Techhawking

I have setup a new IP Address mapping tool on huntip today which allows anyone to plot multiple ip addresses on the map. Here is the the quick API for this map

API

• Method: POST/GET
• Parameters: ips ( comma delimited list of IP addresses or hostnames. For example 10.10.10.1,10.10.10.2,10.10.10.3)
• Parametsrs: ips ( You can add a comment for each IP by using : as delimiter . For example www.hotmail.com:hotmail server,www.google.com: Google servers,202.54.15.1:VLSNL server in india)
• Parameters: showinput (1= default, 0=dont show input box, 2 = don’t show menus either)
• Restrictions: Maximum of 100 IP addresses at any given time.

Notes

• Accuracy: The version of MaxMind database I’m using gives accuracy of around 20 miles

Examples

• 4 of Walmarts DNS servers spread over 3 locations
• A list of hosts captured by traceroute
  
• Another list of hosts captured by traceroute

I was looking for worldwide internet health statistics and found some interesting links.

General Connectivity Reports

• Internet health report
• InternetTrafficReport
• UCI Internet Weather Report
• UCR Internet Reachability Report

BGP and DNS Reports

• BGP Statistics - Very interesting statistics about BGP protocol usage
• DNS Statistics - Root dns response times
• CIDR Report - Some more BGP route stats. Very neat

I’m sure you have heard that there are 13 root servers in the world. This cache file (root hint) provided by internic/IANA http://www.internic.net/zones/named.root should confirm that. So how does these 13 servers brave a DDOS attack.

Aparently 6 of the 13 root servers are mirrored using Anycast routing to loadbalance between multiple servers. The F Root server itself has about 37 mirrors in the world. Anycast routing is implemented using BGP by simultaneously announcing the same destination IP range from many different places on the internet. So even though an IP might be registered for a location here in US, if someone announces that a route to the same IP block in Tokyo, hosts in or around that country will try to pick the cheapest route to get to a DNS server. DDOS attacks against root dns servers have happened in the past, and will continue to happen in future. Anycast routing is probably why these “13″ DNS servers are still alive today.

The next question some might ask is why we can’t have more than 13 IP addresses for root servers… or why can’t we just have a large root hint (cache). The answer is simple. For DNS to work using UDP protocol (which is stateless) there is a recommended upper limit on the size of a DNS packet (512 bytes). TCP/IP, which is much more expensive because of its overhead, is the recommended protocol for queries/replies beyond that packet size. The root server administrators understand this very well (who else will know better) and decided to restrict the total number of servers to 13 which can easily be embedded as a list of IPs inside a 512 byte UDP packet if required.

Here is a map of the 13 registered root servers on the global map. A complete list of root servers are listed at http://www.root-servers.org/.

Hunt IP is a collection of systems admin tools and links to looks which can help in investigating network, dns and Email problems.