Chromium's Impact on Root DNS Traffic

#1

Post by jakob223 » Fri, Aug 21, 2020, 4:04 AM UTC

Chromium's Impact on Root DNS Traffic
blog.apnic.net

Re: Chromium's Impact on Root DNS Traffic

#2

Post by alpb » Fri, Aug 21, 2020, 5:28 AM UTC

I think I've understood the most of the article but I missed the initial part. Why is there a probe in Chrome that uses DNS to query random 7-15 character long hostnames, only to get NXDOMAIN and burden the root nameservers? What does this probe achieve?

Re: Chromium's Impact on Root DNS Traffic

#3

Post by kevingadd » Fri, Aug 21, 2020, 5:28 AM UTC

For me, the kicker: if I'm reading it correctly, over 40% of DNS traffic to the root server they examined is just diagnostic probes from Google Chrome being used to spot malicious DNS servers.

Re: Chromium's Impact on Root DNS Traffic

#4

Post by kevingadd » Fri, Aug 21, 2020, 5:29 AM UTC

alpb wrote: post #2

I think I've understood the most of the article but I missed the initial part. Why is there a probe in Chrome that uses DNS to query random 7-15 character long hostnames, only to get NXDOMAIN and burden the root nameservers? What does this probe achieve?

Some DNS providers (like ISPs) will hijack NXDOMAINs and redirect you to ads or stuff like that. Chrome wants to detect that.

Re: Chromium's Impact on Root DNS Traffic

#5

Post by jiggawatts » Fri, Aug 21, 2020, 5:41 AM UTC

I'm curious to know how much data the root namespace servers put out in terms of gbps, but this doesn't seem to be public information.

Re: Chromium's Impact on Root DNS Traffic

#6

Post by gbil » Fri, Aug 21, 2020, 5:44 AM UTC

kevingadd wrote: post #3

For me, the kicker: if I'm reading it correctly, over 40% of DNS traffic to the root server they examined is just diagnostic probes from Google Chrome being used to spot malicious DNS servers.

We got hit by this issue in March when our remotr users increased 5+ times and the DNS traffic going through our VPNs was causing a headache to our DNS servers. We pinpointed this to tis Chrome functionality, which includes also other chromium based browers like new Edge, and we had to deploy a relevant GPO to disable this functionality. Some background, I'm talking about ~200+k remote users. Also while in the office the load is distributed in tenths of DNS servers, when on VPN only a fraction of those are used. Furthermore if I remember correctly this "feature" in chrome was enabled in a version which was distributed to our clients maybe a month before the lockdowns so there was little time to see the effect while clients were still in the office

Re: Chromium's Impact on Root DNS Traffic

#7

Post by the_pwner224 » Fri, Aug 21, 2020, 5:45 AM UTC

kevingadd wrote: post #3

For me, the kicker: if I'm reading it correctly, over 40% of DNS traffic to the root server they examined is just diagnostic probes from Google Chrome being used to spot malicious DNS servers.

Just thinking for a few seconds, I can think of a number of ways to not repeatedly spam DNS servers while still accomplishing the objective. If you were to send 3 random queries to Google every time you opened your browser, you would quickly get hellbanned behind a recaptcha.

Not saying that we should embark on some quest for retribution against Google. It's just sad.

Re: Chromium's Impact on Root DNS Traffic

#8

Post by jve » Fri, Aug 21, 2020, 5:51 AM UTC

The first question I asked to myself: Is there a way to disable it? Networks i'm attached to, don't do any hijacking.

And yes, luckily there is a policy to disable it: https://cloud.google.com/docs/chrome-enterprise/policies/?po...

Registry key: Software\Policies\Google\Chrome\DNSInterceptionChecksEnabled

PowerShell: Set-ItemProperty HKLM:\SOFTWARE\Policies\Google\Chrome -Name DNSInterceptionChecksEnabled -Value 0 -Type DWord

If you are managing Chrome via GPO, you should do it via GPO. Templates can be downloaded here: https://chromeenterprise.google/browser/download/

Re: Chromium's Impact on Root DNS Traffic

#9

Post by jiggawatts » Fri, Aug 21, 2020, 6:03 AM UTC

gbil wrote: post #6

kevingadd wrote: post #3

For me, the kicker: if I'm reading it correctly, over 40% of DNS traffic to the root server they examined is just diagnostic probes from Google Chrome being used to spot malicious DNS servers.

We got hit by this issue in March when our remotr users increased 5+ times and the DNS traffic going through our VPNs was causing a headache to our DNS servers. We pinpointed this to tis Chrome functionality, which includes also other chromium based browers like new Edge, and we had to deploy a relevant GPO to disable this functionality. Some background, I'm talking about ~200+k remote users. Also while in the office…

The last time I saw DNS throughput or performance issues was around 2003 on a network with 200K desktops and servers. That was 17 years ago, and they don't have a problem any more, despite growing in footprint to nearly half a million client machines.

I struggle to understand how DNS can possibly be a performance issue in 2020. In most corporate environments, the "working set" of a typical DNS servers will fit in the L3 cache of the CPU, or even the L2 cache.

The amount of network traffic involved is similarly miniscule. If all 200K of your client machines sent 100 requests per second, each 100 bytes in size, all of those to just one server, that adds up to a paltry 2 Gbps.

If your DNS servers are struggling with that, get better servers. Or networks. Or IT engineers.

Re: Chromium's Impact on Root DNS Traffic

#10

Post by russellbeattie » Fri, Aug 21, 2020, 6:03 AM UTC

I'm sure anyone here who has set up a PiHole ad-blocking DNS server at home has run into these random domain requests and wondered what was going on. At first I thought one of my devices had a virus on it or something until I did a few searches and discovered it was Chrome being ludicrous. (Next topic: Getting Chrome to actually use the DNS provider that you specify and nothing else...)