Continuous Monitoring

To create a DNS trace for analysis, we collected daily data from all 400$+$ PlanetLab (6) nodes running CoDNS, which produced lookups for over 100K unique names per day. Most of this traffic is generated by the CoDeeN content distribution network (8), which serves over 25 million requests per day to a global client population of over 50K daily users. To create a representative trace, we gathered one month of data, and selected names based on how frequently they appeared in the daily logs of CoDNS. The names that occurred daily contained virtually all of the Alexa top 500 Web site list, excluding some financial sites. Note that we select unique names, and weight their chance of inclusion in the list based on how many days they appear in our trace. The final list contains 40,000 names - the size was chosen to speed the lookup process. For one month, we resolved these names at every PlanetLab site (about 150 on most days), at the rate of one name per second. The list was randomized on a per-site basis to avoid overloading any server-side DNS infrastructure.

Figure 1(a) shows the TTL values for these names - most have cacheable lifetimes of 1 hour to 1 day, but a sizable fraction includes sub-hour TTLs, suggesting the use of CDNs, load balancers, or dynamic DNS systems for machines without static IP addresses. The average lookup time (per site) for all 40K unique names is shown in Figure 1(b), with a wide range of performance. Lookup times for individual names are bimodal - generally requiring less than 200ms or more than 4 seconds. The high lookup times reflect retries issued after a failure to receive a response, and their fraction is shown in Figure 1(c). Many sites require retries on half their lookups, resulting in high average lookup times. These results are worse than the LDNS measurements in CoDNS because they reflect the increased failure rate for uncached lookups in the wide area. Typical resolvers would have lower lookup times as seen by their clients, due to popular names being cached and requested multiple times.

Figure 2: Region information for names mapping to multiple disjoint IP addresses