NANOG Meeting Presentation Abstract

Passive Detection of Misbehaving Name Servers
Meeting:	NANOG59
Date / Time:	2013-10-07 3:00pm - 3:30pm
Room:	Akimel Ballroom 3 & 4
Presenters:	Speakers: Jonathan Spring, Software Engineering Institute (CERT) Jonathan Spring is a member of the technical staff within the CERT(r) Division at Carnegie Mellon University's Software Engineering Institute, a federally-funded research and development center. In addition to his research and analysis role, Jonathan is an adjunct professor at the University of Pittsburgh's School of Information Sciences. He has also co-authored a textbook, "Introduction to Information Security: A Strategic-Based Approach."
Abstract:	In this paper we demonstrate that there are name servers that exhibit IP address flux, a behavior that falls outside the prescribed parameters. We demonstrate this flux in two types of data: passively collected DNS messages and the contents of several large, top-level domains’ official zone files. The community of name server operators has previously indicated that there is no benign use case for such behavior and has attempted to quash it. The continued existence of such behavior is an indicator of malicious name server activity and the inadequacy of attempts to control it.
Files:	Passive Detection of Misbehaving Name Servers(PDF) Passive Detection of Misbehaving Name Servers
Sponsors:	None.

Back to NANOG59 agenda.

NANOG59 Abstracts

• Show All

• 100G Evolution at Comcast
  Speakers:
  Benjamin Vik, Comcast;

• Extending SDN into the Transport Network
  Speakers:
  William Wauford, Infinera;

• SDX: A Software Defined Internet Exchange
  Speakers:
  Arpit Gupta

• 12 Mbps @ 36,000 ft. Coming attractions in in-flight broadband
  Speakers:
  Girish Chandran

• Passive Detection of Misbehaving Name Servers
  Speakers:
  Jonathan Spring, Software Engineering Institute (CERT);

• Better than Best Practices are Needed to Defeat DNS Amplification Attacks
  Speakers:
  Ralf Weber, Nominum;

• Measuring Network Convergence on Production Networks
  Speakers:
  Laris Benkis, Third Planet Networks;

• Datacenter Track
  Moderators:
  Martin HanniganAkamai Technologies, Inc.; .
  Daniel Golding, Iron Mountain;

• Research & Education Network Operators Track
  Speakers:
  Michael Sinatra, ESnet;

• Datacenter Track
  Moderators:
  Martin HanniganAkamai Technologies, Inc.; .
  Daniel Golding, Iron Mountain;

• The Nice Thing About Standards...
  Speakers:
  Paul Ebersman, Infoblox;

• Multihoming / Traffic Engineering
  Speakers:
  Andy DavidsonAllegro Networks / LONAP ; .
  

• Troubleshooting with Traceroute
  Speakers:
  Richard Steenbergen, GTT;

• Optical Networks 201
  Speakers:
  Sergiu Rotenstein, MRV;

• Datacenter Networking @ Facebook
  Speakers:
  David Swafford, Facebook;

• DHCPv6 Fingerprinting and BYOD
  Speakers:
  Tom Coffeen, Infoblox;

• Offensive Anti-Botnet - So you want to take over a botnet...
  Speakers:
  David Dittrich, University of Washington;

• Scaling the Public Edge: Approaches to Application Load Balancing
  Moderators:
  Chris Woodfield, Twitter; Panelists:
  Leslie Carr, Wikimedia Foundation; Mike Thompson, A10 Networks; Jamie Dahl, Yahoo!; Sridhar Devarapalli, Citrix;

• Scaling the Public Edge: Approaches to Application Load Balancing
  Moderators:
  Chris Woodfield, Twitter; Panelists:
  Leslie Carr, Wikimedia Foundation; Mike Thompson, A10 Networks; Jamie Dahl, Yahoo!; Sridhar Devarapalli, Citrix;

• Scaling the Public Edge: Approaches to Application Load Balancing
  Moderators:
  Chris Woodfield, Twitter; Panelists:
  Leslie Carr, Wikimedia Foundation; Mike Thompson, A10 Networks; Jamie Dahl, Yahoo!; Sridhar Devarapalli, Citrix;

• Scaling the Public Edge: Approaches to Application Load Balancing
  Moderators:
  Chris Woodfield, Twitter; Panelists:
  Leslie Carr, Wikimedia Foundation; Mike Thompson, A10 Networks; Jamie Dahl, Yahoo!; Sridhar Devarapalli, Citrix;

• Scaling the Public Edge: Approaches to Application Load Balancing
  Moderators:
  Chris Woodfield, Twitter; Panelists:
  Leslie Carr, Wikimedia Foundation; Mike Thompson, A10 Networks; Jamie Dahl, Yahoo!; Sridhar Devarapalli, Citrix;

• DOCSIS 3.1 High Level Overview
  Speakers:
  Karthik Sundaresan, CableLabs;

• Who are the Anycasters?
  Speakers:
  Jim CowieRenesys; .
  

• Understanding Wireless Interference
  Speakers:
  Suman Banerjee, UW-Madison;

• ARP Mitigation at AMS-IX
  Speakers:
  Martin PelsAMS-IX; .