1. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica master’s degree Supervisor Ch.mo prof Antonio PESCAPE Ch.mo prof Dario ROSSI candidate Danilo CICALESE Matr. M63000196 Anycast enumeration and geolocation approaches academic year 2013/2014

2. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica Anycast: Many Hosts, one IP! With anycast, multiple hosts can share the same IP address. When a packet is sent to an anycast address, the network will deliver it to the topologically closest host. Who is using IP anycast? Content Delivery Networks, i.e., EdgeCast, CloudFlare. Root DNS. Google public DNS. Context 1212

3. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica State of the art: geolocation techniques fail with anycast IPs. Where is Google’s 8.8.8.8? Who do you believe? United States (freegeoip.net). Mountain View, California (IP2Location). New York, New York (Geobytes). United States (Maxmind). Broomfield, Colorado (IPligence). Our contribution is a methodology to: Determine if a service uses IP anycast. Enumerate replicas sharing the same IP address. Geolocate those replicas. Motivation and contribution 1313

4. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica 1414 Measure Latency Planetlab Ripe … Detect and Enumerate Solve MIS Optimum (brute force) 5-approximation (Greedy)…. GeolocateClassification Maximum likelihood IterateFeedback Methodology

5. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica 1515 Detection The Vantage points are referring to two different instances if: The packet cannot travel faster than the speed of the light! The latency measurement is converted in a georaphic areas considering the speed of the light in a optical fiber

6. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica 1616 Enumeration: Greedy algorithm

7. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica 1616 Enumeration: Greedy algorithm

8. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica 1616 Enumeration: Greedy algorithm

9. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica 1616 Enumeration: Greedy algorithm

10. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica Locations at city granularity:  1 ms difference in latency measurement corresponds to a 100 km disc in geodesic distance terms.  Internet Service Providers and system administrators often use machine names that map to the city they are serving, i.e, IATA and IXP code. 7 Geolocation and iteration

11. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica Locations at city granularity:  1 ms difference in latency measurement corresponds to a 100 km disc in geodesic distance terms.  Internet Service Providers and system administrators often use machine names that map to the city they are serving, i.e, IATA and IXP code. Location metrics:  Distance from the border.  User internet population. 7 Geolocation and iteration

12. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica Locations at city granularity:  1 ms difference in latency measurement corresponds to a 100 km disc in geodesic distance terms.  Internet Service Providers and system administrators often use machine names that map to the city they are serving, i.e, IATA and IXP code. Location metrics:  Distance from the border.  User internet population. Geolocation error:  The percentage of correct classification (i.e., geolocation).  The mean geolocation error in kilometers. 7 Geolocation and iteration

13. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica In this section we limited our analysis to 200 PlanetLab Vantage points. We validate our methodology against publicly available ground truth: F, K, I, L DNS root servers. DNS CHAOS query. 1818 Experimental validation

14. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica In this section we limited our analysis to 200 PlanetLab Vantage points. We validate our methodology against publicly available ground truth: F, K, I, L DNS root servers. DNS CHAOS query. Enumeration: the greedy solver is in most of the cases just as good as the brute force solution and it’s faster than brute force( hundreds of milliseconds vs thousands of seconds). Geolocation: equal importance for the distance from the border and user internet population. 1818 Experimental validation

15. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica 1919 Datasets: Ripe 6000 nodes, 122 countries, 2168 AS. Ripe 500 nodes, random selection. Ripe 200 nodes: stratified selection, at least 100 km distant from each other. Measurement campaign

16. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica 1919 Datasets: Ripe 6000 nodes, 122 countries, 2168 AS. Ripe 500 nodes, random selection. Ripe 200 nodes: stratified selection, at least 100 km distant from each other. Measurement campaign Results: Using the full dataset, it s possible to enumerate the 76% of the anycast instances and geolocated the 80% of them. Random selection provides poor results while the stratified selection achieve comparable results.

17. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica 110 Comparison state of the art Enumeration: [1] directly quantitatively comparable, [1] employs DNS root servers as case of study. Geolocation: [2] uses the Client Centric Geolocation, CCG. It’s only qualitatively comparable, as they target Google infrastructure. REFERENCES: [1] X. Fan, J. Heidemann and R. Govindan, “Evaluating anycast in the Domain Name System” in Proc. IEEE INFOCOM, 2013. [2] M. Calder, X. Fan, Z. Hu, E. Katz-Bassett, J. Heidemann and R. Govindan, “Mapping the expansion of Google’s serving infrastructure” in Proc. ACM IMC, 2013.

18. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica 110 Comparison state of the art Enumeration: [1] directly quantitatively comparable, [1] employs DNS root servers as case of study. Geolocation: [2] uses the Client Centric Geolocation, CCG. It’s only qualitatively comparable, as they target Google infrastructure. REFERENCES: [1] X. Fan, J. Heidemann and R. Govindan, “Evaluating anycast in the Domain Name System” in Proc. IEEE INFOCOM, 2013. [2] M. Calder, X. Fan, Z. Hu, E. Katz-Bassett, J. Heidemann and R. Govindan, “Mapping the expansion of Google’s serving infrastructure” in Proc. ACM IMC, 2013.

19. Anycast enumeration and geolocation approaches Scuola Politecnica e delle Scienze di Base Corso di Laurea Magistrale in Ingegneria Informatica FUTURE WORKS: Refine methodology. Selection of the Vantage points. Internet anycast census. 111 Conclusions We propose a novel methodology to detect, enumerate and geolocate anycast replicas. Our methodology does not rely on a protocol specific information. Fewer vantage points suffices to provide recall and accuracy similar to large scale techniques.