport protocols services
TCP service:





connection-oriented: setup
required between client and
server processes
reliable transport between
sending and receiving process
flow control: sender won’t
overwhelm receiver
congestion control: throttle
sender when network
overloaded
does not providing: timing,
minimum bandwidth
guarantees
UDP service:
 unreliable data transfer
between sending and
receiving process
 does not provide:
connection setup,
reliability, flow control,
congestion control, timing,
or bandwidth guarantee
Q: why bother? Why is
there a UDP?
Network Services
28
Internet apps: application, transport protocols
Application
e-mail
remote terminal access
Web
file transfer
streaming multimedia
Internet telephony
Application
layer protocol
Underlying
transport protocol
SMTP [RFC 2821]
Telnet [RFC 854]
HTTP [RFC 2616]
FTP [RFC 959]
proprietary
(e.g. RealNetworks)
proprietary
(e.g., Dialpad)
TCP
TCP
TCP
TCP
TCP or UDP
typically UDP
Real-time applications are often run in UDP:
they can tolerate some loss, but
require a minimal rate
Network Services
29
Examples of Network Services
 E-mail
 Internet telephone
 Web and DNS
 Real-time video
 Instant messaging
 Remote login
 P2P file sharing
conference
 Massive parallel
computing
 Multi-user network
games
 Streaming stored
video clips
Network Services
30
Web and HTTP
 Web Application
Client-server appl that allows clients to obtain
documents from web servers on demand
 Components:

•
•
•
•
HTML document format
Web browsers: e.g. IE, firefox
Web servers: e.g Apache,
Appl-layer protocol: HTTP
 HTTP protocol
Network Services
31
Web and HTTP (hyper-text transfer protocol)
 Web page consists of objects
 Object can be HTML file, JPEG image, Java
applet, audio file,…
 Web page consists of base HTML-file which
includes several referenced objects
 Each object is addressable by a URL (Uniform
Resource Locator)
 Example URL:
http://www.someschool.edu/someDept/pic.gif
protocol
host name
path name
Network Services
32
HTTP overview
HTTP: hypertext transfer
protocol
PC running
Explorer
 Web’s application layer protocol
 Stateless Protocol
 client/server model

client: browser that requests,
receives, “displays” Web objects
 server: Web server sends
objects in response to requests
 HTTP 1.0: RFC 1945
 HTTP 1.1: RFC 2616 (draft in
RFC2068)

Server
running
Apache Web
server
Mac running
Navigator
RFC2617: http authentication
 RFC2616 revision started in Oct 06

W3.org/protocols/
Network Services
33
HTTP overview (continued)
Uses TCP (transport layer
protocol):
 client initiates TCP
connection (creates socket)
to server, port 80
 server accepts TCP
connection from client
 HTTP messages (applicationlayer protocol messages)
exchanged between browser
(HTTP client) and Web
server (HTTP server)
 TCP connection closed
HTTP is “stateless”
 server maintains no
information about
past client requests
aside
Protocols that maintain “state” are
complex!
 past history (state) must be
maintained
 if server/client crashes, their
views of “state” may be
inconsistent, must be
reconciled
Network Services
34
HTTP connections
Nonpersistent HTTP
 At most one object is sent over a TCP connection.
 HTTP/1.0 uses nonpersistent HTTP
Persistent HTTP
 Multiple objects can be sent over single TCP connection
between client and server.
 HTTP/1.1 uses persistent connections in default mode
 Connection established when the 1st web page is requested
and used for all subsequent pages/objects requests until a web
server timeout value is reached.
 Either the client or server can close the persistent connection
by including the connection-token "close" in the Connectionheader field of the http request/reply.
Network Services
35
Nonpersistent HTTP
(contains text,
references to 10
jpeg images)
Suppose user enters URL
www.ece.eng.wayne.edu/home.index
1a. HTTP client initiates TCP
connection to HTTP server
(process) at
www.someSchool.edu on port 80
2. HTTP client sends HTTP request
message (containing URL) into
TCP connection socket. Message
indicates that client wants object
someDepartment/home.index
1b. HTTP server at host
www.someSchool.edu waiting
for TCP connection at port 80.
“accepts” connection, notifying
client
3. HTTP server receives request
message, forms response message
containing requested object, and
sends message into its socket
time
Network Services
36
Nonpersistent HTTP (cont.)
4. HTTP server closes TCP
5. HTTP client receives response
connection.
message containing html file,
displays html. Parsing html
file, finds 10 referenced jpeg
objects
time
6. Steps 1-5 repeated for each of 10
jpeg objects
Network Services
37
Response time modeling
Definition of RTT (Round Trip
Time): time to send a small
packet to travel from
client to server and back. initiate TCP
connection
Response time:
RTT
request
 one RTT to initiate TCP
connection (always needed) file
RTT
 one RTT for HTTP request
file
and first few bytes of
received
HTTP response to return
 file transmission time
time
time to
transmit
file
time
total = 2RTT+transmit time (depends on
file size and bandwidth)
Network Services
38
Persistent HTTP
Nonpersistent HTTP issues:
 requires 2 RTTs per object
 OS overhead for each TCP
connection
 browsers often open parallel
TCP connections to fetch
referenced objects
Persistent HTTP
 server leaves connection
open after sending response
 subsequent HTTP messages
between same client/server
sent over open connection
Persistent without pipelining:
 client issues new request
only when previous
response has been received
 one RTT for each
referenced object
Persistent with pipelining:
 default in HTTP/1.1
 client sends requests as
soon as it encounters a
referenced object
 as little as one RTT for
all the referenced objects
within the requested web
page
Network Services
39
HTTP request message
 two types of HTTP messages:
request, response
 HTTP request message:
 ASCII (human-readable format)
request line
(GET, POST,
HEAD commands)
GET /somedir/page.html HTTP/1.1
Host: www.someschool.edu
User-agent: Mozilla/4.0
Compare to
header Connection: close
Connection:
lines Accept-language:fr
Carriage return,
line feed
indicates end
of message
Keep-Alive
(extra carriage return, line feed)
Network Services
40
HTTP request message (RFC 2616):
general format
Network Services
41
Uploading form input
Post method:
 Web page often
includes form input
 Input is uploaded to
server in entity body
URL method:
 Uses GET method
 Input is uploaded in
URL field of request
line:
www.somesite.com/animalsearch?monkeys&banana
Network Services
42
Method types
HTTP/1.0
 GET
 POST
 HEAD

asks server to leave
requested object out of
response (used mainly
for debugging)
HTTP/1.1
 GET, POST, HEAD
 PUT

uploads file in entity
body to path specified
in URL field
 DELETE
 deletes file specified in
the URL field
Network Services
43
HTTP response message
status line (protocol
status code and phrase)
date at web server
when file was requested
file last modified date
header
lines
data, e.g.,
requested
HTML file
HTTP/1.1 200 OK
Connection: close
Date: Thu, 06 Aug 1998 12:00:15 GMT
Server: Apache/1.3.0 (Unix)
Last-Modified: Mon, 22 Jun 1998 …...
Content-Length: 6821
Content-Type: text/html
data data data data data ...
Network Services
44
HTTP response status codes
In first line in server->client response message.
A few sample codes:
200 OK

request succeeded, requested object later in this message
301 Moved Permanently

requested object moved, new location specified later in
this message (Location:)
400 Bad Request

request message not understood by server
404 Not Found

requested document not found on this server
505 HTTP Version Not Supported
Network Services
45
Trying out HTTP (client side) for yourself
1. Telnet to your favorite Web server:
telnet ece.eng.wayne.edu 80
Opens TCP connection to port 80
(default HTTP server port) at cis.poly.edu.
Anything typed in sent
to port 80 at cis.poly.edu
2. Type in a GET HTTP request:
GET /~czxu/test.html HTTP/1.1
Host: ece.eng.wayne.edu
By typing this in (hit carriage
return twice), you send
this minimal (but complete)
GET request to HTTP server
3. Look at response message sent by HTTP server!
Network Services
46
User-server state: cookies
Example:
Many major Web sites use cookies:
 Susan access
1) Persistent: file stays on users PC after
Internet always
closing the browser.
from same PC
2) Non-Persistent (mostly used in J2EE and
 She visits a specific
.NET platforms): deleted when user
e-commerce site for
closes browser or logs off the web site.
first time
Four components:
 When initial HTTP
1) cookie header line of HTTP response
requests arrives at
message
site, site creates a
2) cookie header line in HTTP request
unique ID and
message
creates an entry in
3) cookie file kept on user’s host,
backend database
managed by user’s browser
for ID
4) back-end database at Web site
Network Services
47
Cookies: keeping “state” (cont.)
client
Cookie file
server
usual http request msg
usual http response +
ebay: 8734
Cookie file
amazon: 1678
ebay: 8734
Set-cookie: 1678
usual http request msg
cookie: 1678
usual http response msg
server
creates ID
1678 for user
cookiespecific
action
one week later:
Cookie file
amazon: 1678
ebay: 8734
usual http request msg
cookie: 1678
usual http response msg
cookiespectific
action
Network Services
48
Cookies (continued)
What cookies can bring:
 authorization
 shopping carts
 recommendations
 user session state
(Web e-mail)
aside
Cookies and privacy:
 cookies permit sites to
learn a lot about you
 you may supply name and
e-mail to sites
 search engines use
redirection & cookies to
learn yet more
 advertising companies
obtain info across sites
Network Services
49
Web caches (proxy server)
Goal: satisfy client request without involving origin server
 user sets browser: Web
origin
server
accesses via cache
 browser sends all HTTP
requests to cache


object in cache: cache
returns object
else cache requests
object from origin
server, then returns
object to client
Proxy
server
client
client
origin
server
Network Services
50
More about Web caching
 Cache acts as both client
and server
 Typically cache is installed
by ISP (university,
company, residential ISP)
Why Web caching?
 Reduce response time for
client request.
 Reduce traffic and hence
cost on an institution’s
internet access link.
 Internet dense with caches
enables “poor” content
providers to effectively
deliver content (but so
does P2P file sharing)
Network Services
51
HTTP Summary
 HTTP request msg format and method
types:

GET, POST, HEAD, PUT, DELATE
 HTTP response msg format and status
codes
 Cookies and their usage:

Persistent vs Non-Persistent cookies
 Web cache or proxy server:
 Conditional GET (If-modified-since:) in HTTP
header
Network Services
52
DNS: Domain Name System
People: many identifiers:

SSN, name, passport #
Internet hosts, routers:


IP address (32 or 128
bit) - used for
addressing datagrams
“canonical name”, e.g.,
ww.yahoo.com - used by
humans
Q: map between IP
addresses and name ?
Domain Name System
(DNS) is:
1- distributed database
implemented in hierarchy of
many name servers
2- application-layer protocol:
host, routers and name
servers communicate to
resolve names (address/name
translation). DNS protocol
uses UDP transport protocol
and port 53.
3- employed by other application
layer protocols (HTTP, SMTP,
FTP) to resolve host names.
Network Services
53
DNS
DNS services
 Hostname to IP address translation
 Host aliasing

Canonical (actual) and alias names
(user-friendly): cwis-1.wayne.edu for
alias www.wayne.edu
 Mail server aliasing:


mail server and web server can share
the same alias name.
E.g. [email protected], wayne.edu
 Load distribution

Why not centralize
DNS?
 single point of failure
 traffic volume
 distant centralized
database
 maintenance
doesn’t scale!
Replicated Web servers: a set of IP
addresses for one canonical name.
DNS returns the list of IPs for a
name but rotated by 1 each time so
the user can use the first listed IP.
Network Services
54
Distributed, Hierarchical Database
Root DNS Servers (13 servers labeled A-M)
Top-Level Domain
Servers (TLDs)
com DNS servers
Authoritative
DNS servers
yahoo.com amazon.com
DNS servers DNS servers
org DNS servers
pbs.org
DNS servers
edu DNS servers
poly.edu
umass.edu
DNS serversDNS servers
Each Client uses a local DNS server that does not belong to the
hierarchy:
 The local DNS is usually assigned by the DHCP server as part of
the temporary IP assignment (run command: “ipconfig /all” to find
your local DNS server).
Network Services
55
DNS: Root name servers
There are 13 root DNS server world wide that are
labeled A-M: map of root DNS, as of Oct 2006.
a Verisign, Dulles, VA
c Cogent, Herndon, VA (also Los Angeles)
d U Maryland College Park, MD
g US DoD Vienna, VA
h ARL Aberdeen, MD
j Verisign, ( 11 locations)
k RIPE London (also Amsterdam, Frankfurt)
i Autonomica, Stockholm (plus 3 other
locations)
m WIDE Tokyo
e NASA Mt View, CA
f Internet Software C. Palo Alto, CA (and
17 other locations)
b USC-ISI Marina del Rey, CA
l ICANN Los Angeles, CA
Network Services
56
TLD and Authoritative Servers
 Top-level domain (TLD) servers: responsible for com,
org, net, edu, etc, and all country code top-level
domains (ccTLD) us, ca, in, cn, jp.


Network solutions maintains servers for com TLD
Educause for edu TLD
 Authoritative DNS servers: organization’s with public
names has DNS servers, providing authoritative
hostname to IP mappings for organization’s servers
(e.g., Web and mail).

Can be maintained by organization or service provider
Network Services
57
Local Name Server
 Does not strictly belong to hierarchy
 Each ISP (residential ISP, company,
university) has one.

Also called “default name server”
 When a host makes a DNS query, query is
sent to its local DNS server

Acts as a proxy, forwards query into hierarchy.
Network Services
58
Example of Typical DNS request
Client X wants IP address for Y
 Steps performed:
1- Client sends DNS request to the local DNS
server to search on its behalf (recursive
query)
2- local DNS contacts one of the root DNSs to
resolve hostname Y.
root DNS server

3- root DNS returns the TLD DNS IP to
local DNS
4- local DNS contacts one of the TLDs
to get an Authoritative DNS nam
5- TLD returns IP of authoritative DNS
to local DNS
6- local DNS contacts authoritative DNS
to resolve X
7- authoritative DNS returns IP of Y
8- local DNS return IP of Y to X
Query 1 is recursive
Queries 2, 4 and 6 are iterative
2
3
TLD DNS server
4
5
local DNS server
1
8
7
6
authoritative DNS server
requesting host
X
Y
Example of recursive+iterative DNS query
- typically used
Network Services
59
Recursive and Iterative DNS
queries
root DNS server
recursive query:
2
 puts burden of name
resolution on contacted
name server
 heavy load?
3
7
6
TLD DNS server
local DNS server
iterative query:
 reply is directly returned
to requesting server
 “I don’t know this name,
but ask this server”
5
1
4
8
authoritative DNS server
requesting host
requested host
Example of pure recursive DNS query not typically used
Network Services
60
DNS: caching and updating records
 once (any) name server learns mapping, it
caches
mapping
 cache entries timeout (disappear) after some
time
 TLD servers typically cached in local name
servers
• Thus root name servers not often visited
Client may also cache DNS names
 update/notify mechanisms under design by IETF


RFC 2136

http://www.ietf.org/html.charters/dnsind-charter.html
Network Services
61
hosts file
 local file that is checked by the client DNS of the OS before
sending a DNS request. It can speed the web access.
 If the requested name is found in the hosts file then its
corresponding IP is used.
 Can be used to create custom (name-IP) entries.
 File Location:


windows XP: C:\WINDOWS\system32\drivers\etc
most UNIX and Linux: /etc
 File Structure:


<IP address><space><name><space><# comment>
Example of an entry: 127.0.0.1
localhost #default entry
Network Services
62
DNS records
DNS: distributed db storing resource records (RR)
RR format: (name, value, type, ttl)
 Type=A
 name is hostname
 value is IP address
 always in authoritative DNS
 may be cached in non-authoritative
DNSs
 Type=CNAME
 name is alias name for some “canonical”
(the real) name
www.ibm.com is really
servereast.backup2.ibm.com
 value is canonical name
 used by all hosts
Type=NS
 name is domain (e.g. foo.com)
 Type=MX
 value is name of mailserver associated
 value is hostname of
with name that is usually an
authoritative name server for this
alias name
domain
 company can have a web server and a mail
 always in non-authoritative DNSs
server with the same alias name. e.g.
to point to authoritative DNSs
[wayne.edu mail.wayne.edu, MX]
TTL is time to live of the RR and determines
when an RR should be removed from cache.
Network Services
63

DNS records with DNS servers
 Authoritative DNSs for an institution:



must contain Type A RRs for the institution’s public names and IPs.
may contain Type MX RRs for the institution’s public mail server
names and IPs.
may contain Type CNAME RRs if the institution has Canonical
names for its alias names.
 TLD DNSs


contain Type NS RRs with each organization’s public name is
mapped to its authoritative DNS server names. There is usually a
primary and secondary authoritative DNS servers.
contain Type A RRs with the Authoritative DNS server name and IP
address.
Network Services
64
DNS protocol, messages
DNS protocol : query and reply messages, both with
same message format
msg header
 identification: 16 bit #, query
and reply msgs use the same
#
 flags:
 query or reply 1 bit flag
 recursion desired or
available 1 bit
 reply is authoritative
Network Services
65
DNS protocol, messages
Name, type fields
for a query
RRs in response
to query
records for
authoritative servers
additional “helpful”
info that may be used
Network Services
66
Inserting records into DNS
 Example: just created startup “Network Utopia”
 Register name networkuptopia.com at a registrar
(e.g., Network Solutions)


Need to provide registrar with names and IP addresses of
your authoritative name server (primary and secondary)
Registrar inserts two RRs into the com TLD server:
(networkutopia.com, dns1.networkutopia.com, NS)
(dns1.networkutopia.com, 212.212.212.1, A)
 Put in authoritative server Type A record for
www.networkuptopia.com and Type MX record for
networkutopia.com
 How do people get the IP address of your Web site?
Network Services
67
nslookup command and whois DB
 used to displays information that you can use to diagnose Domain







Name System (DNS) infrastructure. Contacts the specified DNS
server to retrieve requested records.
nslookup <domain or IP to find> <DNS server name>
Example: nslookup wayne.com
whois database can be used to locate the corresponding registrar,
DNS server and IPs for a particular domain.
Only registrars accredited by the Internet Corporation for Assigned
Names and Numbers (ICANN - non-profit org) are authorized to
register .aero, .biz, .com, .coop, .info, .museum, .name, .net, .org, or .pro
names.
.com whois database: http://www.internic.net/whois.html
.edu whois database http://whois.educause.net/index.asp
wayne.edu DNS name servers:
NS.WAYNE.EDU
NS2.WAYNE.EDU
DNS.MERIT.NET
NS2.CS.WAYNE.EDU
141.217.1.15
141.217.1.13
141.217.16.10
Network Services
68
DNS Vulnerabilities
 DDoS bw-flooding attack against DNS server.
 A large scale attack on 13 DNS root servers on Oct 21,
2002 by using ICMP ping messages
 Block ICMP ping packets in packet filtering
 DNS queries attack
 Hard to be filtered
 Mitigated by caching in local DNS servers
 Man-in-the-middle attack
 Trick a server into bogus records into its cache
 Hard to implement, because it needs to intercept packets
 Reflection attack on other hosts
 Send queries with spoofed source addr of a target
server
Network Services
69
DNS Summary
 DNS services:
 Hostname to IP address translation
 Host aliasing, Mail server aliasing, Load distribution
 DNS is hierarchical and distributed
 root DNS vs TLD vs Authoritative DNS vs local DNS
 recursive vs iterative DNS query
 DNS cache: local server caches TLDs so that root




servers are rarely visited
DNS record types: A, NS, CNAME, MX
DNS Query and Reply msg format is the same
nslookup command and the whois database
DNS vulnerabilities
Network Services
70
Examples of Network Services
 E-mail
 Internet telephone
 Web and DNS
 Real-time video
 Instant messaging
 Remote login
 P2P file sharing
conference
 Massive parallel
computing
 Multi-user network
games
 Streaming stored
video clips
Network Services
71