IPAM

With increasing numbers of white collar workers hunkering down within their homes across the globe over the past couple of weeks, full time working from home is becoming the norm - at least while Corona virus social distancing measures are in place. I was curious how this shift in worker locale might impact IPv6 usage around the world. One popular benchmark is Google's IPv6 statistics, which measures the percentage of IPv6 browser connections to its websites. Images from  https://www.google.com/intl/en/ipv6/statistics.html Over the 12+ years of data points within the graph, the data has exhibited a periodicity with a relative spike on weekend days and nominally lower percentage values during workdays. This leads one to surmise that remote users, when at home, more often connect via IPv6 than when in the office. This theory is supported by the sustained higher percentages of IPv6 utilization during the Christmas holidays in late December and now during the general Corona vir...

I've never liked the term "enablement." It's one of those superfluous terms like "incentivize" and "irregardless" likely coined by corporate sycophants either to render the otherwise mundane more alluring or in ignorance of the existence of shorter formed synonyms. So instead of discussing "automating cloud network enablement," we'll cover"enabling cloud network automation." Moving beyond my introductory digression, i.e., back to the mundane, that is the concept of the cloud which promises several benefits to IT organizations. The cloud offers the ability to leverage infrastructure, platforms and applications to use when needed, for as long as needed, and to pay only for what they used and for how long. This ability to grow and shrink computing, application or infrastructure capacity on demand provides the elasticity enterprises need to support demand surges, new developments, business continuity and much more. Elasticit...

The Internet Corporation for Assigned Names and Numbers (ICANN) just published their review of the recent domain name system (DNS) root zone key rollover. The rollover occurred on October 11, 2018. Please read my prior post for background on DNSSEC and role of the root zone key. ICANN's summary report concludes that the rollover was indeed an "overwhelming success" given the very small number of disruptions detected during the rollover process. The report provides a logical and thorough timeline of the planning leading up to and encompassing the rollover. The report also highlighted several observations of the rollover process, summarized following: The vast diversity of resolver software implementations and configurations on the global Internet renders impossible the ability to predict general resolver behavior leading up to and during a rollover. And the lack of measurement capability prevents assured readiness assessment for major DNS changes. So ICANN and the DN...

They were only trying to do the right thing. When a recursive DNS server issues a query using DNS Extensions (EDNS) to another DNS server and the answer indicates a format error or there is no answer at all, developers of various recursive DNS server implementations created workarounds such as reissuing the query without extensions or querying another server authoritative for the same zone. This philosophy centered on coding the recursive server to fetch an answer even if it meant trying to ask in many different forms. While a noble pursuit in "doing what it takes" to obtain an answer, these and similar workarounds introduce additional queries of various formats and additional processing requirements on the recursive server. These inefficiencies, while intended to satisfy the requirement of answering the query, are needlessly reducing performance and scalability of the Internet. And as more extension features are introduced, complexity of recursive server software will incr...

Your domain name represents your identity on the Internet. Customers, prospects, associates, and generally anyone on the Internet can navigate to your website simply by knowing your domain name. The domain name system (DNS) facilitates this naming process by enabling the resolution of your site's name to Internet Protocol addresses that devices use to connect to your website over the Internet. While DNS simplifies navigation to your Internet presence thanks to your domain name, it also introduces an exposure to visual misrepresentations of your domain name in the DNS and therefore on the Internet. Such misrepresentations may be totally innocent, such as when would-be visitors "fat finger" or mistype your web address in their browsers leading them to another website, or downright malicious where a miscreant creates a website reachable by a visually similar or slight variation in your domain name. Such a malicious website could be designed to visually appear similar to ...

Need a quick summary of essential DNS security measures on a single page? I've published a DNS Security Battlecard just for you. My intention is to "net out" the key measures you should consider to better secure your DNS and thereby better secure your overall network. The battlecard summarizes, for each DNS server role, various controls you can implement related to deployment, routing controls, server controls and DNS application/protocol controls. Beyond the network and server level controls highlighted in the battlecard, please do not forget the human element of security that pervades all DNS server roles. This includes developing and enforcing an organizational security policy, incorporating security functions and requirements into staff job descriptions, staffing of personnel with appropriate job-specific skill sets, regular training of security policies and controls, and periodic auditing of staff activities. Other enterprise-wide security considerations include...

The Domain Name System (DNS) makes the Internet usable for humans. It is fundamental to the proper operation of virtually all Internet Protocol (IP) network applications, from web browsing to email, from messaging to multi-media applications and more. By its very nature, the global Internet DNS system serves as a distributed data repository containing domain names (e.g., web addresses) and corresponding IP address information. DNS has proven extremely effective and scalable in practice and most people take DNS for granted given its proven reliability. However, its essential function and decentralized architecture serve to attract attackers seeking to exploit its distributed structure and rich data store for sinister activities. Every time you enter a web address or send an email, you use DNS. DNS translates human-preferred "www" names into computer-preferred binary addresses. This translation service is more commonly referred to as a name resolution process, whereby a web a...