Embed Size (px)
Citation preview
1
Verifying Growth of IPv6 DNS Entries
Jonathan Carroll, Radhouan Allani, Sriram Akella, Vineet Gupta
[email protected], [email protected], [email protected], [email protected]
A capstone paper submitted as partial fulfillment of the requirements for the degree of Masters in Interdisciplinary Telecommunications at the University of Colorado, Boulder, 2 May 2011. Project directed by Professors Jose Santos and Mark Dehus.
1 Introduction With the global pool of IPv4 addresses drying up it is important to verify the current status of the Internet for true IPv6 only hosts. Prior research has attempted to measure this status by evaluating growth of the DNS entries with AAAA records [1]. The presence of an IPv6 address in the AAAA record of a DNS entry indicates the site is accessible via IPv6 directly, as opposed to having to use an ISP’s NAT 6to4 device which is prone to congestion and delays. However, now that the IPv4 addresses pool running dry has become a reality, it has become pertinent to analyze if growth is moving at a faster rate than when previous research was done. Additionally, researchers have not yet taken into account the recent development of IPv6 whitelisting of DNS servers which started last year [2]. Whitelisted DNS servers are generally those that serve hosts with IPv6 connectivity. Many domains have started to not propagate their AAAA record entries to servers that only serve IPv4 hosts, also called non-whitelisted servers. This is done because of a bug in some residential router firmware that will remove the A record containing the IPv4 address from records when they are passed through, causing the client to only receive the IPv6 address for the server. If the client only has IPv4 connectivity but receives only an IPv6 address it will break connectivity to the site. Current estimates suggest that this affects a very small number of users, around 0.073%, but enough to spur the development and deployment of IPv6 whitelisting among major Internet players [2].
We measured the growth by monitoring both whitelisted and non-whitelisted DNS servers’ entries of the top 6,274 most popular domain names for AAAA records on each of the servers over a two and a half month period. The top 6,274 domains were selected by combining the list of the top 5,000 domains from both Alexa and Quantcast’s rankings and eliminating duplicates. We used four DNS servers: Qwest’s residential DNS, Google Public DNS, University of Colorado (CU) DNS and Hurricane Electric’s (HE) whitelisted DNS server. This study not only aims to find IPv6 adoption trends, but also the impact whitelisting has had on worldwide adoption. By analyzing both types of DNS servers, the overall impact and current scope of whitelisting can be estimated.
2
1.1 Research Question Do whitelisted and non-whitelisted DNS servers show significant growth in the increase of AAAA records on entries for the most popular domain names when compared to previous data? Is there a significant difference between the number of domains with AAAA records on whitelisted and non-whitelisted servers? 1.2 Definitions
IPv6 DNS Entry - A DNS entry with an AAAA record. DNS Whitelisting - Implementation of access control lists (ACL) on the basis of resolver
IP Addresses in an authoritative DNS server of a domain such that only addresses in the ACL are sent to the IPV6 address (AAAA record) of that domain.
Whitelisted DNS server - A recursive resolver DNS server that is in the ACL of the authoritative server that allows it to be passed AAAA records.
Non-whitelisted DNS Server - A recursive resolver DNS server that is not in the ACL of the authoritative server so it will not receive AAAA records.
Most popular domains - The combined top 6,274 domains according to Alexa and Quantcasts rankings of the top 5,000 websites combined eliminating duplicates.
Autonomous System (‘AS’) - “Network, collection of routers, or portion of a large internetwork under a single administrative authority” [3].
AAAA - Hostnames are mapped by quad A or AAAA records to IPv6 addresses in DNS servers. Similar to AAA records used for IPv4 mapping.
Unknown address - An IPv6 address that has not been assigned by any regional registry or defined in any known RFC.
1.3 Scope and Assumptions The audience of this research is network operators, Regional Internet Registries (RIR) and network engineers as it will help them make important decisions about the capacity that will be necessary in 6to4NAT devices as IPv6 is deployed over their networks. The scope of the research includes verifying if the 6,274 most popular domains have an AAAA entry in their DNS record to determine the sites that have IPv6 connectivity. The most popular domains were selected based on the combined ranking of the top 5,000 websites by Quantcast and Alexa as of January 2011. Data was collected intermittently over a two month period between February and March 2011. We assumed that DNS servers that claimed to be whitelisted were truthful, the same for those that claimed not to be. We also assumed that none of the servers changed whitelist status during data collection. 1.4 Goal The goal of this paper is two fold: The first is to quantify the AAAA records of whitelisted and non-whitelisted DNS servers to compare the difference in the number of domains. The second is to determine if there is significant growth on either of the types of DNS
3
servers along with determining the timeframe when all domains will have AAAA records and thus the ability to communicate over IPv6. 1.5 Methodologies To determine the IPv6 connected DNS entries, a python script was written to query the DNS entries for the top 6,247 domain names as ranked by Quantcast and Alexa. Data was collected from four different DNS servers including Qwest’s residential DNS server, Google Public DNS, University of Colorado’s DNS server and Hurricane Electric’s whitelisted DNS server for IPv6 customers. Qwest and University of Colorado access server were selected because we had easy access to these DNS servers. Google Public DNS server was selected because of easy access provided to the general public. Finally, Hurricane Electric was selected as it was the only IPv6 whitelisted DNS server that we were able to find which also supported full IPv4 connectivity to the public.
The collections were stored in a database using SQLlite. The data was collected intermittently over the months of February and March 2011. At the end of this period, the data was analyzed using various statistical and graphical comparisons.
Data on growth of number of IPv6 prefixes along with AS supporting IPv6 was collected manually on a daily basis from reliable third party statistics as another indicator of IPv6 growth. Additionally, data from past research on the same measures was compared to our results to get an overall complete picture over a significant period of time [4].
2 Relevance With the last batch of IPv4 address assigned by ICANN in February 2011 to regional registries, the global IPv4 pool has been officially exhausted [5]. Existing IPv4 address are now being sold at a premium by enterprises because of their acute paucity in comparison to world demand specifically from developing economies [6]. In such a scenario, IPv6 appears to be the only long term solution to ensure continual fast paced growth of the Internet. Though IPv6 has been in existence for more than 12 years now, it is only in the recent four to five years that IPv6 transition has been become a much debated topic [7]. Therefore, our study which overlaps with the last of the IPv4 address being assigned, aims to analyze IPv6 adoption growth at this watershed moment in time.
The research question is significant because it aims to paint a much clearer picture on the rate of IPv6 transition on the Internet. Though the study is worldwide in scope, there is also an aim to make it granular by categorizing specific growth in different regions, thereby making the results relevant for regional comparison. Additionally, the study also aims to be comprehensive by studying the effects of the relatively new practice of IPv6 DNS whitelisting on IPv6 growth. Further, there is an attempt to amalgamate previous work by researchers in this area with our findings and come up with the most current and relevant statistics, thereby providing an invaluable resource to professionals working in the networking field. The research is also of importance to network operators and network engineers in general, providing them with a better
4
picture of the readiness of their network and the overall Internet for a transition to IPv6. Finally, the research would also be of importance to different Internet registries and governments as efforts to deploy IPv6 accelerate. 2.1 Prior Work
In a Number Resource Organization (NRO) Press Release in 2008, Chair Paul Wilson stated, “ What we are now seeing is an acceleration in IPv6 activity on the Internet, clearly indicating the start of production deployment in many parts if the world. We are also seeing a rapid increase in allocation of IPv6 addresses, reflecting an increasing readiness for imminent deployment. These developments are due to the work of all global stakeholders in assembling the resources necessary for IPv6 adoption” [8]. With the rapid allocation of IPv6 prefixes, there has been a necessity to understand the extent of IPv6 growth and a need to quantify its deployment. However, there has been a dilemma over the tools required to accurately quantify this growth. Different kinds of data have been used to capture this phenomenon. Traffic analysis by Arbor Networks has found that IPv6 usage is increasing at about the same rate as IPv4 usage [1]. The data provided by the Regional Internet Registries shows that allocation of IPv6 addresses is taking place at a very high rate. However, studies that have implemented the longitudinal BGP analysis have shown that almost half, about 52%, of these addresses are not announced [1]. The addresses that are announced take a very long time to be listed on the global routing system. Results show that it takes, on average, a minimum of 957 days for an entity to announce their address blocks after they have been allocated. The days on average for the five regions are as follows: RIPE - 141 days, LACNIC - 159 days, AFRINIC - 177 days, APNIC - 202 days, and ARIN - 211 days [1]. Studies have also indicated that most of the growing IPv6 traffic is generated by DNS and ICMP which in turn suggests that the IPv6 traffic is generated by some inquisitive applications and that there is a shortage of substantial quality IPv6 applications [1]. Further, observation on tunneled IPv6 traffic suggest that operating systems supporting IPv6 send an extra DNS query requesting an IPv6 address [1]. An alternative explanation is that IPv6 has been used as a medium to bypass certain security measures in place like firewalls for IPv4 - especially for applications that involve P2P file sharing [1]. In the past, certain research has also taken place concerning measuring the growth of IPV6 (AAAA) DNS records of top websites. Measurements done by Hurricane Electric for the top one million websites based on ranking by Alexa, has indicated that only 2576 had raw IPv6 address connectivity, which gives a dismal 0.2576 % adoption [9]. Similar statistics done by a joint team from Comcast and University of Pennsylvania pegs the percentage to be even lower at 0.1760 % at the end of September 2010. Although the numbers were expectedly higher for the most popular domains. For example, the figures stood at around 4% adoption for the top 100 websites, 1.8% for the top 1000, 0.8 % for the top 10,000 and 0.5% for the top 100,000 respectively, indicating that larger domains seem to be more proactive about ensuring IPv6 connectivity for their sites. [10]. Additionally, parallel measurements done by Hurricane Electric
5
on AS growth has indicated that currently 9.5% of the total ASes in the world are running IPv6 [9].
Though the above results have been very helpful in providing a high level view of IPv6 adoption, most studies overlook the effect of many finer nuances such as DNS whitelisting on IPv6 growth. To counter the effect of brokenness of reachability to IPv6 hosts, top domains have started implementing such whitelisting. According to previous analysis done in this area, IPv6 brokenness is a behavior seen in dual stack IPv6 architectures where unreliable IPv6 connectivity is selected over a reliable IPv4 connection [11]. This results in elongated web page loading times, with the IPv4 connection being tried only after all attempts to connect via IPv6 have been unsuccessful [11]. Google’s studies estimate IPV6 brokenness for clients on the Internet to be about 0.082% as of December 2010 [12]. Therefore, in order to prevent this, organizations such as Google have implemented DNS whitelisting by specifying a number of requirements to qualify for ‘Google over IPv6’ including: low latency, production quality IPv6 support, reliability and separate DNS servers for IPV6 lists [13].
Previous studies done on DNS whitelisting have raised multiple concerns including cost of implementation, configuration of multilayer NAT systems by networks and causing end-users to delay transition to IPv6 [2]. The primary concern however, has been with regards to the conception of a fragmented two tiered Internet structure. Additionally, there have been concerns regarding operators requesting that their resolvers are added to the whitelist, streamlined procedures to address individual objections, verifying successful whitelisting along with de-whitelisting issues. It has been implied that such a large scale deployment of whitelisting on the Internet could have a major impact on IPv6 deployment growth [14].
Though there has been a great deal of concern regarding such practices, there has been no formal study into the impact of DNS whitelisting on IPV6 growth. Therefore by separately measuring both types of servers for IPv6 growth, our study aims to measure the effect on IPv6 transition and fill gaps in previous research. This has become even more important with corporations such as Google, Microsoft and Yahoo planning to create and maintain a combined central IPv6 whitelist for the Internet [15].
3 Analysis Data collected showed an extreme divide between the number of domains with AAAA
records on a whitelisted server over a server that was not whitelisted. The median number of domains on a whitelisted server with AAAA records was 113 in comparison to 18 on all three of the non-whitelisted servers. Though there was some fluctuation in the data on a daily basis, overall it was fairly stable.
The difference in the number of domains with AAAA records on a whitelisted server versus a non-whitelisted server was significant, implying almost 100 different domains are currently being whitelisted. Upon closer analysis however, it was identified that 87 of these domains included the word “google”. All the other domains with AAAA records on the whitelisted server could also be traced back to a site owned by or associated with Google. This
6
suggests that currently Google is the only major website or organization that is practicing active whitelisting.
Figure 1: Number of Domains with AAAA records over time
7
Figure 2, 3, 4, 5: Number of domains with AAAA Record Over Time By Server
The data above shows a large gap between the number of domains with AAAA records on whitelisted servers versus those on non-whitelisted servers, indicating that most of the domains that currently have AAAA records are using whitelisting. This seems to indicate that the threat of breaking legacy IPv4 users with old hardware is being considered seriously by those implementing IPv6 on web servers. If sites were not considering it as a serious matter, it would be expected that fewer domains would be participating in whitelisting. The number of different AS and IPv6 prefixes advertised in BGP were also monitored, but showed no growth over the period monitored.
Table 1: AAAA Record Satistics By Server
Huricane Electric Whitelisted DNS
Google Public DNS
Qwest Residential DNS
University of Colorado DNS
Mean 112.619 18.55 18 18.4
Median 113 18 18 18
Linear Regression Slope
0.025 0.112 0.013 0.060
Distinct Domains Seen With AAAA
Records
118 21 21 20
Domains containing
“google” with AAAA records
87 0 0 0
8
Though some growth is observed, the slope of the line indicates it is very small, around 0.02 which in turn points to the fact that domain from our data set will add an AAAA record every 50 days. Previous research analyzing AAAA record growth done in December 2009 through September 2010 showed the slope of the best fit line for that data set was around 0.0002 suggesting slower growth than that observed in our results [9]. This research analyzed the top one million domains which could explain the slower growth. This also denotes that the more popular domains are adopting IPv6 at a faster rate than less popular domains.
Figure 6: Domains with AAAA Records by TLD University of Colorado DNS
Figure 7: Domains with AAAA Records by TLD Google Public DNS
9
Figure 8: Domains with AAAA Records by TLD Hurricane Electric DNS
Figure 9: Domains with AAAA Records by TLD Qwest DNS
10
Figure 10: TLD Breakdown in Domains Monitored
A breakdown of domains with AAAA records by Top Level Domain (TLD) can be seen in figures 6-9. A breakdown of all of the domains being monitored regardless of AAAA record status can be seen in figure 10. The breakdown shows several interesting trends, mainly that growth in AAAA records amongst the most popular TLD, ‘com’, is much slower than that of less popular TLDs. The breakdown also reveals that certain TLDs are more likely to have AAAA records, in particular ‘edu’, ‘biz’, ‘it’, ‘de’, ‘no’, and ‘cn’ had twice the number in the breakdown of TLDs with AAAA records than that observed in the overall breakdown of the TLD dataset. The increase in the number of different TLDs appearing with AAAA records on the whitelisted server can be explained by all of the different Google domains with different TLDs, each being whitelisted.
Figure 11: RIR That Assigned AAAA Address University of Colorado DNS
11
Figure 12: RIR That Assigned AAAA Address Google Public DNS
Figure 13: RIR That Assigned AAAA Address Hurricane Electric DNS
Figure 14: RIR That Assigned AAAA Address Qwest DNS
Using IANA’s data on which regional Internet registries have been allocated IPv6 addresses, we were able to pinpoint the region a particular address in an AAAA record and
12
generate figures 11-14 for each DNS server [16]. It was found that around 12% of the AAAA records on the non-whitelisted servers are for 6to4 addresses. This means that the site itself is not natively speaking IPv6 and is instead requesting the users to use their ISPs 6to4 NAT to access the site. This is another indicator of sites choosing to rely on 6to4 NAT instead of adopting IPv6 natively. There was also a significant portion of unknown addresses, about 5%, on the non-whitelisted servers that were not valid unicast addresses or defined in any RFC suggesting that some of the AAAA records are invalid. The data also shows a significant difference in the regional breakdown of the AAAA record between the whitelisted and non-whitelisted servers. On non-whitelisted servers most of the addresses can be traced back to North America or Europe, with Asia having a smaller presence. The whitelisted server on the other hand had an overwhelming amount of addresses from North America. There were no AAAA records in our data that could be traced back to South America or Africa. This suggests that the majority of whitelisting is being done in North America.
4 Conclusion Based on the slope of the linear regression line on all four of the servers monitored it appears that there is some growth in AAAA records of the most popular domain names. The growth is however very slow, suggesting that only one new domain will add an AAAA record from our list of most popular domains roughly every 50 days. At this growth rate it would take roughly 822 years for all of the domains in our compiled list of most popular domains to come online, even on the whitelisted DNS server. However with many top domains, displaying genuine concern, acceleration towards implementation of IPv6 in the future may be possible. Of the 118 domains with AAAA records on the whitelisted server 87 of them were Google domains. This would seem to indicate that Google is one of the only major organizations implementing whitelisting. The continued slow growth of AAAA records among the most popular domains doesn’t necessarily mean that domains aren’t taking the adoption seriously. The issues with some legacy consumer software and routing hardware that causes users with only IPv4 addresses receiving AAAA records to be unable to access the site could influence their decision. These sites may choose not to implement IPv6 and instead let users rely on 6to4NAT provided by their ISP over breaking their site for users on legacy systems. The costs to an individual site of implementing a whitelisting system on their authoritative DNS server with no immediate benefit gives them little incentive to go this route. With all of the technical hurdles and negative effects on some legacy users there is little incentive for sites to implement IPv6 on their server. Any domains that do implement IPv6 will likely do so with whitelisting to avoid breaking legacy clients. For the foreseeable future it seems likely that most sites will be accessed exclusively via IPv4 and 6to4NAT will be necessary for most web traffic of IPv6 users.
13
References: [1] E. Karpilovsky, A. Gerber, D.Pei, J. Roxford, & A. Shaikh, "Quantifying the Extent of IPv6
Deployment," Princeton University, AT&T Labs – Research, p. 10, [Online]. Available: http://www.cs.princeton.edu/~jrex/papers/ipv6-pam09.pdf. [Accessed Februray 15, 2011].
[2] “IPv6 DNS Whitelisting: Overview and Implications,” presented at IETF 79, Beijing, China, 2010.
[3]"Routing Terms," Juniper Networks, p. 1, [Online]. Available: http://www.juniper.net/techpubs/software/junos-security/junos-security95/junos-security-swconfig-interfaces-and-routing/jd0e55622.html. [Accessed Mar. 30, 2011].
[4] "Internet Addressing: Measuring Deployment of IPv6," OECD, p. 47, Apr. 2010. [Online]. Available: http://www.oecd.org/dataoecd/48/51/44953210.pdf. [Accessed Feb. 2, 2011].
[5] S. Lawson, "ICANN Assigns Its Last IPv4 Addresses," PC World, p. 1, Feb. 2011. [Online]. Available: http://www.pcworld.com/article/218666/icann_assigns_its_last_ipv4_addresses.html. [Accessed Feb. 12, 2011].
[6] "Microsoft spends $7.5m on net addresses," BBC News Technology , p. 1, Mar. 2011. [Online]. Available: http://www.bbc.co.uk/news/technology-12859585. [Accessed Mar. 30, 2011].
[7] S. Deering & R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification," RFC, vol. 2460, p. 39, 1998. [Online]. Available: http://tools.ietf.org/html/rfc2460. [Accessed Jan. 5, 2011].
[8] "IPv6 Growth Increases 300 Percent in Two Years," The Number Resource Organization (NRO) Press Release, p. 3, Dec. 2008. [Online]. Available:http://www.nro.net/wp-content/uploads/2010/12/IGF-v6-draft-pw.pdf. [Accessed Februray 4, 2011].
[9] M. Leber, "Global IPv6 Deployment Progress Report," Hurricane Electric Internet Services, [Online]. Available: http://bgp.he.net/ipv6-progress-report.cgi. [Accessed Jan. 1, 2011].
[10] "IPv6 Adoption Monitor," [Online]. Available: http://ipv6monitor.comcast.net:8088/monitor/. [Accessed Jan. 1, 2011]
[11] Y. Poppe, "IPv6 and the Fear of Brokenness," Circleid Internet Infrastructure , Oct. 2010. [Online]. Available http://www.circleid.com/posts/20101012_ipv6_and_the_fear_of_brokenness/. [Accessed Mar. 3, 2011].
[12] Colitti, L., “IPv6 Transition Experiences,” presented at NANOG 50, Atlanta, USA, 2010. [13] “Google over IPv6,” Google. http://www.google.com/intl/en/ipv6/ [Mar. 26, 2011]. [14] Brzozowski, J., Griffiths, C., et al., “IPv6 DNS Whitelisting-Could it Hinder IPv6
Adoption,” ISOC IPv6 Deployment Workshop, 2010 [15] C.D. Marsan, "Google, Microsoft, Netflix in talks to create shared list of IPv6 users,"
Networkworld,p.4,Mar.26,2010.[Online].Available: http://http://www.networkworld.com/news/2010/032610-dns-ipv6-whitelist.html?page=1. [Accessed Mar. 3, 2011].
14
[16] "IPv6 Global Unicast Address Assignments," Internet Assigned Numbers Authority (iana), p. 1, Aug. 2008. [Online]. Available: http://www.iana.org/assignments/ipv6-unicast-address-assignments/ipv6-unicast-address-assignments.xml. [Accessed Jan. 15, 2011].
