开放DNS递归服务器的主动测量与分析

发布时间：2018-05-29 06:01

本文选题：开放递归解析器 + 域名系统　；参考：《哈尔滨工业大学》2016年硕士论文

【摘要】：随着互联网的不断发展以及无线网络技术的普及,网络主机的数量逐渐增加,提供域名系统(Domian Name System,DNS)解析服务的主机数量也逐渐增多。DNS作为互联网重要的基础服务设施,不仅仅提供了域名到IP地址的转换,更是为邮件服务,Web服务等众多服务提供支持,在互联网中扮演十分重要的角色。本文从DNS递归服务器角度出发,利用主动测量技术对国内DNS递归服务器进行探测发现,识别开放的DNS递归服务器,采集DNS服务器相关信息,并对测量得到的数据进行分析,探究国内的DNS现状。本文设计并实现了开放DNS递归服务器测量系统。该系统分为蛮力探测,DNS递归服务器识别,DNS服务器信息采集三个部分。蛮力探测部分对传统的探测技术做了优化,实现了基于Zmap的高效DNS探测技术,对全国IP地址进行探测,筛选出可能的DNS递归服务器候选集。DNS递归服务器识别部分提出了一种基于DNS权威服务器的递归服务器识别方法,从可能的DNS递归服务器候选集中识别出开放的递归服务器。DNS服务器信息采集部分对识别出的开放DNS递归服务器进行软件版本信息,协议支持情况,地理位置分布等信息的采集并进行分析。本文利用实现的测量系统对全国3.3亿IPv4地址进行了多次DNS递归服务器探测。其中蛮力探测部分利用高效DNS探测技术,1天时间完成全国IP地址的探测,发现可能的DNS递归服务器近2000万台。DNS递归服务器识别部分基于本文提出的识别技术对多次探测结果进行验证识别,最终发现稳定提供DNS服务的开放DNS递归服务器7990台。DNS服务器信息采集部分通过分析采集到的7990台服务器信息,发现这些服务器的地理分布及ISP归属情况基本与实际网络现状相符,在所有的服务器中支持TCP查询的占80%,而支持DNSSEC的仅有40%。本文在测量系统数据统计分析过程中发现了“伪服务器”、多次探测数据差异大、以及识别过程中部分结果不匹配等异常现象,随后设计实验对异常现象进行探究,发现造成“伪服务器”这种现象的原因是由于部分小规模ISP的特殊配置。而通过对另两种异常现象的分析,发现移动(包含铁通)ISP的入口网关存在DNS过滤行为,是造成这些异常现象的根本原因。本文最终通过实现的开放DNS递归服务器测量系统,提供了稳定的开放DNS递归服务器列表,并利用系统采集到的服务器信息以及探测过程中的异常现象进行分析,探究了当前DNS的部署情况以及网络现状,发现了一些ISP针对DNS的行为,为维护DNS系统的安全稳定高效运行提供了支持。
[Abstract]:With the continuous development of the Internet and the popularity of wireless network technology, the number of network hosts is gradually increasing. It not only provides the conversion of domain name to IP address, but also provides support for many services such as mail service and Web service, and plays a very important role in the Internet. From the point of view of DNS recursive server, this paper makes use of the active measurement technology to detect and discover the domestic DNS recursive server, identify the open DNS recursive server, collect the relevant information of the DNS server, and analyze the data obtained from the measurement. Explore the current situation of DNS in China. An open DNS recursive server measurement system is designed and implemented in this paper. The system is divided into three parts: brute force detection, DNS recursive server identification and DNS server information collection. In the part of brute force detection, the traditional detection technology is optimized, the efficient DNS detection technology based on Zmap is realized, and the IP address is detected in the whole country. Screening out the possible candidate set of DNS recursive server. In this paper, a recursive server recognition method based on DNS authoritative server is proposed. From the possible candidate set of DNS recursive server, the open recursive server. DNS server information collection part of the identified open DNS recursive server software version information, protocol support, Collect and analyze information such as geographical distribution. In this paper, the 330 million IPv4 address of the whole country is detected several times with the DNS recursive server using the realized measurement system. Among them, the brute force detection part uses the high-efficiency DNS detection technology to complete the IP address detection of the whole country in one day. It is found that there are nearly 20 million. DNS recursive servers identified by the DNS recursion server. The recognition technology proposed in this paper is used to verify and identify the multiple detection results. Finally, it is found that the information collection part of 7990 open DNS recursive servers, which provide stable DNS services, is based on the analysis of the collected information of 7990 servers. It is found that the geographical distribution and ISP ownership of these servers are basically consistent with the actual network status. 80 servers support TCP queries, while only 40 servers support DNSSEC. In this paper, "pseudo-server" is found in the process of statistical analysis of data of measurement system, the difference of detecting data is large, and part of the result is not matched in the process of identification, then the abnormal phenomenon is explored by designing experiments. The discovery of this phenomenon is due to the special configuration of some small-scale ISP. Through the analysis of the other two abnormal phenomena, it is found that there is DNS filtering behavior in the entrance gateway of the mobile (including TieTong ISPs), which is the root cause of these abnormal phenomena. Finally, this paper provides a stable list of open DNS recursive servers through the implementation of the open DNS recursive server measurement system, and analyzes the abnormal phenomena in the detection process by using the server information collected by the system. This paper probes into the current deployment of DNS and the current situation of the network, and finds out some behaviors of ISP aimed at DNS, which provides support for maintaining the safe, stable and efficient operation of DNS system.
【学位授予单位】：哈尔滨工业大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP393.05

【相似文献】