Monitoring and measuring Yeti · Monitoring and measuring Yeti Stéphane Bortzmeyer AFNIC...

33
Monitoring and measuring Yeti Stéphane Bortzmeyer AFNIC [email protected] Yeti workshop Yokohama 30 october 2015 1 / 16

Transcript of Monitoring and measuring Yeti · Monitoring and measuring Yeti Stéphane Bortzmeyer AFNIC...

  • Monitoring andmeasuring Yeti

    Stéphane BortzmeyerAFNIC

    [email protected] workshop

    Yokohama30 october 2015

    1 / 16

  • Monitoring andmeasuring Yeti

    Stéphane BortzmeyerAFNIC

    [email protected] workshop

    Yokohama30 october 2015

    2 / 16

  • Humans are lousy

    Testing with dig from time to time is not enough.

    We need to automate!

    3 / 16

  • Monitoring

    4 / 16

  • Monitoring

    We’ll use Icinga http://www.icinga.org/ as an example butany Nagios-compatible will be fine.

    4 / 16

    http://www.icinga.org/

  • Monitoring

    Among the existing monitoring plugins, check_dig (DNS tests)

    4 / 16

  • Monitoring

    Among the existing monitoring plugins, check_dig (DNS tests)

    Also, in various contrib repositories:

    check_soahttps://github.com/bortzmeyer/check_dns_soa Checksa zone, not an individual server. Warns if a server is downcheck_rrsighttp://dns.measurement-factory.com/tools/nagios-plugins/check_zone_rrsig_expiration.htmlCheck DNSSEC signature expiration

    4 / 16

    https://github.com/bortzmeyer/check_dns_soahttp://dns.measurement-factory.com/tools/nagios-plugins/check_zone_rrsig_expiration.htmlhttp://dns.measurement-factory.com/tools/nagios-plugins/check_zone_rrsig_expiration.html

  • MonitoringAmong the existing monitoring plugins, check_dig (DNS tests)

    Also, in various contrib repositories:

    check_soahttps://github.com/bortzmeyer/check_dns_soa Checksa zone, not an individual server. Warns if a server is downcheck_rrsighttp://dns.measurement-factory.com/tools/nagios-plugins/check_zone_rrsig_expiration.htmlCheck DNSSEC signature expiration

    RIPE Atlas can also return the current state of a permanentmeasurement, allowing to monitor reachability.https://labs.ripe.net/Members/suzanne_taylor_muzzin/introducing-ripe-atlas-status-checks

    4 / 16

    https://github.com/bortzmeyer/check_dns_soahttp://dns.measurement-factory.com/tools/nagios-plugins/check_zone_rrsig_expiration.htmlhttp://dns.measurement-factory.com/tools/nagios-plugins/check_zone_rrsig_expiration.htmlhttps://labs.ripe.net/Members/suzanne_taylor_muzzin/introducing-ripe-atlas-status-checkshttps://labs.ripe.net/Members/suzanne_taylor_muzzin/introducing-ripe-atlas-status-checks

  • Example, Dahu monitoring with Icinga

    define service{use generic-servicehostgroup_name Yetiservice_description PINGcheck_command check_ping!200.0,20%!400.0,35%

    }

    define service{use generic-servicehost_name dahu1,dahu2service_description DNScheck_command check_dig!-6 -l . -T SOA -A +dnssec

    }

    5 / 16

  • Other examples

    define service {use generic-servicehostgroup_name My_zonesservice_description CHECK_DNS_SOAcheck_command check_dns_soa

    }

    define service {use dns-rrsig-servicehostgroup_name My_zonesservice_description SIGEXPIRATIONcheck_command check-zone-rrsig!5!2

    }

    6 / 16

  • DNS quality

    Testing a root is a bit more difficult. . .

    7 / 16

  • DNS quality

    Testing a root is a bit more difficult. . .

    Zonemaster https://zonemaster.net/ Currently cannot testthe Yeti root (bug #381). With a local installation?

    7 / 16

    https://zonemaster.net/

  • DNS quality

    Testing a root is a bit more difficult. . .

    DNSmon https://dnsmon.ripe/net/ Can it be configured tomonitor Yeti?

    7 / 16

    https://dnsmon.ripe/net/

  • DNS quality

    Testing a root is a bit more difficult. . .

    DNSviz https://dnsviz.net/ Requires a local installation.

    7 / 16

    https://dnsviz.net/

  • DNSviz

    % dnsviz probe -A -x .:$(dig +nodnssec +short @dahu1.yeti.eu.org NS .) . \> yeti.json

    % dnsviz print -t ksk.txt -r yeti.json .

    % dnsviz graph -T html -t ksk.txt -r yeti.json . > yeti.html

    8 / 16

  • DNSviz, text. [.]

    [.] DNSKEY: 8/55954/257 [.], 8/17586/256 [.][.] RRSIG: ./8/55954 (2015-10-29 - 2015-11-28) [.][.] CNAME: NODATA[.] SOA: bii.dns-lab.net. yeti.biigroup.cn. 2015102900 1800 900 604800 86400[.] RRSIG: ./8/17586 (2015-10-29 - 2015-11-28) [.][.] PROOF: [.][.] NSEC: . aaa. NS SOA RRSIG NSEC DNSKEY[.] RRSIG: ./8/17586 (2015-10-29 - 2015-11-28) [.][.] SOA: bii.dns-lab.net. yeti.biigroup.cn. 2015102900 1800 900 604800 86400[.] RRSIG: ./8/17586 (2015-10-29 - 2015-11-28) [.]

    5grxudhb8j[.] A: NXDOMAIN[.] SOA: bii.dns-lab.net. yeti.biigroup.cn. 2015102900 1800 900 604800 86400[.] RRSIG: ./8/17586 (2015-10-29 - 2015-11-28) [.][.] PROOF: [.][.] NSEC: . aaa. NS SOA RRSIG NSEC DNSKEY[.] RRSIG: ./8/17586 (2015-10-29 - 2015-11-28) [.]

    9 / 16

  • DNSviz, picture

    .(2015-10-29 16:17:03 UTC)

    ./SOA

    5grxudhb8j ./SOA ./CNAME

    DNSKEYalg=8, id=55954

    DNSKEYalg=8, id=17586

    NSEC NSEC

    file:///home/stephane/tmp/yeti.html

    1 of 1 29/10/2015 17:20

    10 / 16

  • check_soahttps://github.com/bortzmeyer/check-soa

    % check-soa -i .bii.dns-lab.net.240c:f:1:22::6: OK: 2015102801 (194 ms)dahu1.yeti.eu.org.2001:4b98:dc2:45:216:3eff:fe4b:8c5b: OK: 2015102801 (273 ms)dahu2.yeti.eu.org.2001:67c:217c:6::2: OK: 2015102801 (270 ms)ns-yeti.bondis.org.2a02:2810:0:405::250: OK: 2015102801 (290 ms)yeti-dns01.dnsworkshop.org.2001:1608:10:167:32e::53: OK: 2015102801 (255 ms)yeti-ns.wide.ad.jp.2001:200:1d9::35: OK: 2015102801 (3 ms)yeti-ns.as59715.net.2a02:cdc5:9715:0:185:5:203:53: OK: 2015102801 (265 ms)yeti-ns.conit.co.2607:ff28:2:10::47:a010: OK: 2015102801 (148 ms)yeti-ns.ix.ru.2001:6d0:6d06::53: OK: 2015102801 (298 ms)yeti-ns.switch.ch.2001:620:0:ff::29: OK: 2015102801 (259 ms)yeti-ns.tisf.net.2001:559:8000::6: OK: 2015102801 (108 ms)yeti.aquaray.com.2a02:ec0:200::1: OK: 2015102801 (258 ms)yeti.bofh.priv.at.2a01:4f8:161:6106:1::10: OK: 2015102801 (262 ms)yeti.ipv6.ernet.in.2001:e30:1c1e:1::333: OK: 2015102801 (191 ms)

    11 / 16

    https://github.com/bortzmeyer/check-soa

  • check_soa% check-soa -i .bii.dns-lab.net.240c:f:1:22::6: OK: 2015102801 (194 ms)dahu1.yeti.eu.org.2001:4b98:dc2:45:216:3eff:fe4b:8c5b: OK: 2015102801 (273 ms)dahu2.yeti.eu.org.2001:67c:217c:6::2: OK: 2015102801 (270 ms)ns-yeti.bondis.org.2a02:2810:0:405::250: OK: 2015102801 (290 ms)yeti-dns01.dnsworkshop.org.2001:1608:10:167:32e::53: OK: 2015102801 (255 ms)yeti-ns.wide.ad.jp.2001:200:1d9::35: OK: 2015102801 (3 ms)yeti-ns.as59715.net.2a02:cdc5:9715:0:185:5:203:53: OK: 2015102801 (265 ms)yeti-ns.conit.co.2607:ff28:2:10::47:a010: OK: 2015102801 (148 ms)yeti-ns.ix.ru.2001:6d0:6d06::53: OK: 2015102801 (298 ms)yeti-ns.switch.ch.2001:620:0:ff::29: OK: 2015102801 (259 ms)yeti-ns.tisf.net.2001:559:8000::6: OK: 2015102801 (108 ms)yeti.aquaray.com.2a02:ec0:200::1: OK: 2015102801 (258 ms)yeti.bofh.priv.at.2a01:4f8:161:6106:1::10: OK: 2015102801 (262 ms)yeti.ipv6.ernet.in.2001:e30:1c1e:1::333: OK: 2015102801 (191 ms)

    11 / 16

  • RIPE Atlas

    https://atlas.ripe.net/

    Small hardware probes that volunteers plug everywhereAlmost 9 000 probes in operation today (a friendly botnet)Strong bias towards Europe: let’s fix it. Several Atlasambassadors will be at the IETF meetinghttps://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probes

    The probes can measure ICMP Echo, DNS (with a lot ofoptions, such as query type, DO, EDNS bufsize. . . ),traceroute, NTP. . .

    12 / 16

    https://atlas.ripe.net/https://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probeshttps://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probes

  • RIPE Atlas

    https://atlas.ripe.net/

    Small hardware probes that volunteers plug everywhere

    Almost 9 000 probes in operation today (a friendly botnet)Strong bias towards Europe: let’s fix it. Several Atlasambassadors will be at the IETF meetinghttps://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probes

    The probes can measure ICMP Echo, DNS (with a lot ofoptions, such as query type, DO, EDNS bufsize. . . ),traceroute, NTP. . .

    12 / 16

    https://atlas.ripe.net/https://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probeshttps://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probes

  • RIPE Atlas

    https://atlas.ripe.net/

    Small hardware probes that volunteers plug everywhereAlmost 9 000 probes in operation today (a friendly botnet)

    Strong bias towards Europe: let’s fix it. Several Atlasambassadors will be at the IETF meetinghttps://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probes

    The probes can measure ICMP Echo, DNS (with a lot ofoptions, such as query type, DO, EDNS bufsize. . . ),traceroute, NTP. . .

    12 / 16

    https://atlas.ripe.net/https://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probeshttps://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probes

  • RIPE Atlas

    https://atlas.ripe.net/

    Small hardware probes that volunteers plug everywhereAlmost 9 000 probes in operation today (a friendly botnet)Strong bias towards Europe: let’s fix it. Several Atlasambassadors will be at the IETF meetinghttps://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probes

    The probes can measure ICMP Echo, DNS (with a lot ofoptions, such as query type, DO, EDNS bufsize. . . ),traceroute, NTP. . .

    12 / 16

    https://atlas.ripe.net/https://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probeshttps://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probes

  • RIPE Atlas

    https://atlas.ripe.net/

    Small hardware probes that volunteers plug everywhereAlmost 9 000 probes in operation today (a friendly botnet)Strong bias towards Europe: let’s fix it. Several Atlasambassadors will be at the IETF meetinghttps://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probes

    The probes can measure ICMP Echo, DNS (with a lot ofoptions, such as query type, DO, EDNS bufsize. . . ),traceroute, NTP. . .

    12 / 16

    https://atlas.ripe.net/https://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probeshttps://www.ietf.org/registration/MeetingWiki/wiki/ripe_atlas_probes

  • User Defined Measurements

    You can request measurements from the Atlas probesWeb interface or APIOfficial CLI under development but already severalcontributed librariesProbes can be selected by country, region (“America”) or ASnumber

    13 / 16

  • User Defined Measurements

    You can request measurements from the Atlas probes

    Web interface or APIOfficial CLI under development but already severalcontributed librariesProbes can be selected by country, region (“America”) or ASnumber

    13 / 16

  • User Defined Measurements

    You can request measurements from the Atlas probesWeb interface or API

    Official CLI under development but already severalcontributed librariesProbes can be selected by country, region (“America”) or ASnumber

    13 / 16

  • User Defined Measurements

    You can request measurements from the Atlas probesWeb interface or APIOfficial CLI under development but already severalcontributed libraries

    Probes can be selected by country, region (“America”) or ASnumber

    13 / 16

  • User Defined Measurements

    You can request measurements from the Atlas probesWeb interface or APIOfficial CLI under development but already severalcontributed librariesProbes can be selected by country, region (“America”) or ASnumber

    13 / 16

  • Atlas API example, ICMP Echo

    Test a Yeti server from Canada:

    % python reachability+retrieve.py --country=CA 2001:200:1d9::3546 probes reportedTest done at 2015-10-29T12:37:23ZTests: 45 successful tests (97.8 %),

    0 errors (0.0 %), 1 timeouts (2.2 %),average RTT: 182 ms

    14 / 16

  • Atlas API example, DNS

    Test a Yeti server from AS 15557:

    % python resolve-name.py --asn=15557 -6 \--nameserver=2001:200:1d9::35 --type=SOA .

    Measurement #2879147 for ./SOA uses 16 probesNameserver 2001:200:1d9::35[bii.dns-lab.net. yeti.biigroup.cn. 2015102801 1800 900 604800 86400] :

    16 occurrencesTest done at 2015-10-29T12:32:55Z

    15 / 16

  • Atlas with the API

    See the quantitative results posted on the mailing list (obtainedthrough Atlas API). http://lists.yeti-dns.org/pipermail/discuss/2015-October/000262.html

    16 / 16

    http://lists.yeti-dns.org/pipermail/discuss/2015-October/000262.htmlhttp://lists.yeti-dns.org/pipermail/discuss/2015-October/000262.html

  • [email protected]

    Merci !


What is yeti?

What is yeti?

Yeti DNS & IPv6 - ICANN · Yeti DNS: NOT a Alternate Namespace The Yeti DNS project uses the ICANN root zone. The Yeti DNS project is not intended to research the contents of the

Yeti DNS & IPv6 - ICANN · Yeti DNS: NOT a Alternate Namespace The Yeti DNS project uses the ICANN root zone. The Yeti DNS project is not intended to research the contents of the

Monitoring and measuring Yetiyeti-dns.org/resource/workshop/Stephane-yokohama-workshop-measuring.pdfMonitoring and measuring Yeti Stéphane Bortzmeyer AFNIC bortzmeyer@nic.fr Yeti

Monitoring and measuring Yetiyeti-dns.org/resource/workshop/Stephane-yokohama-workshop-measuring.pdfMonitoring and measuring Yeti Stéphane Bortzmeyer AFNIC [email protected] Yeti

Yeti Harness Manual

Yeti Harness Manual

Yeti Ad Concept

Yeti Ad Concept

Yeti Microphone Manual

Yeti Microphone Manual

Scope for YETI Partnership

Scope for YETI Partnership

Yeti kataloog 2013

Yeti kataloog 2013

Yeti - Bigfoot

Yeti - Bigfoot

Yeti Oprema

Yeti Oprema

Stéphane Bortzmeyer CYBERSTRUCTURE Stéphane Bortzmeyer · 2018. 11. 19. · Dans la collection Société numérique : Giorgio Griziotti, Neurocapitalisme, Pouvoirs numériques et

Stéphane Bortzmeyer CYBERSTRUCTURE Stéphane Bortzmeyer · 2018. 11. 19. · Dans la collection Société numérique : Giorgio Griziotti, Neurocapitalisme, Pouvoirs numériques et

Yak and yeti

Yak and yeti

YETI VIEWPOINTS - naseaonline.orgnaseaonline.org/wp-content/uploads/Publication/YetiViewpoints/Yeti...ANMA-NASeA Yeti -Viewpoints Working for a better community 25th Anniversary Special

YETI VIEWPOINTS - naseaonline.orgnaseaonline.org/wp-content/uploads/Publication/YetiViewpoints/Yeti...ANMA-NASeA Yeti -Viewpoints Working for a better community 25th Anniversary Special

SUV YETI

SUV YETI

ŠKODA YETI - Griffin Tax free LimitedTo help you navigate the way to your perfect Yeti, this brochure features 2 wheel drive Yeti and Yeti Outdoor from page 18 and 4x4 Yeti and Yeti

ŠKODA YETI - Griffin Tax free LimitedTo help you navigate the way to your perfect Yeti, this brochure features 2 wheel drive Yeti and Yeti Outdoor from page 18 and 4x4 Yeti and Yeti

2014 Skoda Yeti - Brochure

2014 Skoda Yeti - Brochure

Yeti Manual English

Yeti Manual English

Sap Yak&Yeti

Sap Yak&Yeti

Yeti Katalog 2008

Yeti Katalog 2008

YETI CATÁLOGO 2012

YETI CATÁLOGO 2012