[dns-wg] yet another "final" agenda for the WG

There have been a couple of tweaks to what had been the final agenda. Tomáš Hlaváček will be speaking instead of Ondřej Surý and I've found 5 minutes to squeeze in an update on the ISC from its new CEO, Jeff Osborn. Here's what should be the final, definitive agenda for tomorrow. Maybe. :-)

#
#	$Id: Agenda,v 1.8 2013/10/15 06:45:47 jim Exp $ 
#

		 FINAL FINAL DNS WG AGENDA - RIPE 67

[0] Usual Administrivia						5 mins

[1] ENUM WG Announcement					5 mins
	Niall O'Reilly, UCD

[2] PMTU for better IPv6 Performance				10 mins
	Willem Toorop, NLnet Labs

Options for utilising ICMPv6 Packet-Too-Big (PTB) messages to increase DNS
responsiveness are explored. Working solutions, evaluated with RIPE Atlas,
are presented. The effect of the solutions in the real world are further
assessed with the help of traffic captures from SIDN and SURFnet.

[3] DNS over TCP analysis					20 mins
	Geoff Huston, APNIC

The Host requirements Specification, RFC 1123, states that "DNS resolvers
and recursive servers MUST support UDP, and SHOULD support TCP". There has
been some recent discussion about the viability of employing TCP rather
than UDP for large DNS responses as a means of mitigating the vulnerability
to large scale DNS DDOS attacks, and this got us wondering whether
resolvers still supported TCP. This is a report of an experiment to measure
what proportion of the Internet's users use DNS resolvers that are capable
of using TCP to query authoritative name servers.

[4] Defeating DNS Amplification Attacks				15 mins
	Ralf Weber, Nominum

Discussions of amplification attacks have largely focused on authoritative
servers. These attacks are beginning to use recursive resolvers. The
current generation of attacks leverages home gateways that forward DNS
queries coming in on their WAN interface, masking their origin when they
arrive at a resolver. It's unlikely vulnerable home gateways can be updated
anytime soon, so this presentation will describe how log data from DNS
resolvers can be used to identify attacks and detail proposals for
mitigating them without impacting legitimate DNS traffic.

[5] UDP Fragmentation/PMTU attack mitigation			20 mins
	Tomáš Hlaváček, CZ.NIC

Recent work has indicated transport- and link-level fragmentation issues
are a concern for the DNS. CZ.NIC have been working on a proof of concept
to illustrate these potential problems and what might be done to defend
against them. 

[6] Open discussion of [2], [3], [4] & [5]			15 mins


LUNCH BREAK


[7] NCC DNS Report						10 mins
	Anand Buddhev, RIPE NCC

[8] ISC News							5 mins
	Jeff Osborn, ISC/DNSco

[9] Which habitat fits your name server's nature best?		15 mins
	Willem Toorop, NLnet Labs

The performance measurements used for NSD version 4 will be discussed. The
core architectural choices in the implementations of various popular name
servers are explained. An analyisis given of which environments and under
what circumstances these implementations flourish best.

[10] Introducing Hedgehog					10 mins
	Dave Knight, ICANN

Hedgehog, a replacement for DSC which is snazzier in many ways, has been
developed for ICANN and will be published as Free/Open Source Software.

[11] Client-IP EDNS Option Concerns				15 mins
	Florian Streibelt, TU Berlin

Adoption of the proposed DNS extension, EDNS-Client-Subnet (ECS) offers
unique, but likely unintended, opportunities to discover details about
operational practices by ECS adopters at almost no cost. By utilising only
a single residential vantage point and relying solely on publicly available
information, we are able to (i) uncover the global footprint of ECS
adopters with very little effort; (ii) infer the DNS response cacheability
and end-user clustering of ECS adopters for an arbitrary network in the
Internet; and (iii) capture snapshots of user to server mappings as
practiced by major ECS adopters. While pointing out such new measurement
opportunities, our work is also intended to make current and future ECS
adopters aware of which operational information gets exposed when utilizing
this recent DNS extension.

[12] OTE's resolver infrastructure/design/rollout		20 mins
	Kostas Zorbadelos, Otenet

* Initial presentation of the resolving service
* Why anycast, motives for the service redesign 
* Design choices for anycast nodes in OTE's network
* Software choices and anycast node setup
* Transition to the new setup for existing users    
* Monitoring / alerting / measurement tools
* Future work / discussion

[13] DITL Data Analysis for ICANN gTLD Collision Study		10 mins
	 Jim Reid, RTFM LLP

Earlier this year ICANN commissioned a study into the issues and risks of
name collision which may be caused by the addition of new gTLDs. This
presentation describes how several terabytes of DNS traffic comprising 150+
billion queries, mostly provided by root server operators for DNS-OARC's
DITL exercise, were processed and the technical challenges/constraints on
doing this work.

[14] AOB