Network Services 1-1 Overview of Internet and Network Services ECE7610/ECE7650
Jan 23, 2016
Network Services 1-1
Overview of Internet and Network Services
ECE7610/ECE7650
Network Services 1-2
Network Services 1-3
What’s the Internet: “nuts and bolts” view
millions of connected computing devices: hosts = end systems
running network apps communication links
fiber, copper, radio, satellite
transmission rate = bandwidth
routers: forward packets (chunks of data)
local ISP
companynetwork
regional ISP
router workstation
servermobile
Network Services 1-4
What’s the Internet: a service view Distributed applications:
Web, email, games, e-commerce, file sharing
Network protocols: used by applications to control sending, receiving of msgs: TCP, IP, HTTP, FTP, PPP Internet standards
• RFC: Request for comments• IETF: Internet Engineering Task
Force
Communication services provided to apps: Connectionless unreliable connection-oriented reliable
Network Services 1-5
A closer look at network structure: network edge:
applications and hosts network core:
routers network of networks
access networks, physical media: communication links
Network Services 1-6
The network edge: end systems (hosts):
run application programs e.g. Web, email at “edge of network”
Programs in end-systems use the serivce of the Internet to send msgs to each other client/server model
• client host requests, receives service from always-on server; e.g. web, email
peer-peer model:• minimal (or no) use of dedicated
servers• e.g. Gnutella, KaZaA, Skype, BitTorrent
Network Services 1-7
The Network Core
Physical connectivity of local area networks mesh of interconnected
routers Logical connectivity:
how is data transferred through net?
Network Services 1-8
Internet structure: network of networks
“Tier-2” ISPs: smaller (often regional) ISPs Connect to one or more tier-1 ISPs, possibly other tier-2 ISPs
NAPs (Network Access Points) are complex high-speed switching networks often concentrated at a single building. Operated by 3rd party telecom or Internet backbone ISP-1.
PoPs (Points of Presence) are private group of routers within each ISP and used to connect it (peer it) with other up/down/equal ISPs and is the new trend in connectivity.
Tier 1 ISP
Tier 1 ISP
Tier 1 ISP
NAP
Tier-2 ISPTier-2 ISP
Tier-2 ISP Tier-2 ISP
Tier-2 ISP
Tier-2 ISP pays tier-1 ISP for connectivity to rest of Internet, tier-2 ISP is customer oftier-1 provider
Tier-2 ISPs also peer privately with each other, interconnect at public NAPs or private POPs.
Network Services 1-9
Internet structure: network of networks
“Tier-3” ISPs and local ISPs last hop (“access”) network (closest to end systems)
Tier 1 ISP
Tier 1 ISP
Tier 1 ISP
NAP
Tier-2 ISPTier-2 ISP
Tier-2 ISP Tier-2 ISP
Tier-2 ISP
localISPlocal
ISPlocalISP
localISP
localISP Tier 3
ISP
localISP
localISP
localISP
Local and tier- 3 ISPs are customers ofhigher tier ISPsconnecting them to rest of Internet
Network Services 1-10
Tier-1 ISP: e.g., Sprint
Sprint US backbone network
Seattle
Atlanta
Chicago
Roachdale
Stockton
San Jose
Anaheim
Fort Worth
Orlando
Kansas City
CheyenneNew York
PennsaukenRelay
Wash. DC
Tacoma
DS3 (45 Mbps)OC3 (155 Mbps)OC12 (622 Mbps)OC48 (2.4 Gbps)
Network Services 1-11
ATT Global Backbone IP Network
From http://www.business.att.com
Network Services 1-12
MichNet: Statewide Backbone Nation’s longest-
running regional network
An 2.5 Gigabit (OC48c) backbone, with 24 backbone nodes
Two diverse 2.5 gigabit (2x OC48) to chicago
www.merit.edu/mn
Network Services 1-13
Internet protocol stack application: supporting network
applications FTP, SMTP, HTTP
transport: process-process data transfer TCP, UDP
network: host-host data transfer IP
link: data transfer between neighboring network elements PPP, Ethernet
physical: bits “on the wire”
application
transport
network
link
physical
Network Services 1-14
messagesegment
datagram
frame
sourceapplicatio
ntransportnetwork
linkphysical
HtHnHl M
HtHn M
Ht M
M
destination
application
transportnetwork
linkphysical
HtHnHl M
HtHn M
Ht M
M
networklink
physical
linkphysical
HtHnHl M
HtHn M
HtHnHl M
HtHn M
HtHnHl M HtHnHl M
router
switch
Encapsulation
Characteristics of Layering
Layering positives: Each layer relies on services from layer
below and exports services to layer above Interface defines interaction Hides implementation - layers can change
without disturbing other layers (black box)
Layering negatives: duplicate functionality and inter-dependency.
Network Services 1-15
Network Services 16
Examples of Network Services E-mail Web Instant messaging Remote login P2P file sharing Multi-user network
games Streaming stored
video clips
Internet telephone Real-time video
conference Massive parallel
computing
Network Services 17
Creating a network app
Write programs that run on different end
systems and communicate over a
network. e.g., Web: Web server
software communicates with browser software
little software written for devices in network core network core devices do
not run user application code
application on end systems allows for rapid app development, propagation
applicationtransportnetworkdata linkphysical
applicationtransportnetworkdata linkphysical
applicationtransportnetworkdata linkphysical
Network Services 18
Application architectures
Appl arch is designed by appl developers and dictates how the appl is organized over various end-systems
Types of organizations: Client-server (thin vs thick client) Peer-to-peer (P2P) Hybrid of client-server and P2P
Network Services 19
Client-server architectureserver:
waits to be contacted always-on have permanent IP
address server farms for scaling
clients: initiates communication can be thin (browser-only)
or thick (need more than a browser)
not always-on may have dynamic IP
addresses do not communicate
directly with each other
Client/Server
Web Server(e.g. IIS,Apache)
Application Server(e.g. WebSphere)
Database Server(e.g. DB2, Oracle)
Client/Client/Server
Google Data Centers
Estimated cost of data center: $600M Google spent $2.4B in 2007 on new
data centers Each data center uses 50-100
megawatts of power
1-20Network Services
Network Services 21
Pure P2P architecture
server is not always-on arbitrary end systems
directly communicate, without passing through special servers
peers are intermittently connected and change IP addresses
examples: Gnutella, KaZaa, Bitorrent
Highly scalableBut difficult to manage
P2P file sharing accounts for a major portion of all traffic
Network Services 22
Hybrid of client-server and P2PNapster Bitorrent
File transfer P2P File search centralized:
• Peers register content at central server• Peers query same central server to locate content
Instant messaging Chatting between two users is P2P Presence detection/location centralized:
• User registers its IP address with central server when it comes online
• User contacts central server to find IP addresses of buddies
Network Services 23
Processes communicating
Process: program running within a host. within same host, two processes
communicate using inter-process communication (IPC) (defined by OS).
processes in different hosts communicate by exchanging messages
A network appl consists of pairs of processes that send messages to each other over a network The process initiating the comm is labeled as client,
and the other waiting to be connected as server Applications with P2P architectures have
client processes & server processes A process assumes client and server roles in diff
time
Network Services 24
Sockets process sends/receives
messages to/from its socket socket analogous to door
sending process shoves msg out door
sending process relies on transport infrastructure on other side of door which brings message to socket at receiving process
Interface between the appl and transport layer within a host
process
TCP withbuffers,variables
socket
host orserver
process
TCP withbuffers,variables
socket
host orserver
Internet
controlledby OS
controlled byapp developer
Socket API available for developers: (1) choice of transport protocol; (2) ability to fix a few parameters. Everything else handled by the OS
Process naming: host IP addr + port number.
Network Services 25
Application layer protocol defines Types of messages
exchanged, e.g., request & response messages
Syntax of message types: what fields in messages & how fields are delineated
Semantics of the fields, i.e., meaning of information in fields
Rules for when and how processes send & respond to messages
Public-domain protocols:
defined in RFCs allows for
interoperability e.g., HTTP, SMTPProprietary protocols: e.g., KaZaA
Appl-layer protocol is one pieceof a network appl.
Network Services 26
What services does an application need?Data loss (Reliable transfer) some apps (e.g., audio) can
tolerate some loss other apps (e.g., file transfer,
telnet) require 100% reliable data transfer
Timing some apps (e.g., Internet
telephony, interactive games) require low delay to be “effective” (hard real-time)
Examples: no real-time (soft real-time)?
Bandwidth some apps (e.g.,
multimedia, bw-sensitive appl) require minimum amount of bandwidth to be “effective”
other apps (“elastic apps”) make use of whatever bandwidth they get. Exampes ??
Network Services 27
Service requirements of common apps
Application
file transfere-mail
Web documentsreal-time audio/video
stored audio/videointeractive gamesinstant messaging
Data loss
no lossno lossno lossloss-tolerant
loss-tolerantloss-tolerantno loss
Bandwidth
elasticelasticelasticaudio: 5kbps-1Mbpsvideo:10kbps-5Mbpssame as above few kbps upelastic
Time Sensitive
nononoyes, 100’s msec
yes, few secsyes, 100’s msecyes and no
Network Services 28
Internet transport protocols services
TCP service: connection-oriented: setup
required between client and server processes
reliable transport between sending and receiving process
flow control: sender won’t overwhelm receiver
congestion control: throttle sender when network overloaded
does not providing: timing, minimum bandwidth guarantees
UDP service: unreliable data transfer
between sending and receiving process
does not provide: connection setup, reliability, flow control, congestion control, timing, or bandwidth guarantee
Q: why bother? Why is there a UDP?
Network Services 29
Internet apps: application, transport protocols
Application
e-mailremote terminal access
Web file transfer
streaming multimedia
Internet telephony
Applicationlayer protocol
SMTP [RFC 2821]Telnet [RFC 854]HTTP [RFC 2616]FTP [RFC 959]proprietary(e.g. RealNetworks)proprietary(e.g., Dialpad)
Underlyingtransport protocol
TCPTCPTCPTCPTCP or UDP
typically UDP
Real-time applications are often run in UDP:they can tolerate some loss, butrequire a minimal rate
Network Services 30
Examples of Network Services E-mail Web and DNS Instant messaging Remote login P2P file sharing Multi-user network
games Streaming stored
video clips
Internet telephone Real-time video
conference Massive parallel
computing
Network Services 31
Web and HTTP
Web Application Client-server appl that allows clients to
obtain documents from web servers on demand
Components: • HTML document format• Web browsers: e.g. IE, firefox• Web servers: e.g Apache, • Appl-layer protocol: HTTP
HTTP protocol
Network Services 32
Web and HTTP (hyper-text transfer protocol)
Web page consists of objects Object can be HTML file, JPEG image, Java
applet, audio file,… Web page consists of base HTML-file which
includes several referenced objects Each object is addressable by a URL (Uniform
Resource Locator) Example URL:
http://www.someschool.edu/someDept/pic.gif
host name path nameprotocol
Network Services 33
HTTP overview
HTTP: hypertext transfer protocol Web’s application layer protocol Stateless Protocol client/server model
client: browser that requests, receives, “displays” Web objects
server: Web server sends objects in response to requests
HTTP 1.0: RFC 1945 HTTP 1.1: RFC 2616 (draft in
RFC2068) RFC2617: http authentication
RFC2616 revision started in Oct 06 W3.org/protocols/
PC runningExplorer
Server running
Apache Webserver
Mac runningNavigator
HTTP request
HTTP request
HTTP response
HTTP response
Network Services 34
HTTP overview (continued)
Uses TCP (transport layer protocol):
client initiates TCP connection (creates socket) to server, port 80
server accepts TCP connection from client
HTTP messages (application-layer protocol messages) exchanged between browser (HTTP client) and Web server (HTTP server)
TCP connection closed
HTTP is “stateless” server maintains no
information about past client requests
Protocols that maintain “state” are complex!
past history (state) must be maintained
if server/client crashes, their views of “state” may be inconsistent, must be reconciled
aside
Network Services 35
HTTP connectionsNonpersistent HTTP At most one object is sent over a TCP connection. HTTP/1.0 uses nonpersistent HTTP
Persistent HTTP Multiple objects can be sent over single TCP connection
between client and server. HTTP/1.1 uses persistent connections in default mode Connection established when the 1st web page is
requested and used for all subsequent pages/objects requests until a web server timeout value is reached.
Either the client or server can close the persistent connection by including the connection-token "close" in the Connection-header field of the http request/reply.
Network Services 36
Nonpersistent HTTPSuppose user enters URL www.ece.eng.wayne.edu/home.index
1a. HTTP client initiates TCP connection to HTTP server (process) at www.someSchool.edu on port 80
2. HTTP client sends HTTP request message (containing URL) into TCP connection socket. Message indicates that client wants object someDepartment/home.index
1b. HTTP server at host www.someSchool.edu waiting for TCP connection at port 80. “accepts” connection, notifying client
3. HTTP server receives request message, forms response message containing requested object, and sends message into its socket
time
(contains text, references to 10
jpeg images)
Network Services 37
Nonpersistent HTTP (cont.)
5. HTTP client receives response message containing html file, displays html. Parsing html file, finds 10 referenced jpeg objects
6. Steps 1-5 repeated for each of 10 jpeg objects
4. HTTP server closes TCP connection.
time
Network Services 38
Response time modeling
Definition of RTT (Round Trip Time): time to send a small packet to travel from client to server and back.
Response time: one RTT to initiate TCP
connection (always needed)
one RTT for HTTP request and first few bytes of HTTP response to return
file transmission timetotal = 2RTT+transmit time (depends
on file size and bandwidth)
time to transmit file
initiate TCPconnection
RTT
requestfile
RTT
filereceived
time time
Network Services 39
Persistent HTTP
Nonpersistent HTTP issues: requires 2 RTTs per object OS overhead for each TCP
connection browsers often open
parallel TCP connections to fetch referenced objects
Persistent HTTP server leaves connection
open after sending response
subsequent HTTP messages between same client/server sent over open connection
Persistent without pipelining: client issues new request
only when previous response has been received
one RTT for each referenced object
Persistent with pipelining: default in HTTP/1.1 client sends requests as
soon as it encounters a referenced object
as little as one RTT for all the referenced objects within the requested web page
Network Services 40
HTTP request message
two types of HTTP messages: request, response
HTTP request message: ASCII (human-readable format)
GET /somedir/page.html HTTP/1.1Host: www.someschool.edu User-agent: Mozilla/4.0Connection: close Accept-language:fr
(extra carriage return, line feed)
request line(GET, POST,
HEAD commands)
header lines
Carriage return, line feed
indicates end of message
Compare toConnection: Keep-Alive
Network Services 41
HTTP request message (RFC 2616): general format
Network Services 42
Uploading form input
Post method: Web page often
includes form input Input is uploaded to
server in entity body
URL method: Uses GET method Input is uploaded in
URL field of request line:
www.somesite.com/animalsearch?monkeys&banana
Network Services 43
Method types
HTTP/1.0 GET POST HEAD
asks server to leave requested object out of response (used mainly for debugging)
HTTP/1.1 GET, POST, HEAD PUT
uploads file in entity body to path specified in URL field
DELETE deletes file specified
in the URL field
Network Services 44
HTTP response message
HTTP/1.1 200 OK Connection: closeDate: Thu, 06 Aug 1998 12:00:15 GMT Server: Apache/1.3.0 (Unix) Last-Modified: Mon, 22 Jun 1998 …... Content-Length: 6821 Content-Type: text/html data data data data data ...
status line (protocolstatus code and phrase)
header lines
data, e.g., requested
HTML file
date at web serverwhen file was requested
file last modified date
Network Services 45
HTTP response status codes
200 OK request succeeded, requested object later in this
message
301 Moved Permanently requested object moved, new location specified later
in this message (Location:)
400 Bad Request request message not understood by server
404 Not Found requested document not found on this server
505 HTTP Version Not Supported
In first line in server->client response message.A few sample codes:
Network Services 46
Trying out HTTP (client side) for yourself
1. Telnet to your favorite Web server:
Opens TCP connection to port 80(default HTTP server port) at cis.poly.edu.Anything typed in sent to port 80 at cis.poly.edu
telnet ece.eng.wayne.edu 80
2. Type in a GET HTTP request:
GET /~czxu/test.html HTTP/1.1Host: ece.eng.wayne.edu
By typing this in (hit carriagereturn twice), you sendthis minimal (but complete) GET request to HTTP server
3. Look at response message sent by HTTP server!
Network Services 47
User-server state: cookies
Many major Web sites use cookies: 1) Persistent: file stays on users PC after
closing the browser.2) Non-Persistent (mostly used in J2EE
and .NET platforms): deleted when user closes browser or logs off the web site.
Four components:1) cookie header line of HTTP response
message2) cookie header line in HTTP request
message3) cookie file kept on user’s host,
managed by user’s browser4) back-end database at Web site
Example: Susan access
Internet always from same PC
She visits a specific e-commerce site for first time
When initial HTTP requests arrives at site, site creates a unique ID and creates an entry in backend database for ID
Network Services 48
Cookies: keeping “state” (cont.)
client server
usual http request msg
usual http response +Set-cookie: 1678
usual http request msgcookie: 1678
usual http response msg
usual http request msgcookie: 1678
usual http response msg
cookie-specificaction
cookie-spectificaction
servercreates ID
1678 for user
entry in backend
database
access
acce
ss
Cookie file
amazon: 1678ebay: 8734
Cookie file
ebay: 8734
Cookie file
amazon: 1678ebay: 8734
one week later:
Network Services 49
Cookies (continued)
What cookies can bring:
authorization shopping carts recommendations user session state
(Web e-mail)
Cookies and privacy: cookies permit sites to
learn a lot about you you may supply name and
e-mail to sites search engines use
redirection & cookies to learn yet more
advertising companies obtain info across sites
aside
Network Services 50
Web caches (proxy server)
user sets browser: Web accesses via cache
browser sends all HTTP requests to cache object in cache: cache
returns object else cache requests
object from origin server, then returns object to client
Goal: satisfy client request without involving origin server
client
Proxyserver
client
HTTP request
HTTP request
HTTP response
HTTP response
HTTP request
HTTP response
origin server
origin server
Network Services 51
More about Web caching
Cache acts as both client and server
Typically cache is installed by ISP (university, company, residential ISP)
Why Web caching? Reduce response time for
client request. Reduce traffic and hence
cost on an institution’s internet access link.
Internet dense with caches enables “poor” content providers to effectively deliver content (but so does P2P file sharing)
Network Services 52
HTTP Summary
HTTP request msg format and method types: GET, POST, HEAD, PUT, DELATE
HTTP response msg format and status codes
Cookies and their usage: Persistent vs Non-Persistent cookies
Web cache or proxy server: Conditional GET (If-modified-since:) in HTTP
header
Network Services 53
DNS: Domain Name System
People: many identifiers: SSN, name, passport #
Internet hosts, routers: IP address (32 or 128
bit) - used for addressing datagrams
“canonical name”, e.g., ww.yahoo.com - used by humans
Q: map between IP addresses and name ?
Domain Name System (DNS) is:
1- distributed database implemented in hierarchy of many name servers
2- application-layer protocol: host, routers and name servers communicate to resolve names (address/name translation). DNS protocol uses UDP transport protocol and port 53.
3- employed by other application layer protocols (HTTP, SMTP, FTP) to resolve host names.
Network Services 54
DNS Why not centralize
DNS? single point of
failure traffic volume distant centralized
database maintenance
doesn’t scale!
DNS services Hostname to IP address translation Host aliasing
Canonical (actual) and alias names (user-friendly): cwis-1.wayne.edu for alias www.wayne.edu
Mail server aliasing: mail server and web server can
share the same alias name. E.g. [email protected], wayne.edu
Load distribution Replicated Web servers: a set of IP
addresses for one canonical name. DNS returns the list of IPs for a name but rotated by 1 each time so the user can use the first listed IP.
Network Services 55
Root DNS Servers (13 servers labeled A-M)
com DNS servers org DNS servers edu DNS servers
poly.eduDNS servers
umass.eduDNS servers
yahoo.comDNS servers
amazon.comDNS servers
pbs.orgDNS servers
Distributed, Hierarchical Database
Each Client uses a local DNS server that does not belong to the hierarchy:
The local DNS is usually assigned by the DHCP server as part of the temporary IP assignment (run command: “ipconfig /all” to find your local DNS server).
Top-Level Domain Servers (TLDs)
Authoritative DNS servers
Network Services 56
DNS: Root name servers
b USC-ISI Marina del Rey, CAl ICANN Los Angeles, CA
e NASA Mt View, CAf Internet Software C. Palo Alto, CA (and 17 other locations)
i Autonomica, Stockholm (plus 3 other locations)
k RIPE London (also Amsterdam, Frankfurt)
m WIDE Tokyo
a Verisign, Dulles, VAc Cogent, Herndon, VA (also Los Angeles)d U Maryland College Park, MDg US DoD Vienna, VAh ARL Aberdeen, MDj Verisign, ( 11 locations)
There are 13 root DNS server world wide that are labeled A-M: map of root DNS, as of Oct 2006.
Network Services 57
TLD and Authoritative Servers Top-level domain (TLD) servers: responsible for
com, org, net, edu, etc, and all country code top-level domains (ccTLD) us, ca, in, cn, jp. Network solutions maintains servers for com TLD Educause for edu TLD
Authoritative DNS servers: organization’s with public names has DNS servers, providing authoritative hostname to IP mappings for organization’s servers (e.g., Web and mail). Can be maintained by organization or service provider
Network Services 58
Local Name Server
Does not strictly belong to hierarchy Each ISP (residential ISP, company,
university) has one. Also called “default name server”
When a host makes a DNS query, query is sent to its local DNS server Acts as a proxy, forwards query into
hierarchy.
Network Services 59
requesting hostX
Y
root DNS server
local DNS server
1
23
4
5
6
authoritative DNS server
78
TLD DNS server
Example of Typical DNS request
Client X wants IP address for Y Steps performed:1- Client sends DNS request to the local
DNS server to search on its behalf (recursive query)
2- local DNS contacts one of the root DNSs to resolve hostname Y.
3- root DNS returns the TLD DNS IP to local DNS
4- local DNS contacts one of the TLDs to get an Authoritative DNS nam
5- TLD returns IP of authoritative DNS to local DNS
6- local DNS contacts authoritative DNS to resolve X
7- authoritative DNS returns IP of Y8- local DNS return IP of Y to X
Query 1 is recursiveQueries 2, 4 and 6 are iterative
Example of recursive+iterative DNS query - typically used
Network Services 60
requesting host
requested host
root DNS server
local DNS server
1
2
45
6
authoritative DNS server
7
8
TLD DNS server
3
Recursive and Iterative DNS queries
recursive query: puts burden of name
resolution on contacted name server
heavy load?
iterative query: reply is directly returned
to requesting server “I don’t know this name,
but ask this server”
Example of pure recursive DNS query - not typically used
Network Services 61
DNS: caching and updating records once (any) name server learns mapping, it
caches mapping cache entries timeout (disappear) after
some time TLD servers typically cached in local name
servers• Thus root name servers not often visited
Client may also cache DNS names update/notify mechanisms under design by
IETF RFC 2136 http://www.ietf.org/html.charters/dnsind-charter.html
Network Services 62
hosts file
local file that is checked by the client DNS of the OS before sending a DNS request. It can speed the web access.
If the requested name is found in the hosts file then its corresponding IP is used.
Can be used to create custom (name-IP) entries. File Location:
windows XP: C:\WINDOWS\system32\drivers\etc most UNIX and Linux: /etc
File Structure: <IP address><space><name><space><# comment> Example of an entry: 127.0.0.1 localhost #default entry
Network Services 63
DNS recordsDNS: distributed db storing resource records (RR)
Type=NS name is domain (e.g. foo.com) value is hostname of authoritative
name server for this domain always in non-authoritative DNSs to
point to authoritative DNSs
RR format: (name, value, type, ttl)
Type=A name is hostname value is IP address always in authoritative DNS may be cached in non-authoritative
DNSs
Type=CNAME name is alias name for some “canonical”
(the real) name www.ibm.com is really servereast.backup2.ibm.com value is canonical name used by all hosts
Type=MX value is name of mailserver associated
with name that is usually an alias name
company can have a web server and a mail server with the same alias name. e.g. [wayne.edu mail.wayne.edu, MX]
TTL is time to live of the RR and determines when an RR should be removed from cache.
Network Services 64
DNS records with DNS servers
Authoritative DNSs for an institution: must contain Type A RRs for the institution’s public names and IPs. may contain Type MX RRs for the institution’s public mail server
names and IPs. may contain Type CNAME RRs if the institution has Canonical
names for its alias names. TLD DNSs
contain Type NS RRs with each organization’s public name is mapped to its authoritative DNS server names. There is usually a primary and secondary authoritative DNS servers.
contain Type A RRs with the Authoritative DNS server name and IP address.
Network Services 65
DNS protocol, messagesDNS protocol : query and reply messages, both with same message format
msg header identification: 16 bit #, query
and reply msgs use the same #
flags: query or reply 1 bit flag recursion desired or
available 1 bit reply is authoritative
Network Services 66
DNS protocol, messages
Name, type fields for a query
RRs in responseto query
records forauthoritative servers
additional “helpful”info that may be used
Network Services 67
Inserting records into DNS
Example: just created startup “Network Utopia” Register name networkuptopia.com at a registrar
(e.g., Network Solutions) Need to provide registrar with names and IP addresses
of your authoritative name server (primary and secondary)
Registrar inserts two RRs into the com TLD server:
(networkutopia.com, dns1.networkutopia.com, NS)(dns1.networkutopia.com, 212.212.212.1, A)
Put in authoritative server Type A record for www.networkuptopia.com and Type MX record for networkutopia.com
How do people get the IP address of your Web site?
Network Services 68
nslookup command and whois DB used to displays information that you can use to diagnose Domain
Name System (DNS) infrastructure. Contacts the specified DNS server to retrieve requested records.
nslookup <domain or IP to find> <DNS server name> Example: nslookup wayne.com whois database can be used to locate the corresponding registrar,
DNS server and IPs for a particular domain. Only registrars accredited by the Internet Corporation for Assigned
Names and Numbers (ICANN - non-profit org) are authorized to register .aero, .biz, .com, .coop, .info, .museum, .name, .net, .org, or .pro names.
.com whois database: http://www.internic.net/whois.html .edu whois database http://whois.educause.net/index.asp wayne.edu DNS name servers:
NS.WAYNE.EDU 141.217.1.15 NS2.WAYNE.EDU 141.217.1.13 DNS.MERIT.NET NS2.CS.WAYNE.EDU 141.217.16.10
Network Services 69
DNS Vulnerabilities DDoS bw-flooding attack against DNS server.
A large scale attack on 13 DNS root servers on Oct 21, 2002 by using ICMP ping messages
Block ICMP ping packets in packet filtering DNS queries attack
Hard to be filtered Mitigated by caching in local DNS servers
Man-in-the-middle attack Trick a server into bogus records into its cache Hard to implement, because it needs to intercept
packets Reflection attack on other hosts
Send queries with spoofed source addr of a target server
Network Services 70
DNS Summary DNS services:
Hostname to IP address translation Host aliasing, Mail server aliasing, Load distribution
DNS is hierarchical and distributed root DNS vs TLD vs Authoritative DNS vs local DNS recursive vs iterative DNS query DNS cache: local server caches TLDs so that root
servers are rarely visited DNS record types: A, NS, CNAME, MX DNS Query and Reply msg format is the same nslookup command and the whois database DNS vulnerabilities
Network Services 71
Examples of Network Services E-mail Web and DNS Instant messaging Remote login P2P file sharing Multi-user network
games Streaming stored
video clips
Internet telephone Real-time video
conference Massive parallel
computing