APNIC, the registrar responsible for the distribution of IP addresses in the Asia-Pacific region, results of traffic distribution analysis on one of the root DNS servers a.root-servers.net. 45.80% of the requests to the root server turned out to be related to checks performed by browsers based on the Chromium engine. Thus, almost half of the root DNS servers' resources are spent on performing diagnostic checks for Chromium rather than processing requests from DNS servers when determining root zones. Given that Chrome occupies 70% of the web browser market, such diagnostic activity leads to about 60 billion requests to root servers daily.
Diagnostic checks are used in Chromium to determine the application by service providers that redirect requests for non-existent names to their own handlers. Such systems are implemented by some providers to direct traffic to themselves for domain names entered incorrectly — typically, pages with error warnings, suggestions for likely correct names, and advertisements are shown for non-existent domains. This activity completely undermines the logic of determining intranet hosts in the browser.
When processing a search query entered in the address bar, if only one word is entered without dots, the browser first to resolve this word in DNS, assuming that the user might be trying to access an intranet site within a local network, instead of sending a query to the search engine. If the provider redirects requests for non-existent domain names to themselves, users face a problem — any one-word search queries entered in the address bar begin to be redirected to the provider's pages rather than being sent to the search engine.
To address this issue, Chromium developers added , which, when redirects are detected, change the logic of request processing in the address bar.
Each time a browser is launched, settings are changed in DNS, or the IP address changes, it sends three DNS requests with random first-level domain names that are highly likely to not exist. The names consist of 7 to 15 Latin letters (without dots) and are used to detect how the provider redirects non-existent domain names to their host. If two out of the three HTTP requests with random names result in a redirect to the same page, Chromium assumes that the user has been redirected to a third-party page.
Unusual sizes of first-level domains (from 7 to 15 letters) and the factor of request repetition (names were randomly generated and did not repeat each time) were used as indicators to highlight Chromium's activity from the overall stream of requests to the root DNS server.
Initially, the log filtered out requests for non-existent domains (78.09%), then highlighted requests that repeated no more than three times (51.41%), and subsequently filtered domains consisting of 7 to 15 letters (45.80%). Interestingly, only 21.91% of requests to the root servers were related to identifying existing domains.
The study also examined the relationship between the increasing load on the root servers a.root-servers.net and j.root-servers.net and the growing popularity of Chrome.
In Firefox, checks for redirects through DNS determining redirects to authentication pages (captive portal) and with the fixed subdomain 'detectportal.firefox.com', without querying first-level domain names. This behavior does not create additional load on the root DNS servers, but it may potentially leak confidential data about the user's IP address (a request is made to 'detectportal.firefox.com/success.txt' at each launch). To disable this check in Firefox, there is a setting 'network.captive-portal-service.enabled', which can be changed on the 'about:config' page.
Source: opennet.ru
