Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium's Impact on Root DNS Traffic

blog.apnic.net

Post reply on HN
Print view View original

51–60 of 221 posts

Re: Chromium's Impact on Root DNS Traffic

#51

Post by Semaphor »

elric wrote: post #26

I don't get this feature. And I really hate that it's present in pretty much every browser these days. If I want to type an URL, I'll use the address bar. If I want to search, I'll use the search bar. Different bars with different keyboard shortcuts and different purposes. Why do so many browsers merge these two? Screens are insanely wide these days, so screen real estate can't be the reason. Are we trying to trick u…

On FF it’s Ctrl+k for searching (by prepending `? `) and Ctrl+l for addresses (if it can be parsed as an address). I almost never just click into the bar, so that works fine for me.

Re: Chromium's Impact on Root DNS Traffic

#52

Post by [deleted] »

1vuio0pswjnm7 wrote: post #49

Why does Chrome (Google) need to know whether DNS is being intercepted? What actions does Google take based on the answer? Note that under this crude test of sending queries for unregistered domains, a user who administers their own DNS could be indistingushiable from "DNS interception" by an ISP or other third party. I administer my own DNS. I do not use third party DNS. These random queries would just hit my own DN…

[deleted]

Re: Chromium's Impact on Root DNS Traffic

#53

Post by jiggawatts »

steventhedev wrote: post #42
CKN23-ARIN wrote: post #16

Earlier quoted context omitted.

https://root-servers.org/ Select a root server at the bottom. Some, but not all, have a "statistics" link. Seems to be stated in qps and message size distribution, but you should be able to derive traffic volume from that.

Assuming the mean is close to the median, they are reporting ~10B requests daily with a median response size of around 1KB. 10TB daily is a little under 1Gpbs. Traffic is spiky, but this isn't particularly complex once you consider they have multiple data centers/servers. Of course, I may have misread something as daily that was hourly or something like that...

So it looks like the root namespace providers output a totally reasonable amount of traffic. Divided between the hundreds of points of presence globally, this is tens of megabits per physical host.

This FAQ is illuminating: https://www.verisign.com/en_US/domain-names/internet-resolut...

The servers themselves are ordinary 1 RU physical rack mount servers with 1 Gbps or 10 Gbps Ethernet. Nothing special. I'm guessing that most of the load isn't from the root, e.g.: "j.root-servers.net", but from hosting the authoritative DNS servers for .com and .net (b.gtld-servers.net) on the same box. That would surely have more traffic and much more data.

Re: Chromium's Impact on Root DNS Traffic

#54

Post by jve »

1vuio0pswjnm7 wrote: post #49

Why does Chrome (Google) need to know whether DNS is being intercepted? What actions does Google take based on the answer? Note that under this crude test of sending queries for unregistered domains, a user who administers their own DNS could be indistingushiable from "DNS interception" by an ISP or other third party. I administer my own DNS. I do not use third party DNS. These random queries would just hit my own DN…

From article:

> Users on such networks might be shown the “did you mean” infobar on every single-term search. To work around this, Chromium needs to know if it can trust the network to provide non-intercepted DNS responses.

Don't know if this is the sole reason.

Re: Chromium's Impact on Root DNS Traffic

#55

Post by RedShift1 »

jve wrote: post #8

The first question I asked to myself: Is there a way to disable it? Networks i'm attached to, don't do any hijacking. And yes, luckily there is a policy to disable it: https://cloud.google.com/docs/chrome-enterprise/policies/?po... Registry key: Software\Policies\Google\Chrome\DNSInterceptionChecksEnabled PowerShell: Set-ItemProperty HKLM:\SOFTWARE\Policies\Google\Chrome -Name DNSInterceptionChecksEnabled -Value 0 -T…

I wouldn't apply this policy to road warriors even if they spend most of the time in a location you have under control.

Re: Chromium's Impact on Root DNS Traffic

#56

Post by moonchild »

jiggawatts wrote: post #53
steventhedev wrote: post #42

Earlier quoted context omitted.

Assuming the mean is close to the median, they are reporting ~10B requests daily with a median response size of around 1KB. 10TB daily is a little under 1Gpbs. Traffic is spiky, but this isn't particularly complex once you consider they have multiple data centers/servers. Of course, I may have misread something as daily that was hourly or something like that...

So it looks like the root namespace providers output a totally reasonable amount of traffic. Divided between the hundreds of points of presence globally, this is tens of megabits per physical host. This FAQ is illuminating: https://www.verisign.com/en_US/domain-names/internet-resolut... The servers themselves are ordinary 1 RU physical rack mount servers with 1 Gbps or 10 Gbps Ethernet. Nothing special. I'm guessing…

Reasonable quantity of traffic, but they have to be very reliable.

Re: Chromium's Impact on Root DNS Traffic

#57

Post by Taek »

jve wrote: post #54
1vuio0pswjnm7 wrote: post #49

Why does Chrome (Google) need to know whether DNS is being intercepted? What actions does Google take based on the answer? Note that under this crude test of sending queries for unregistered domains, a user who administers their own DNS could be indistingushiable from "DNS interception" by an ISP or other third party. I administer my own DNS. I do not use third party DNS. These random queries would just hit my own DN…

From article: > Users on such networks might be shown the “did you mean” infobar on every single-term search. To work around this, Chromium needs to know if it can trust the network to provide non-intercepted DNS responses. Don't know if this is the sole reason.

In my mind it's a good enough reason to justify trying to fix it.

Re: Chromium's Impact on Root DNS Traffic

#59

Post by ubercow13 »

elric wrote: post #26

I don't get this feature. And I really hate that it's present in pretty much every browser these days. If I want to type an URL, I'll use the address bar. If I want to search, I'll use the search bar. Different bars with different keyboard shortcuts and different purposes. Why do so many browsers merge these two? Screens are insanely wide these days, so screen real estate can't be the reason. Are we trying to trick u…

Firefox's omnibox is probably my favourite feature, it's so much better than separate bars. The reason is that it also searches within your bookmarks and history for items matching the terms you enter. At least half the time when I use the location bar, I am looking for a site I have been to before or bookmarked, and it will pop up as the first result in the suggestions. If nothing is found, it makes sense to fall back to a web search a lot of the time. How would this work with separate bars? Surely the history should be searched when typing in the location bar, but then you couldn't fall back to searching the web. Also, when looking for that site in my history, I might be typing part of the URL or part of the page title, so it is ambiguous whether it's a URL or search. Even if I am typing part of the URL, if it turns out nothing is found in my history, it might make sense to continue with the same terms as a web search instead of me trying to remember or form a whole URL from memory.

Chrome's implementation is terrible as it's designed to just funnel you into Google search, and doesn't give you a good idea of how useful it can be.

Re: Chromium's Impact on Root DNS Traffic

#60

Post by jlgaddis »

gbil wrote: post #6
kevingadd wrote: post #3

For me, the kicker: if I'm reading it correctly, over 40% of DNS traffic to the root server they examined is just diagnostic probes from Google Chrome being used to spot malicious DNS servers.

We got hit by this issue in March when our remotr users increased 5+ times and the DNS traffic going through our VPNs was causing a headache to our DNS servers. We pinpointed this to tis Chrome functionality, which includes also other chromium based browers like new Edge, and we had to deploy a relevant GPO to disable this functionality. Some background, I'm talking about ~200+k remote users. Also while in the office…

In a corporate / enterprise network where the DNS servers are Windows servers (domain controllers, in my experience, most of the time), the best thing you can do is stand up a few instances of , running on Linux, set them up as slaves for your internal zones, and point your users at those servers instead of your Windows servers.
Post reply on HN