WIXLIB

DNSNames and IP addressesPeople: many identifiers: SSN, name, Passport #Internet hosts, routers: many identifiers too IP address (32 bit) - used for addressing datagrams“name”, e.g., www.google.org - used by humansQ: map between IP addresses and name ?DNS does.but before we talk about DNS lets talk more aboutnames and addresses!2: Application LayerNames and addresses:why both? One name may map to more than one IPaddress IP address: 216.239.57.101IP addresses are per network interfaceMultihomed machines have more than onenetwork interface - each with its own IPaddress Example: routers must be like this (Also Ethernet or other link-layer addresses.) IP addresses are fixed-size numbers. 32 bits. 216.239.57.101 11011000.11101111.111001.1100101 Names are memorizable, flexible: One IP address may map to more than onename Variable-length Many names for a single IP address. Change address doesn’t imply change name. iPv6 addresses are 128 bit – even harder to memorize! 2: Application LayerOne server machine may be the web server(www.foo,com), mail server (mail.foo.com)etc.2: Application Layer33How to get names andnumbers?How to get a machine name? Acquistion of Names and numbers are both First, get a domain name then you are freeregulated 32Mapping Not 1 to 1 Name: www.google.com 2: Application Layer3134to assign sub names in that domainWhy? How to get a domain name coming up Before you ask for a domain name though Should understand domain name structure Should also know that you are responsible forproviding authoritative DNS server (actually aprimary and one or more secondary DNSservers) for that domain and registrationinformation through “whois”2: Application Layer352: Application Layer366

Domain name structureTop-level Domains (TLDs)root (unnamed)com edu gov mil net org.frgrus ukgTLDsgoogleustreas.ccTLDssecond level (sub-)domains Country code Top Level Domains (ccTLDs) One for each countrygTLDs Generic Top Level DomainsccTLDs Country Code Top Level Domains2: Application Layer on for Assigned Names and Numbers(ICANN), was formed to assume responsibilityfrom the US Government ICANN authorizes other companies to registerdomains in com, org and net and new gTLDsNetwork Solutions is one of the largest and intransitional period between US Govt and ICANN hadsole authority to register domains in com, org and net Sign agreement Demonstrate 70,000 in working capital Yearly fee - 4000 for first TLD 500for each additional2: Application Layer40Internet RegistriesIf you want a block of IP addresses, go to anInternet Registry Answer 1: Normally, answer is get an IPRIPE NCC (Riseaux IP Europiens Network CoordinationCentre) for Europe, Middle-East, AfricaAPNIC (Asia Pacific Network Information Centre )for Asiaand PacificARIN (American Registry for Internet Numbers) for NorthAmerica, the Caribbean, sub-equatorial AfricaLACNIC – Latin American and Caribbean Registry (new10/2002)Note: Once again regional distribution is important forefficient routing!address from your upstream providerThis is essential to maintain efficient routing! Answer 2: If you need lots of IP addressesthen you can acquire your own block ofthem. tion.htm Application 2500 application fee39How to get an IP Address? 38Want to be a registrar? In 1998, non-profit corporation, Internet2: Application Layer2: Application Layer37How to get a domain name? Generic Top Level Domains (gTLDs) .com - commercial organizations .org - not-for-profit organizations .edu - educational organizations .mil - military organizations .gov - governmental organizations .net - network service providers New: .biz, .info, .name, Get them from a regional Internet registryCan also get Autonomous System Numbers (ASNsfrom these registries2: Application Layer412: Application Layer427

Obtaining a Block of IPaddressesCheckpoint Now you know both how to get a machine Price (ARIN,Jan 2003) http://www.arin.net/registration/fee schedule.html 2500/year for /20 ; 20000/year for a /14 /20 20 of the 32 bits in IP address are specified, 12bits free, 212 4096 possible hosts See why a /14 would be more expensive than a /20?name and how to get an IP address Now back to DNS – how to map from one tothe other! Can’t just pay and not use them IP address space is a scarce resource You must prove you have fully utilized a small blockbefore can ask for a larger one!2: Application Layer2: Application Layer43Mapping from name to IP Address?DNS: Domain Name SystemHow could we provide this service?Domain Name System: In the beginning, file containing mapping for all hosts copiedto each new host Size of file?Propagation of changes? Centralized DNS server? single point of failuretraffic volumedistant centralized databasemaintenance44distributed database implemented in hierarchy ofmany name serversapplication-layer protocol host, routers, nameservers to communicate to resolve names(address/name translation) note: core Internet function implemented asapplication-layer protocol complexity at network’s “edge”doesn’t scale! no server has all name-to-IP address mappings2: Application Layer2: Application Layer45Mapping Name Servers to“Zones”Name Server Zone Structurerootcom gov edulucentmil net orgrootfrgrus ukcom gov eduStructure based onadministrative issues.ustreasirs46Zone: subtree with commonadministration authority.wwwlucentcornellustreascustoms.irsRoot NSLucent NSUstreas NSIRS NSwww2: Application Layer472: Application Layer488

Local Name ServersKinds of Name ServersName server: process running on a host that processesDNS requests local name servers: each ISP, company has local (default) name server host DNS query first goes to local name server authoritative name server: can perform name/address translation for a specific domain orzone root name server: intermediate name server: Each host knows the IP address of a localNS. Each local NS knows the IP addresses ofall root NSs. Knows the authoritative server for each domain Authoritative servers for a large domain may hand off queriesto lower level name servers that are responsible for a portionof the domain2: Application Layer2: Application Layer49Authoritative Name ServersRoot Name Servers Authoritative name servers for a given How do local name servers find thedomain do not “cache” the translationinstead they are the official source fortranslating all machine names in thatdomain For each domain, there must be anauthoritative name server authoritative NS for a given domain? Local name servers contact root nameservers for the address of theauthoritative name server for a domainIn fact, must be at least two- a primary andsecondary2: Application LayerPutting it together 10 root name servers inthe Internet host surf.eurecom.frwants IP address ofgaia.cs.umass.eduA. ROOT-SERVERS.NETB.ROOT-SERVERS.NET in Europe ternic.net/domain/named.cache RFC 2870: Root Name25surf.eurecom.frServer OperationalRequirements2: Application Layer53What is wrong with this picture?52root name server1. Contacts its local DNSserver, dns.eurecom.fr2. dns.eurecom.fr contacts local name serverroot name server, ifdns.eurecom.frnecessary163. root name server contactsauthoritative name server,dns.umass.edu, ifnecessaryrequesting host Most in US, 1 in Japan, 2 2: Application Layer51Root name servers 5034authorititive name serverdns.umass.edugaia.cs.umass.edu2: Application Layer549

DNS: iterated queriesrecursive query:2 Contacted servercompletes translationitself Puts burden oncontacted serveriterated query:iterated query37local name serverintermediate name serverdns.umass.edudns.eurecom.fr158They aren’t really the authority for each sub domain butthey can point you to the authority!gaia.cs.umass.edu2: Application Layer72: Application Layer55root name server56DNS – Point of Failure How often are failures a result of DNS62 Root name serverto contact to findauthoritativename serverCouldn’t theauthoritative name servers for a big domain getoverloaded like the root? Or maybe it isinconvenient administratively for two sub domainsto share the same DNS server? We don’t want the root to have to rememberdifferent servers for sub domains. Give the root the name of an “intermediate nameserver” surf.eurecom.frIntermediate Name Serverintermediatename server: who6authoritative name serverdns.cs.umass.edurequesting hostRoot servers disable recursive queries!may not know thereal authoritativename server may know What about big domains?recursivequery4 contacted serverreplies with name ofserver to contact “I don’t know thisname, but ask thisserver” Takes burden offcontacted serversIntermediate Name Serversroot name server3failure?Make notes of IP addresses of commonmachines you use If can’t access, try instead accessing by IPaddress If you can - DNS failure somewhere local name serverdns.eurecom.fr18requesting hostintermediate name serverdns.umass.edu45authoritative name .edu2: Application LayerDNS: distributed db storing resource records (RR) DNS designed for fairly slow/infrequent changeto these mappings RR format:Changes made via external edits to a zone's MasterFileFaster more automatic update/notify mechanismsunder design by IETFaddress all the time – can update the translationof human readable name to that new IP address;DHCP in general Once a non-authoritative name server learns amapping, it caches the mapping (name, value, type,ttl) Type A One we’ve been discussing Maps name to IP address name is hostname value is IP addressProposed Standard: RFC 2136 Example: home machines that get a new IP 58DNS records: More than Name toIP AddressDNS UPDATE 2: Application Layer57 Other common ones? NS, MX, CNAME, PTR Lots more: SOA, HINFO, MB, MR, MG, WKS, RBcache entries timeout (disappear) after some timeWhat it change faster than cache entries time out?2: Application Layer592: Application Layer6010

DNS records: More than Name toIP Address Type NS name is domain (e.g.foo.com)value is IP address ofauthoritative name serverfor this domain (why notname?) Type MX value is hostname ofmailserver associated withnamePTR Records Type CNAME name is an alias namefor some “cannonical”(the real) name value is cannonicalname Do reverse mapping from IP address toname Why is that hard? Which name server isresponsible for that mapping? How do youfind them? Answer: special root domain, arpa, forreverse lookups Type PTR name is IP address (inspecial format) value is name Reverse of type A2: Application LayerArpa top level domainmil net orgIn-addrfrietf30gr Notice that 1.33.30.128.in-addr.arpa is writtenin order of increasing scope of authorityjust like www.irs.gov From largest scope of authority, gov, up tosingle machine www.irs.gov From largest scope of activity, arpa, up tosingle machine 1.33.30.128.in-addr.arpa (or128.30.33.1) nslookup –query any 1.33.30.128.in-addr.arpa?us ukwww.ietf.org.www12833162Why is it backwards?Want to know machine name for 128.30.33.1?Issue a PTR request for 1.33.30.128.in-addr.arparootarpa com gov edu2: Application Layer611.33.30.128.in-addr.arpa.2: Application Layer2: Application Layer63In-addr.arpa domain64DNS protocol, messagesDNS protocol : query and repy messages, both with samemessage format When an organization acquires a domainname, they receive authority over thecorresponding part of the domain namespace. When an organization acquires a block ofIP address space, they receive authorityover the corresponding part of the inaddr.arpa space. Example: Acquire domain berkeley.edu andacquire a class B IP Network ID 128.1432: Application Layermsg header identification: 16 bit # forquery, repy to query usessame # flags: query or reply recursion desired recursion available reply is authoritative reply was truncated65Sample query and response?2: Application Layer6611

UDP or TCPDNS protocol, messages DNS usually uses UDPName, type fieldsfor a query Doesn’t DNS need error control? Why is UDPusually ok? RRs in reponseto query records forauthoritative serversEach object small enough to go in one datagram – no needfor reorderRetransmission? Just instrument client to resend requestif doesn’t get a response When does DNS use TCP? Truncation bit; if reply too long, set truncate bit assignal to request using TCP Also for zone transfers from primary to secondaryservers (RFC still says try UDP first)additional “helpful”info that may be used BIND can be configured to only respond to a TCP2: Application Layer67request if a corresponding UDP request was madefirst2: Application LayerWhy not always TCP?HTTP vs DNS TCP has higher overhead 2 Round Trips per query rather than 1 Many apps that use UDP implement only thesubset of TCP functionality they really need Why is HTTP human readable and DNSnot?Saves space is the limited size of thequery/response packet HTTP used by an application focused on endusers; DNS used by an application focused onnetwork management? Better answer? Also UDP requires less state on server With TCP, each connection requires significantstate More prone to overload (denial of serviceattacks?)2: Application Layer2: Application Layer69nslookupSummary Use to query DNS servers (not telnet like with We looked at two application levelhttp – why?) Examples: nslookup www.yahoo.com HTTP runs on TCP Many IP addresses why? DNS usually runs on UDP (sometimes onnslookup –query mx gnu.orgnslookup 70protocols: HTTP and DNS Interactive and Non-interactive modes 68TCP)Enter interactive shellType a host name; get its IP address infols –d domain.name (rarely supported)set debug, set recurse, set norecurse, exit HTTP is human readable; DNS not2: Application Layer712: Application Layer7212

OuttakesOther DNS forwarding Way to say if don’t find it here look hereinstead Examples I used to be authoritative for this – now I’m not lookhere Also useful for reverse lookups when organizationsdon’t have a full class A/B/C address – say where elseto look for possible reverse name lookup Internal DNS server behind firewall and has fulltranslations within domain; External has publiclyvisible like web and mail servers; Internal isfirewalled off so forwards request for outside worldto external that queries the root servers etc2: Application Layer2: Application Layer73OtherDNS Notify Need to use TCP for DNS through Used by a master server to inform thefirewalls? Common DDOS attack on DNS is to sendTCP requests to a large array of serversaround the world for some zone that theyare not authoritative for. In turn,allthose servers then go and make a largenumber of TCP requests to that zone'sauthoritative server at once.2: Application Layerslave servers that they should ask for anupdate. Zone Transfers are typicallylimited to only allow the slave servers toreceive that zone. For that reason, usingthe "ls" feature in nslookup almost neverworks.76How do clients and serverscommunicate? Markup language give general layoutAPI: applicationprogramming interface defines interfacebetween applicationand transport layer socket: Internet APIguidelines - not exact placement or formatso browsers may display the samedocument differently Free form (i.e. Spaces don’t matter) Embedded tags give guidelines Tags often appear in pairs 2: Application Layer75HTML overview 74 beginning TAGNAME ending /TAGNAME two processescommunicate by sendingdata into socket,reading data out ofsocketQ: how does a process“identify” the otherprocess with which itwants to communicate? IP address of hostrunning other process“port number” - allowsreceiving host todetermine to whichlocal process themessage should bedelivered more on this later.2: Application Layer772: Application Layer7813

Sockets Specify TransportServicesQUICK LOOK AHEAD: TCP vs UDP Sockets define the interfaces between anTCP service:application and the transport layer Applications choose the type of transportlayer by choosing the type of socket UDP Sockets – called DatagramSocket in Java,SOCK DGRAM in C TCP Sockets – called Socket/ServerSocket inJava, SOCK STREAM in C Client and server agree on the type of socket, the server port number and theprotocol2: Application Layer79connection-oriented: setuprequired between client,serverreliable transport betweensending and receiving processflow control: sender won’toverwhelm receivercongestion control: throttlesender when neworkoverloadeddoes not providing: timing,minimum bandwidthguaranteesUDP service: unreliable data transferbetween sending andreceiving process does not provide:connection setup,reliability, flow control,congestion control, timing,or bandwidth guarantee2: Application Layer8014

server: response contains no object if cached copy up-to-date: HTTP/1.0 304 Not Modified client server http request msg If-modified-since: date http response HTTP/1.0 304 Not Modified object not modified http request msg If-modified-since: date http response HTTP/1.0 200 OK data object modified 2: Application Layer 20