measuring the end user

Measuring the End User

Geoff HustonAPNIC Labs

Measurement Bias

WhenwefirstlookedatmeasuringintheInternet,itwasallaboutthenetwork,andthedistinctionbetweennetworkmanagementandnetworkmeasurementwasnotveryclear

Weendedupmeasuringwhat’seasytomeasureandoftenmissedmeasuringwhat’susefultounderstand

“Measurable” Questions?

• HowmanyroutesareIPv6routes?• HowmanyserviceprovidersofferIPv6?• HowmanydomainnameshaveAAAARRs?• HowmanydomainsareDNSSECsigned?• HowmanyDNSqueriesaremadeoverIPv6?• HowmuchtrafficusesIPv6?• HowmanyconnectionsuseIPv6?

…

Users vs Infrastructure

Noneofthesespecificmeasurementquestionsreallyembracethelargerquestionsabouttheenduserexperience

Theyareallaimedatmeasuringanaspectofofbehaviour withinparticularparametersofthenetworkinfrastructure,buttheydon’tencompasshowtheenduserassemblesacoherentviewofthenetwork

The Internet is all about US!

What’s the question?

Howmanyusers experience<x>?

• Howmanyusers arecapableofusingIPv6?• Howmanyusers canresolveaDNSname?• Howmanyusers areperformingDNSSECvalidation?• Howmanyusers supportECDSAindigitalsignaturesin

DNSSEC?etc

The Challenge:

Howcanweundertakemeaningfulpublicmeasurementsthat:

quantifyaspectsofusers’experiencesdrawnfromacrosstheentireInternetthatdon’trelyonaccesstoprivatedata?

For example… IPv6

• ItwouldbegoodtoknowhowwearegoingwiththetransitiontoIPv6

• AnditwouldbegoodeveryonetoknowhoweveryoneelseisgoingwiththetransitiontoIPv6

• Whatcanwemeasure?– IPv6intheDNS– AAAArecordsintheAlexa topN– IPv6inrouting– IPv6routingtable– IPv6trafficexchanges– trafficgraphs

• Whatshould wemeasure?– Howmanyconnecteddevicesontoday’sInternetarecapableofmakingIPv6connections?

How to measure millions of end devices for their IPv6

capability?


capability?

a)Be


capability?

OR

Haveyourmeasurementcoderunonamillionenddevices

Ads are ubiquitous

Ads use active scripts

• Advertisingchannelsuseactivescriptingtomakeadsinteractive– Thisisnotjustan‘animatedgif’– itusesascripttosensemousehovertochangethedisplayedimage

Adobe Flash and the network

• Flashincludesprimitivesin‘actionscript’tofetch‘networkassets’– Typicallyusedtoloadalternateimages,sequences– Notageneralizednetworkstack,subjecttoconstraintsoverwhatconnectionscanbemade

• Flashhasasynchronous‘threads’modelforeventdriven,spriteanimation

Adobe Flash and the network

• Flashincludesprimitivesin‘actionscript’tofetch‘networkassets’– Typicallyusedtoloadalternateimages,sequences– Notageneralizednetworkstack,subjecttoconstraintsoverwhatconnectionscanbemade

• Flashhasasynchronous‘threads’modelforeventdriven,spriteanimation

html5

APNIC’s measurement technique

• CraftascriptwhichfetchesasetofURLstomeasure

• URLsarereducedtoanotional‘1x1’imagewhichisnotaddedtothebrowser’sdisplaymanagerandisnotdisplayed

• URLstriggerDNSresolutionviawhatevernameresolutionmechanismisusedbythelocalbrowserandhost

• Andreportback:WeencodedatatransferfromtheclienttotheserverinthenameoffetchedURLs– CouldusetheDNSastheinformation conduit:

• ResultisreturnedbyDNSname– CoulduseHTTPastheinformationconduit

• ResultisreturnedviaparametersattachedtoanHTTPGETcommandWeuseacombinationofhttprequestsandserverlogs

The Ad Measurement Technique

Enduser

AdServer

AuthoritativeNameServer

WebServer


Enduser

AdServer


WebServer

1.AdImpression


Enduser

AdServer


WebServer

DNSResolvers

2.DNSresolution


Enduser

AdServer


WebServer3.WebFetch


Enduser

AdServer


WebServer4.ResultWebFetch



WebServer

Linode servers(x6)

DNS:Customised EVLDNSserverallowingDNSSEC-signedpseudowildcardsignedsubdomains*

WEB:NGINX– smalldynamiccontentServer

TCPDUMP:fullpacketcapturelog

*ThankstoRayBellisandISCforthis!

Experiment Variables

DNS– DNSSEC– DNSSECsigningalgorithms– Responsesize– TCPsupport– V4vsV6DNStransport– UDPbehaviour– UDPFragmentation– CNAME/DNAMEsupport– DNSRobustness– Resolverdistribution


URL– V4/V6– RTTvariance– TCPhandshakerobustness– OS/Browservariance– TCPMSS/Packetfragmentation– PathMTUbehaviour– URLstalking– Addresspermanencecharacteristics


DNS+URL– UsertoResolvermapping– Cacherefreshcharacteristics

What’s it good for?

Thisapproachallowsustoanalyzeuserbehaviour whenpresentedwithparticulartests– DNS:responsesize,TCPbehaviour,resolverdistribution,matchingresolverstousers,resolvertimers,EDNS0use,EDNS0clientsubnetuseandaccuracy,dualstackbehaviour,responsesize,…

–Web:Protocolpreference,dualstackbehaviour,responsesize,fragmentationbehaviour,…

(Some) Studies so far

We’veusedthisplatformtolookatlargescalemeasurementsof:– IPv6penetration– IPv6performanceandrobustness– DNSSECValidation– DNSSECperformance– PacketFragments/PathMTU– gTLD acceptance– NameCollisions– DNSresponsesizebehaviours

But…

It’snotageneralpurposecomputeplatform,soitcan’tdomanythings– Ping,traceroute,etc– Senddatatoanydestination– Pulldatafromanydestination– Usedifferentprotocols

Thisisa“many-to-one”styledsetupwheretheserverinstrumentationprovidesinsightontheinferredbehaviour oftheedges

In Summary…• Measuringwhathappensattheuserlevelbymeasuringsomeartifactorbehaviour intheinfrastructureandinferringsomeformofuserbehaviour isalwaysgoingtobeaguessofsomeform

• Ifyoureallywanttomeasureuserbehaviour thenitsusefultotriggertheusertobehaveinthewayyouwanttostudyormeasure

• Thetechniqueofembeddingsimpletestcodebehindadsisonewayofachievingthisobjective– forcertainkindsofbehaviours relatingtotheDNSandtoURLfetching

Thanks!

Additional Slides

Advertising placement logic

FreshEyeballs==UniqueIPs– Wehavegoodevidence theadvertisingchannel isabletosustainaconstantsupply

ofuniqueIPaddresses

Paybyimpression– Ifyouselect apreference forimpressions,thenthechanneltrieshardtopresent

youradtoasmanyuniqueIPsaspossible

Time/Location/Contexttuned– Canselect fortimeofday,physicallocationorkeywordcontexts(forsearch-related

ads)– Butifyoudon’tselect, thenplacement isgeneralized

Aimtofillbudget– Ifyourequest$100ofplacementaday,theninsidetheadplacementmachineryan

algorithmtrieshardtoachieveevenplacement loads,butintheend,will ‘soak’placeyouradtoachieveenoughviewstobill youthattargetof$100

0

1000

2000

3000

4000

5000

00:00 02:00 04:00 06:00 08:00 10:00 12:00 14:00 16:00 18:00 20:00 22:00 00:00

22/Mar

35

Ad Placement Training – Day 1

0

1000

2000

3000

4000

5000

00:00 02:00 04:00 06:00 08:00 10:00 12:00 14:00 16:00 18:00 20:00 22:00 00:00

22/Mar23/Mar

36


0

1000

2000

3000

4000

5000

00:00 02:00 04:00 06:00 08:00 10:00 12:00 14:00 16:00 18:00 20:00 22:00 00:00

22/Mar23/Mar24/Mar

37


0

1000

2000

3000

4000

5000

00:00 02:00 04:00 06:00 08:00 10:00 12:00 14:00 16:00 18:00 20:00 22:00 00:00

22/Mar23/Mar24/Mar25/Mar

38


0

1000

2000

3000

4000

5000

00:00 02:00 04:00 06:00 08:00 10:00 12:00 14:00 16:00 18:00 20:00 22:00 00:00

23/Mar24/Mar25/Mar26/Mar27/Mar28/Mar29/Mar30/Mar31/Mar01/Apr

39

Ad Placement Training – Days 5, 6 & 7

Fresh Eyeballs

Ads

WebPage

Ad Placement Profile

Daily Variance in Placements

Success!

• 2.5M– 10Msamplesperday– mostlynew!• LargesamplespaceacrossmuchoftheknownInternet

• AssemblearichdatasetofenduseraddressesandDNSresolvers

Success … of a sort!

• WhatweareafterisarandomsampleoftheentireInternet

Andweareclose

• Butwhatwehaveisadatasetbiasedtowards“cheap”eyeballsinfixednetworks

“Raw” AD counts per day155,430VNVietnam103,517CNChina92,107MXMexico79,092THThailand73,702INIndia65,402PKPakistan64,121BRBrazil54,637TRTurkey52,532USUnited States ofAmerica52,240ARArgentina48,315COColombia45,216IDIndonesia39,839PEPeru36,962RURussianFederation34,529PHPhilippines33,899EGEgypt22,983TWTaiwan22,712RORomania22,490UAUkraine22,403ESSpain

IP address to country code mapping for experiments placed on the 24th May 2015

Impressions per Country

ITU-T’s Internet User Census

155,430VNVietnam103,517CNChina92,107MXMexico79,092THThailand73,702INIndia65,402PKPakistan64,121BRBrazil54,637TRTurkey52,532USUnited States ofAmerica52,240ARArgentina48,315COColombia45,216IDIndonesia39,839PEPeru36,962RURussian Federation34,529PHPhilippines33,899EGEgypt22,983TWTaiwan22,712RORomania22,490UAUkraine22,403ESSpain

668,493,485China282,384872UnitedStatesofAmerica252,482905 India110,345878Brazil109,390190 Japan87,305661RussianFederation72,663301Nigeria71,823404 Indonesia71,174958Germany61,579582Mexico57,306333UnitedKingdomofGreatBritainandNorthernIreland54,114094 France45,416941 Iran(IslamicRepublicof)45,019465 Egypt42,187842RepublicofKorea41,780667Philippines40,980368Vietnam39,256999Bangladesh35,793673 Italy35,503461 Turkey

ITU’s estimates of number of Internet users per country

“Weighting” sample data to correct AD Placement bias

We“weight”therawdataby:– Geolocating theIPaddresstoaparticularcountry– Multiplyingthesamplebytherelativeweightofthecountry

Weighting the Results

Measuring ALL of the Internet

It’snotperfectbyanymeans,butitisareasonablefirstpasstocorrectfortheimplicitadplacementbiasintherawdata

SonowwehaveamethodtomeasureasampleofInternetusersandaprocessthatcanrelatethatmeasurementbacktotheInternetasawhole.

Howcanweusethis?

What does this allow?

InprovidinganenduserwithasetofURLstoretrievewecanexamine:– Protocolbehaviour

e.g.:V4vs V6,protocolperformance,connectionfailurerate

– DNSbehaviourse.g.:DNSSECuse,DNSresolutionperformance,DNSresponsesize,cryptoprotocolperformance,…

1. Measuring IPv6

Measuring IPv6

Clientisgiven4uniqueURLstoload:• DualStackobject• V4-onlyobject• V6-onlyobject• ResultreportingURL(10secondtimer)

WewanttocomparethenumberofenddevicesthatcanretrievetheV6-onlyobjecttothenumberofdevicesthatcanretrievetheV4-onlyobject(V6Capable)WecanalsolookatthenumberofenddevicesthatuseIPv6toretrievetheDualStackObject(V6Preferred)

What we see (Web Log)temora.rand.apnic.net 124.13.125.185[04/Aug/2015:00:01:29+0000]"GET/newadcfg/ad.py?A=2121&N&R&FHTTP/1.1"200799"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,likeGecko)Chrome/44.0.2403.125Safari/537.36"0.000u281fd425-s14386464891438646489.894cfg.dotnxdomain.net

temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.rd.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net

temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.eHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net

temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r6.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.57806u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net

temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.fHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.8710di-u281fd425-s1438646489-i5097.ap.dotnxdomain.net

temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.dHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.1590ds-u281fd425-s1438646489-i5097.ap.dotnxdomain.net

temora.rand.apnic.net 124.13.125.185[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r4.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.44804u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net

temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.results&zrdtd-390.zr4td-1548.zr6td-678.zd-1258.ze-390.zf-971.HTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.8150du-results-u281fd425-x-i5097.ap.dotnxdomain.net








temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.results&zrdtd-390.zr4td-1548.zr6td-678.zd-1258.ze-390.zf-971.HTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.8150du-results-u281fd425-s1438646489-i5097.ap.dotnxdomain.net

This is a Mac OSX system, using OS X 10.9.5, with Chrome 44.0.2403.125




temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278 [04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r6.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.57806u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net





This system can do IPv6, and prefers to use IPv6 in dual stack contexts





temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.f HTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.8710di-u281fd425-s1438646489-i5097.ap.dotnxdomain.net




This experiment ran through to conmpletion

What we see (Web Log)temora.rand.apnic.net 124.13.125.185 [04/Aug/2015:00:01:29+0000]"GET/newadcfg/ad.py?A=2121&N&R&FHTTP/1.1"200799"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,likeGecko)Chrome/44.0.2403.125Safari/537.36"0.000u281fd425-s14386464891438646489.894cfg.dotnxdomain.net

temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278 [04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.rd.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net



temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.f HTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.8710di-u281fd425-s1438646489-i5097.ap.dotnxdomain.net




This user is a customer of TMNET in Malaysia, AS4788

IPv6 Deployment

Google’s view:

Why are they different?

As far as I am aware, Google do not perform per-country weighting, and it is likely that they are over-sampling the US and Western Europe and also likely that they are under-sampling in China, Africa and South America

IPv6 Deployment in the US

IPv6 Deployment in Comcast

Measuring Platforms –July 2015

Win$72%$

Andriod$16%$

iOS$6%$

Mac$4%$

Linux$1%$

Windows$Phone$1%$

Chrome$0%$

Firefox$0%$

Other$0%$

OS#Share#

Measuring Platforms –January 2016

Win37%

Android33%

iOS27%

Mac2%

Linux1%

Winows Phone0%

ChromeOS0%

Other0%

OSSHARE- JANUARY2016

Windows37%

Android33%

iOS27%

Measuring Browsers –July 2015

Chrome'68%'

Firefox'12%'

Safari'8%'

Explorer'6%'

Mobile_Safari'4%'

Opera'2%'

Other'0%'

Mozilla'0%'

Netscape'0%'

Browsers'

Measuring Browsers –January 2016

Chrome52%

Safari38%

Firefox6%

MSIE3%

Opera1%

Silk0%

Chromium0%

Other0%

BrowserShare

2. Measuring DNS Behaviours

Measuring DNSSEC

Clientisgiven4 uniqueURLstoload:• DNSSEC-validlysignedDNSname• DNSSEC-invalidlysignedDNSname• UnsignedDNSname(control)• ResultreportingURL(10secondtimer)AllDNSisIPv4

What We See (DNS Log)1438646489.920[ap]04-Aug-201500:01:29.920202.188.0.254#141180du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net.INAAAA-ED()01571438646489.920[ap]04-Aug-201500:01:29.920202.188.0.254#291104u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net.INA-ED()01451438646489.921[ap]04-Aug-201500:01:29.921202.188.0.254#404610du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net.INA-ED()01451438646489.922[ap]04-Aug-201500:01:29.922202.188.0.254#4875506u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net.INAAAA-ED()01571438646489.923[ap]04-Aug-201500:01:29.923202.188.0.254#1223006u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net.INA-ED()0203

1453248859.615[ap]20-Jan-201600:14:19.615117.102.103.194#582700ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INA- ()01341453248860.616[ap]20-Jan-201600:14:20.616202.155.0.150#554300ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INA-ED()04051453248860.708[ap]20-Jan-201600:14:20.708202.155.0.150#389140ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INDS-ED()03931453248860.798[ap]20-Jan-201600:14:20.798202.155.135.9#276980ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INDS-EDC()03931453248860.887[ap]20-Jan-201600:14:20.887202.155.135.9#53440ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INA-EDC()04051453248860.978[ap]20-Jan-201600:14:20.978202.155.0.150#114340ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INDNSKEY-ED()05371453248861.067[ap]20-Jan-201600:14:21.067202.155.135.9#437050ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INDNSKEY-EDC()0537

DNSSEC Validation “signature”

DNSSEC Validation

DNSSEC Validation in Sweden

DNSSEC Validation in US

What Else?

• The“market”forDNSresolution:howmanyuserssendtheirqueriesthroughGoogle’sPublicDNSservers?

• Howmanyusersuseresolverslocatedinaforeigncountry?

• Whichcountries?

Foreign (CC) Resolution: Top Resolvers by AS

Rank AS Use AS Name

1 15169 42.69% GOOGLE - Google Inc.,US2 3356 7.47% LEVEL3 - Level 3 Communications, Inc.,US3 36692 7.05% OPENDNS - OpenDNS, LLC,US4 19994 2.56% RACKSPACE - Rackspace Hosting,US5 174 1.87% COGENT-174 - Cogent Communications,US

6 16880 1.70% AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED,US7 2914 1.09% NTT-COMMUNICATIONS-2914 - NTT America, Inc.,US8 4134 0.91% CHINANET-BACKBONE No.31,Jin-rong Street,CN9 29791 0.70% VOXEL-DOT-NET - Voxel Dot Net, Inc.,US

10 3462 0.67% HINET Data Communication Business Group,TW

11 9121 0.64% TTNET Turk Telekomunikasyon Anonim Sirketi,TR12 3303 0.64% SWISSCOM Swisscom (Switzerland) Ltd,CH13 6939 0.63% HURRICANE - Hurricane Electric, Inc.,US14 6147 0.50% Telefonica del Peru S.A.A.,PE15 6713 0.48% IAM-AS,MA

16 8048 0.47% CANTV Servicios, Venezuela,VE17 3257 0.47% TINET-BACKBONE Tinet SpA,DE18 13238 0.43% YANDEX Yandex LLC,RU19 45595 0.41% PKTELECOM-AS-PK Pakistan Telecom Company Limited,PK20 9299 0.40% IPG-AS-AP Philippine Long Distance Telephone Company,PH

21 7643 0.39% VNPT-AS-VN Vietnam Posts and Telecommunications (VNPT),VN22 45758 0.39% TRIPLETNET-AS-AP TripleT Internet Internet service provider Bangkok,TH23 8151 0.38% Uninet S.A. de C.V.,MX24 7470 0.35% TRUEINTERNET-AS-AP TRUE INTERNET Co.,Ltd.,TH25 4837 0.35% CHINA169-BACKBONE CNCGROUP China169 Backbone,CN

Total: 21,770,772 (28% of total) end user query sets

Offshore DNS from HK Users

Market Penetration of Google’s Public DNS

3. Digital Stalking

7

StreetArt:Banksy Geoff Huston, APNIC

Some Stalker Numbers

Inthefirst248daysof2014wesaw:– 123,110,633uniqueend-userIPaddressespresentedtoourserversfromthesetestscripts

– 317,309oftheseend-userIPaddressespresentedHTTPGETstringstousthatweresubsequentlypresentedtousfromadifferentclientIPaddress!

That’ssome1in400*usersthatseemtohaveattractedsomekindofdigitalstalker!

*Ormaybeabitmore,duetoNATshidingmultipleendusersbehindasinglepublicIPaddress

Online Privacy? Really?

It’shardtobelievethattoday’sInternetrespectspersonalprivacywhenitseemsthataround1in400usershaveattractedsomekindofdigitalstalkerthattrackstheURLstheyvisit.

Stalking Rates by CountryCC Samples Stalked Rate/1,000,000 CountryIR 674 111 164,688 Iran (Islamic Republic of)LA 28,506 2,875 100,855 Lao People's Democratic RepublicMO 38,761 2,954 76,210 Macao Special Administrative Region of ChinaSG 240,188 17,406 72,468 Singapore HK 486,101 22,136 45,537 Hong Kong Special Administrative Region of ChinaCN 10,419,638 435,040 41,751 China GB 872,124 28,845 33,074 United Kingdom of Great Britain and Northern IrelandTW 1,769,367 36,823 20,811 Taiwan JP 1,500,779 23,971 15,972 Japan AU 293,193 4,620 15,757 Australia US 4,491,711 53,370 11,881 United States of AmericaMY 1,035,434 10,214 9,864 Malaysia AL 437,399 4,043 9,243 Albania CA 947,922 6,244 6,587 Canada KH 143,886 897 6,234 Cambodia MM 16,411 97 5,910 Myanmar MK 458,820 2,214 4,825 The former Yugoslav Republic of MacedoniaBZ 8,139 35 4,300 Belize MN 57,622 233 4,043 MongoliaNZ 344,951 1,385 4,015 New ZealandCV 3,742 14 3,741 Cape VerdeME 223,005 775 3,475 MontenegroFJ 14,892 47 3,156 Fiji SR 44,116 136 3,082 Suriname AW 11,123 34 3,056 Aruba

Stalking Delay

The 15, 30 and 60 minute local peaks are likely to be local web proxy refresh cycles

This local peak matches a result timer in the test script

Top 25 International Stalkers

Rank IP Net # AVG Delay AS Description

1 119.147.146.0 205,033 130.7 4134 CHINANET-BACKBONE No.31,Jin-rong Street,CN

2 101.226.33.0 6,198 1,576.1 4812 CHINANET-SH-AP China Telecom (Group),CN



5 112.64.235.0 3,819 1,544.9 17621 CNCGROUP-SH China Unicom Shanghai network,CN



8 223.27.200.0 2,740 1.8 45796 BBCONNECT-TH-AS-AP BB Connect Co., Ltd.,TH




12 69.41.14.0 1,243 1,127.4 47018 CE-BGPAC - Covenant Eyes, Inc.,US


14 112.65.193.0 1,038 1,623.9 17621 CNCGROUP-SH China Unicom Shanghai network,CN

15 64.124.98.0 906 1,288.9 6461 ABOVENET - Abovenet Communications, Inc,US

16 180.153.114.0 819 1,632.6 4812 CHINANET-SH-AP China Telecom (Group),CN


18 208.184.77.0 649 1,419.5 6461 ABOVENET - Abovenet Communications, Inc,US




22 183.60.153.0 262 451.3 4134 CHINANET-BACKBONE No.31,Jin-rong Street,CN



25 208.80.194.0 227 10,731.5 13448 WEBSENSE - Websense, Inc,US

The Leakiest Browser!

Wow! “Public Security Equipment 110 No 0000000025!”

4. Access ISP Market Share

http://stats.labs.apnic.net/aspop

Market Share in HK

What Else?

AnalysisoffailurepatternstodetectevidenceofstructuredinterceptionofDNSandWebretrieval

Content Blocking in Iran?

0

2

4

6

8

10

12

14

16

18

20

22

24

26

28

30

32

34

36

38

40

42

44

46

48

50

52

54

56

58

60

62

64

66

68

70

72

74

76

78

80

82

84

86

88

90

92

94

96

98

100

academyaccountantsactoragencyairforcearmyassociatesattorneyauctionaudiobandbarbargainsbeerbestbid bikebio blackblackfridayblueboutiquebrusselsbuildbuildersbusinessbuzzbzhcabcameracampcapetowncapitalcardscarecareercareerscasacashcateringcenterceocheapchristmaschurchcityclaimscleaningclickclinicclothingcoachcodescoffeecolognecommunitycompanycomputercondosconstructioncontractorscookingcoolcountrycreditcreditcardcricketcruisescymrudancedatingdealsdegreedeliverydemocratdentaldentistdesidiamondsdietdigitaldirectdirectorydiscountdomainsdurbaneducationemailenergyengineerengineeringenterprisesequipmentestateeventsexchangeexpertexposedfailfarmfashionfinancefinancialfishfishingfitnessflightsfloristflowersforsalefoundationfrl fundfurniturefutbolgallerygardengentgiftgiftsgivesglassgraphicsgratisgripeguideguitarsguruhaushealthcarehelphiphopholdingsholidayhorsehosthostinghousehowil immoimmobilienindustriesink instituteinsureinternationalinvestmentsjetztjoburgjuegoskaufenkim kitchenkiwikoelnlandlawyerleaselgbtlife lightinglimitedlimolinkloanslondonmaisonmanagementmarketmarketingmediamemorialmenumobimodamoemoneymortgagemoscownagoyanamenavynetworkngoninjaokinawaongoooosakaparispartnerspartspartyphotophotographyphotospicspicturespinkpizzaplaceplumbingpokerpressproductionspropertiespropertypubqponquebecrecipesredrehabreisenrentalsrepairreportrepublicanrestrestaurantreviewsrip rocksrodeoryukyusaarlandsarlschulescienceservicessexyshikshashoessinglessocialsoftwaresolarsolutionssoyspacesuppliessupplysupportsurfsurgerysx systemstatartattootax technologytel tiendatipstirestiroltodaytokyotoolstowntoystradetraininguniversityunovacationsventuresvetviajesvillasvisionvlaanderenvodkavotingvoyagewaleswangwatchwebcamwebsiteweddingwhoswhowienwikiworkworksworldwtfxn--6qq986b3xlxn--80adxhksxn--80asehdbxn--80aswgxn--c1avgxn--i1b6b1a6a2exn--mgbab2bdxn--ngbc5azdxn--nqv7fxn--q9jyb4cxyzyogayokohamazone

%

Iran (Islamic Republic of) (IR) - 11025 Measurements

Web WebX NoWeb NoDNS LateWeb

.il appears to use DNSResponse blocking

.sexy appears to use WebResponse blocking

Hong Kong

0

2

4

6

8

10

12

14

16

18

20

22

24

26

28

30

32

34

36

38

40

42

44

46

48

50

52

54

56

58

60

62

64

66

68

70

72

74

76

78

80

82

84

86

88

90

92

94

96

98

100

academy

accountantsactoragencyairforcearm

yassociatesattorneyauctionaudiobandbarbargainsbeerbestbidbikebioblackblackfridayblueboutiquebrusselsbuildbuildersbusinessbuzzbzhcabcam

eracam

pcapetow

ncapitalcardscarecareercareerscasacashcateringcenterceocheapchristm

aschurchcityclaim

scleaningclickclinicclothingcoachcodescoffeecolognecom

munity

company

computer

condosconstructioncontractorscookingcoolcountrycreditcreditcardcricketcruisescym

rudancedatingdealsdegreedeliverydem

ocratdentaldentistdesidiam

ondsdietdigitaldirectdirectorydiscountdom

ainsdurbaneducationem

ailenergyengineerengineeringenterprisesequipm

entestateeventsexchangeexpertexposedfailfarmfashionfinancefinancialfishfishingfitnessflightsfloristflow

ersforsalefoundationfrl fundfurniturefutbolgallerygardengentgiftgiftsgivesglassgraphicsgratisgripeguideguitarsguruhaushealthcarehelphiphopholdingsholidayhorsehosthostinghousehowil im

mo

imm

obilienindustriesinkinstituteinsureinternationalinvestm

entsjetztjoburgjuegoskaufenkimkitchenkiw

ikoelnlandlaw

yerleaselgbtlifelightinglim

itedlim

olinkloanslondonm

aisonm

anagement

market

marketing

media

mem

orialm

enum

obim

odam

oem

oneym

ortgagem

oscownagoyanam

enavynetw

orkngoninjaokinaw

aongoooosakaparispartnerspartspartyphotophotographyphotospicspicturespinkpizzaplaceplum

bingpokerpressproductionspropertiespropertypubqponquebecrecipesredrehabreisenrentalsrepairreportrepublicanrestrestaurantreview

srip rocksrodeoryukyusaarlandsarlschulescienceservicessexyshikshashoessinglessocialsoftw

aresolarsolutionssoyspacesuppliessupplysupportsurfsurgerysx system

statartattootaxtechnologyteltiendatipstirestiroltodaytokyotoolstow

ntoystradetraininguniversityunovacationsventuresvetviajesvillasvisionvlaanderenvodkavotingvoyagew

alesw

angw

atchw

ebcamw

ebsitew

eddingw

hoswho

wien

wiki

work

works

world

wtf

xn--6qq986b3xlxn--80adxhksxn--80asehdbxn--80asw

gxn--c1avgxn--i1b6b1a6a2exn--m

gbab2bdxn--ngbc5azdxn--nqv7fxn--q9jyb4cxyzyogayokoham

azone

%

Hong Kong Special Administrative Region of China (HK) - 248750 Measurements

Web WebX NoWeb NoDNS LateWeb

That looks like a high (3%) DNS loss rate – why?