The Domain Name System and Internet Still Survive Presented by: Ao-Jan Su

Please clarify Section 4. : Two recent survey by Pappas and Ramasubramanian… most domain names are served by a small number of nameservers. Abstract: The survey shows that a typical name depends on 46 servers on average. Which one is correct?

Ordered Records (Large TCB is not an important issue) Most DNS queries use the first entry in the ordered list It is very unlikely to ask Rochester for Cornell’s IP address ;; QUESTION SECTION: ;cornell.edu. IN A ;; ANSWER SECTION: cornell.edu IN A ;; AUTHORITY SECTION: cornell.edu IN NS dns.cit.cornell.edu. cornell.edu IN NS cudns.cit.cornell.edu. cornell.edu IN NS simon.cs.cornell.edu. cornell.edu IN NS bigred.cit.cornell.edu. cornell.edu IN NS cayuga.cs.rochester.edu.

Hijack FBI (DNS design ’ s fault?) reston-ns2.tel .net is running an old nameserver (BIND 8.2.4) It is the vulnerability of software (server) NOT the design of DNS. This problem can be easily detected and corrected (by scanning the versions of BIND in the nameservers periodically and keep the software up to date)

OK,.edu and.org are Lazy But, this also implies that hackers have very little interest in hijacking these domains. Or cs.northwestern.edu would be hijacked now! Same reason goes to Ukraine, Belarus, San Marino, Malta… BTW Can you give me some examples of domains with.aero and.int?

Conclusion Don’t blame on DNS for vulnerability (bugs) of BIND TCB is not a good representation of daily DNS operations (extreme conditions should not count the same weight as normal cases) However, I agree that.edu and.org nameservers should update their BIND as soon as possible

Thank you.