Subject: [Add] Looking at the problem space for real numbers....

From: "Winfield, Alister" <[email-masked]>
Date: Mon, 17 Jun 2019 10:42:13 +0000

I have many questions that require facts top back them up partly to help guide us on priority of issues that we ought to be discussing and on the scale of the problems we are likely to be facing as implementors and deployers of DoH.

Starting with probably the easiest to state question. Up scaling required with any transition to DoH.

Does anyone here have any measurements to define the sizing in terms of:

                Number of connections at the DoH server vs the same service on plain DNS (assuming UDP connection is roughly equivalent to unique IP’s seen per n seconds).
                Connection rate at the DoH servers (tricky given we have so few clients at the moment).
                Query rates vs plain DNS assuming that in the end solutions may well lose all DNS caching at the OS / Customers Access Device (CPE) layers / Other.
               (Before anyone says it yes some of these caches are bypassed already that’s one reason simple modelling of the system to get a likely scaling factor is so complex)

Alister.
Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD

---

From: Michael Richardson <[email-masked]>
Date: Mon, 17 Jun 2019 10:56:55 -0400

> Does anyone here have any measurements to define the sizing in terms

I have no data, but I can suggest how to get the data.

> Query rates vs plain DNS assuming that in the end solutions may well
> lose all DNS caching at the OS / Customers Access Device (CPE) layers
> / Other.
>
> (Before anyone says it yes some of these caches are bypassed already
> that’s one reason simple modelling of the system to get a likely
> scaling factor is so complex)

Are you asking on behalf of sky.uk, which I think is an ISP?

Assuming that you have no IPv6 and no CGN, and your customer's CPEs do NAT44
for clients behind the CPE, then you should be able to measure number of
requests to port-53 outgoing from your clients.  That should be a simple
netflow (or equivalent) sampling of counters.

OSes and applications, even if they are talking to 8.8.8.8/etc. do cache
answers, usually for longer than they ought to.  Some ignore TTLs, asking too
often.

That would give you some data on the lower bound; I think you are right that
if DoH goes directly to the device, and the CPE does not eventually get
involved, then we lose a lot of caching.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Tony Finch <[email-masked]>
Date: Wed, 19 Jun 2019 19:04:19 +0100

> Does anyone here have any measurements to define the sizing in terms of:

My numbers are too small to be useful :-)

I have about 4 people out of 40,000 using my DoH service. I'm using it
with Firefox, which appears to use fairly long-lived https connections -
I see hundreds of queries with the same client port number from my
browser.

I have quite a lot more people using DoT from Android devices, but the
numbers are not very comparable because I have tuned the DNS TCP keepalive
parameters to relatively short idle timeouts but I have not done the same
for https. Last time I looked I was getting average 2 queries per
connection (with large variance) on DoT with a 5 second idle timeout, and
clients on v4 only.

I have assumed the per-user query rate is the same regardless of the
transport.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
disperse power, foster diversity, and nurture creativity