Subject: [DNSOP] Handling of unreachable servers

From: Alexander Gall <[email-masked]>
Date: Fri, 26 Jan 2007 14:12:53 +0100

We (AS 559) provide transit service to a TLD server located at an
exchange point in Zurich, Switzerland.  The server was unreachable for
almost three days in January.  The attached graph shows the relevant
traffic on our peering with GEANT (AS 20965 which we map to AS 8933 in
our accounting system for historical reasons).  All traffic marked as
"other" is essentially DNS (queries inbound and replies outbound).

The interesting thing is that the query rate increased dramatically
while the name server was down (6 unicast and about 25 instances of an
anycast server for the TLD were operational).  I don't expect all
recursive name servers out there to be able to handle unreachable
servers in an intelligent manner, but the magnitude surprises me.  Are
there any surveys of software versions used on DNS caches?  Studies
like <http://dns.measurement-factory.com/surveys/200504.html> are
probably biased towards authoritative servers, because many caches are
hidden behind firewalls.

What strategies to deal with unreachable servers do common
implementations use?  I would have thought that most of them prefer
the servers with the lowest RTT, like BIND does.  Unreachable servers
would have an infinite RTT and should only be queried occasionally to
check whether they have become reachable again.  Either this is not
true and the number of misbehaving servers is large or a relatively
small number of misbehaving servers generates the bulk of these
queries.

We happen to have full NetFlow data for this period of time, but
haven't analyzed it yet.  It would be interesting to see, for example,
how the distribution of queries per IP adddress changed during the
event, which could allow to estimate the fraction of the population of
caches that exhibits this behavior.

--
Alex

_______________________________________________
DNSOP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dnsop