Measuring the End User
Geoff HustonAPNIC Labs
Measurement Bias
WhenwefirstlookedatmeasuringintheInternet,itwasallaboutthenetwork,andthedistinctionbetweennetworkmanagementandnetworkmeasurementwasnotveryclear
Weendedupmeasuringwhat’seasytomeasureandoftenmissedmeasuringwhat’susefultounderstand
“Measurable” Questions?
• HowmanyroutesareIPv6routes?• HowmanyserviceprovidersofferIPv6?• HowmanydomainnameshaveAAAARRs?• HowmanydomainsareDNSSECsigned?• HowmanyDNSqueriesaremadeoverIPv6?• HowmuchtrafficusesIPv6?• HowmanyconnectionsuseIPv6?
…
Users vs Infrastructure
Noneofthesespecificmeasurementquestionsreallyembracethelargerquestionsabouttheenduserexperience
Theyareallaimedatmeasuringanaspectofofbehaviour withinparticularparametersofthenetworkinfrastructure,buttheydon’tencompasshowtheenduserassemblesacoherentviewofthenetwork
The Internet is all about US!
What’s the question?
Howmanyusers experience<x>?
• Howmanyusers arecapableofusingIPv6?• Howmanyusers canresolveaDNSname?• Howmanyusers areperformingDNSSECvalidation?• Howmanyusers supportECDSAindigitalsignaturesin
DNSSEC?etc
The Challenge:
Howcanweundertakemeaningfulpublicmeasurementsthat:
quantifyaspectsofusers’experiencesdrawnfromacrosstheentireInternetthatdon’trelyonaccesstoprivatedata?
For example… IPv6
• ItwouldbegoodtoknowhowwearegoingwiththetransitiontoIPv6
• AnditwouldbegoodeveryonetoknowhoweveryoneelseisgoingwiththetransitiontoIPv6
• Whatcanwemeasure?– IPv6intheDNS– AAAArecordsintheAlexa topN– IPv6inrouting– IPv6routingtable– IPv6trafficexchanges– trafficgraphs
• Whatshould wemeasure?– Howmanyconnecteddevicesontoday’sInternetarecapableofmakingIPv6connections?
How to measure millions of end devices for their IPv6
capability?
How to measure millions of end devices for their IPv6
capability?
a)Be
How to measure millions of end devices for their IPv6
capability?
OR
Haveyourmeasurementcoderunonamillionenddevices
Ads are ubiquitous
Ads are ubiquitous
Ads are ubiquitous
Ads use active scripts
• Advertisingchannelsuseactivescriptingtomakeadsinteractive– Thisisnotjustan‘animatedgif’– itusesascripttosensemousehovertochangethedisplayedimage
Adobe Flash and the network
• Flashincludesprimitivesin‘actionscript’tofetch‘networkassets’– Typicallyusedtoloadalternateimages,sequences– Notageneralizednetworkstack,subjecttoconstraintsoverwhatconnectionscanbemade
• Flashhasasynchronous‘threads’modelforeventdriven,spriteanimation
Adobe Flash and the network
• Flashincludesprimitivesin‘actionscript’tofetch‘networkassets’– Typicallyusedtoloadalternateimages,sequences– Notageneralizednetworkstack,subjecttoconstraintsoverwhatconnectionscanbemade
• Flashhasasynchronous‘threads’modelforeventdriven,spriteanimation
html5
APNIC’s measurement technique
• CraftascriptwhichfetchesasetofURLstomeasure
• URLsarereducedtoanotional‘1x1’imagewhichisnotaddedtothebrowser’sdisplaymanagerandisnotdisplayed
• URLstriggerDNSresolutionviawhatevernameresolutionmechanismisusedbythelocalbrowserandhost
• Andreportback:WeencodedatatransferfromtheclienttotheserverinthenameoffetchedURLs– CouldusetheDNSastheinformation conduit:
• ResultisreturnedbyDNSname– CoulduseHTTPastheinformationconduit
• ResultisreturnedviaparametersattachedtoanHTTPGETcommandWeuseacombinationofhttprequestsandserverlogs
The Ad Measurement Technique
Enduser
AdServer
AuthoritativeNameServer
WebServer
The Ad Measurement Technique
Enduser
AdServer
AuthoritativeNameServer
WebServer
1.AdImpression
The Ad Measurement Technique
Enduser
AdServer
AuthoritativeNameServer
WebServer
DNSResolvers
2.DNSresolution
The Ad Measurement Technique
Enduser
AdServer
AuthoritativeNameServer
WebServer3.WebFetch
The Ad Measurement Technique
Enduser
AdServer
AuthoritativeNameServer
WebServer4.ResultWebFetch
The Ad Measurement Technique
AuthoritativeNameServer
WebServer
Linode servers(x6)
DNS:Customised EVLDNSserverallowingDNSSEC-signedpseudowildcardsignedsubdomains*
WEB:NGINX– smalldynamiccontentServer
TCPDUMP:fullpacketcapturelog
*ThankstoRayBellisandISCforthis!
Experiment Variables
DNS– DNSSEC– DNSSECsigningalgorithms– Responsesize– TCPsupport– V4vsV6DNStransport– UDPbehaviour– UDPFragmentation– CNAME/DNAMEsupport– DNSRobustness– Resolverdistribution
Experiment Variables
URL– V4/V6– RTTvariance– TCPhandshakerobustness– OS/Browservariance– TCPMSS/Packetfragmentation– PathMTUbehaviour– URLstalking– Addresspermanencecharacteristics
Experiment Variables
DNS+URL– UsertoResolvermapping– Cacherefreshcharacteristics
What’s it good for?
Thisapproachallowsustoanalyzeuserbehaviour whenpresentedwithparticulartests– DNS:responsesize,TCPbehaviour,resolverdistribution,matchingresolverstousers,resolvertimers,EDNS0use,EDNS0clientsubnetuseandaccuracy,dualstackbehaviour,responsesize,…
–Web:Protocolpreference,dualstackbehaviour,responsesize,fragmentationbehaviour,…
(Some) Studies so far
We’veusedthisplatformtolookatlargescalemeasurementsof:– IPv6penetration– IPv6performanceandrobustness– DNSSECValidation– DNSSECperformance– PacketFragments/PathMTU– gTLD acceptance– NameCollisions– DNSresponsesizebehaviours
But…
It’snotageneralpurposecomputeplatform,soitcan’tdomanythings– Ping,traceroute,etc– Senddatatoanydestination– Pulldatafromanydestination– Usedifferentprotocols
Thisisa“many-to-one”styledsetupwheretheserverinstrumentationprovidesinsightontheinferredbehaviour oftheedges
In Summary…• Measuringwhathappensattheuserlevelbymeasuringsomeartifactorbehaviour intheinfrastructureandinferringsomeformofuserbehaviour isalwaysgoingtobeaguessofsomeform
• Ifyoureallywanttomeasureuserbehaviour thenitsusefultotriggertheusertobehaveinthewayyouwanttostudyormeasure
• Thetechniqueofembeddingsimpletestcodebehindadsisonewayofachievingthisobjective– forcertainkindsofbehaviours relatingtotheDNSandtoURLfetching
Thanks!
Additional Slides
Advertising placement logic
FreshEyeballs==UniqueIPs– Wehavegoodevidence theadvertisingchannel isabletosustainaconstantsupply
ofuniqueIPaddresses
Paybyimpression– Ifyouselect apreference forimpressions,thenthechanneltrieshardtopresent
youradtoasmanyuniqueIPsaspossible
Time/Location/Contexttuned– Canselect fortimeofday,physicallocationorkeywordcontexts(forsearch-related
ads)– Butifyoudon’tselect, thenplacement isgeneralized
Aimtofillbudget– Ifyourequest$100ofplacementaday,theninsidetheadplacementmachineryan
algorithmtrieshardtoachieveevenplacement loads,butintheend,will ‘soak’placeyouradtoachieveenoughviewstobill youthattargetof$100
0
1000
2000
3000
4000
5000
00:00 02:00 04:00 06:00 08:00 10:00 12:00 14:00 16:00 18:00 20:00 22:00 00:00
22/Mar
35
Ad Placement Training – Day 1
0
1000
2000
3000
4000
5000
00:00 02:00 04:00 06:00 08:00 10:00 12:00 14:00 16:00 18:00 20:00 22:00 00:00
22/Mar23/Mar
36
Ad Placement Training – Day 2
0
1000
2000
3000
4000
5000
00:00 02:00 04:00 06:00 08:00 10:00 12:00 14:00 16:00 18:00 20:00 22:00 00:00
22/Mar23/Mar24/Mar
37
Ad Placement Training – Day 3
0
1000
2000
3000
4000
5000
00:00 02:00 04:00 06:00 08:00 10:00 12:00 14:00 16:00 18:00 20:00 22:00 00:00
22/Mar23/Mar24/Mar25/Mar
38
Ad Placement Training – Day 4
0
1000
2000
3000
4000
5000
00:00 02:00 04:00 06:00 08:00 10:00 12:00 14:00 16:00 18:00 20:00 22:00 00:00
23/Mar24/Mar25/Mar26/Mar27/Mar28/Mar29/Mar30/Mar31/Mar01/Apr
39
Ad Placement Training – Days 5, 6 & 7
Fresh Eyeballs
Ads
WebPage
Ad Placement Profile
Daily Variance in Placements
Success!
• 2.5M– 10Msamplesperday– mostlynew!• LargesamplespaceacrossmuchoftheknownInternet
• AssemblearichdatasetofenduseraddressesandDNSresolvers
Success … of a sort!
• WhatweareafterisarandomsampleoftheentireInternet
Andweareclose
• Butwhatwehaveisadatasetbiasedtowards“cheap”eyeballsinfixednetworks
“Raw” AD counts per day155,430VNVietnam103,517CNChina92,107MXMexico79,092THThailand73,702INIndia65,402PKPakistan64,121BRBrazil54,637TRTurkey52,532USUnited States ofAmerica52,240ARArgentina48,315COColombia45,216IDIndonesia39,839PEPeru36,962RURussianFederation34,529PHPhilippines33,899EGEgypt22,983TWTaiwan22,712RORomania22,490UAUkraine22,403ESSpain
IP address to country code mapping for experiments placed on the 24th May 2015
Impressions per Country
ITU-T’s Internet User Census
155,430VNVietnam103,517CNChina92,107MXMexico79,092THThailand73,702INIndia65,402PKPakistan64,121BRBrazil54,637TRTurkey52,532USUnited States ofAmerica52,240ARArgentina48,315COColombia45,216IDIndonesia39,839PEPeru36,962RURussian Federation34,529PHPhilippines33,899EGEgypt22,983TWTaiwan22,712RORomania22,490UAUkraine22,403ESSpain
668,493,485China282,384872UnitedStatesofAmerica252,482905 India110,345878Brazil109,390190 Japan87,305661RussianFederation72,663301Nigeria71,823404 Indonesia71,174958Germany61,579582Mexico57,306333UnitedKingdomofGreatBritainandNorthernIreland54,114094 France45,416941 Iran(IslamicRepublicof)45,019465 Egypt42,187842RepublicofKorea41,780667Philippines40,980368Vietnam39,256999Bangladesh35,793673 Italy35,503461 Turkey
ITU’s estimates of number of Internet users per country
“Weighting” sample data to correct AD Placement bias
We“weight”therawdataby:– Geolocating theIPaddresstoaparticularcountry– Multiplyingthesamplebytherelativeweightofthecountry
Weighting the Results
Measuring ALL of the Internet
It’snotperfectbyanymeans,butitisareasonablefirstpasstocorrectfortheimplicitadplacementbiasintherawdata
SonowwehaveamethodtomeasureasampleofInternetusersandaprocessthatcanrelatethatmeasurementbacktotheInternetasawhole.
Howcanweusethis?
What does this allow?
InprovidinganenduserwithasetofURLstoretrievewecanexamine:– Protocolbehaviour
e.g.:V4vs V6,protocolperformance,connectionfailurerate
– DNSbehaviourse.g.:DNSSECuse,DNSresolutionperformance,DNSresponsesize,cryptoprotocolperformance,…
1. Measuring IPv6
Measuring IPv6
Clientisgiven4uniqueURLstoload:• DualStackobject• V4-onlyobject• V6-onlyobject• ResultreportingURL(10secondtimer)
WewanttocomparethenumberofenddevicesthatcanretrievetheV6-onlyobjecttothenumberofdevicesthatcanretrievetheV4-onlyobject(V6Capable)WecanalsolookatthenumberofenddevicesthatuseIPv6toretrievetheDualStackObject(V6Preferred)
What we see (Web Log)temora.rand.apnic.net 124.13.125.185[04/Aug/2015:00:01:29+0000]"GET/newadcfg/ad.py?A=2121&N&R&FHTTP/1.1"200799"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,likeGecko)Chrome/44.0.2403.125Safari/537.36"0.000u281fd425-s14386464891438646489.894cfg.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.rd.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.eHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r6.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.57806u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.fHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.8710di-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.dHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.1590ds-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 124.13.125.185[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r4.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.44804u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.results&zrdtd-390.zr4td-1548.zr6td-678.zd-1258.ze-390.zf-971.HTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.8150du-results-u281fd425-x-i5097.ap.dotnxdomain.net
What we see (Web Log)temora.rand.apnic.net 124.13.125.185[04/Aug/2015:00:01:29+0000]"GET/newadcfg/ad.py?A=2121&N&R&FHTTP/1.1"200799"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,likeGecko)Chrome/44.0.2403.125Safari/537.36"0.000u281fd425-s14386464891438646489.894cfg.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.rd.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.eHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r6.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.57806u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.fHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.8710di-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.dHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.1590ds-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 124.13.125.185[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r4.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.44804u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.results&zrdtd-390.zr4td-1548.zr6td-678.zd-1258.ze-390.zf-971.HTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.8150du-results-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
This is a Mac OSX system, using OS X 10.9.5, with Chrome 44.0.2403.125
What we see (Web Log)temora.rand.apnic.net 124.13.125.185[04/Aug/2015:00:01:29+0000]"GET/newadcfg/ad.py?A=2121&N&R&FHTTP/1.1"200799"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,likeGecko)Chrome/44.0.2403.125Safari/537.36"0.000u281fd425-s14386464891438646489.894cfg.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.rd.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.eHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278 [04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r6.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.57806u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.fHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.8710di-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.dHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.1590ds-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 124.13.125.185[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r4.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.44804u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.results&zrdtd-390.zr4td-1548.zr6td-678.zd-1258.ze-390.zf-971.HTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.8150du-results-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
This system can do IPv6, and prefers to use IPv6 in dual stack contexts
What we see (Web Log)temora.rand.apnic.net 124.13.125.185[04/Aug/2015:00:01:29+0000]"GET/newadcfg/ad.py?A=2121&N&R&FHTTP/1.1"200799"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,likeGecko)Chrome/44.0.2403.125Safari/537.36"0.000u281fd425-s14386464891438646489.894cfg.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.rd.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.eHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r6.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.57806u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.f HTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.8710di-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.dHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.1590ds-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 124.13.125.185[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r4.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.44804u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.results&zrdtd-390.zr4td-1548.zr6td-678.zd-1258.ze-390.zf-971.HTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.8150du-results-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
This experiment ran through to conmpletion
What we see (Web Log)temora.rand.apnic.net 124.13.125.185 [04/Aug/2015:00:01:29+0000]"GET/newadcfg/ad.py?A=2121&N&R&FHTTP/1.1"200799"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,likeGecko)Chrome/44.0.2403.125Safari/537.36"0.000u281fd425-s14386464891438646489.894cfg.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278 [04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.rd.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.eHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.2900du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r6.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.57806u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:30+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.f HTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646490.8710di-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.dHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.1590ds-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 124.13.125.185[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.r4.tdHTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.44804u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
temora.rand.apnic.net 2001:e68:5431:519e:f002:854e:2741:278[04/Aug/2015:00:01:31+0000]"GET/1x1.png?u281fd425-s1438646489-i5097.ap.results&zrdtd-390.zr4td-1548.zr6td-678.zd-1258.ze-390.zf-971.HTTP/1.1"20068"https://tpc.googlesyndication.com/sadbundle/7103675352697911246/basic/index.html""Mozilla/5.0(Macintosh;IntelMacOSX10_9_5)AppleWebKit/537.36(KHTML,like Gecko)Chrome/44.0.2403.125Safari/537.36"0.000https 1438646491.8150du-results-u281fd425-s1438646489-i5097.ap.dotnxdomain.net
This user is a customer of TMNET in Malaysia, AS4788
IPv6 Deployment
Google’s view:
Why are they different?
As far as I am aware, Google do not perform per-country weighting, and it is likely that they are over-sampling the US and Western Europe and also likely that they are under-sampling in China, Africa and South America
IPv6 Deployment in the US
IPv6 Deployment in Comcast
Measuring Platforms –July 2015
Win$72%$
Andriod$16%$
iOS$6%$
Mac$4%$
Linux$1%$
Windows$Phone$1%$
Chrome$0%$
Firefox$0%$
Other$0%$
OS#Share#
Measuring Platforms –January 2016
Win37%
Android33%
iOS27%
Mac2%
Linux1%
Winows Phone0%
ChromeOS0%
Other0%
OSSHARE- JANUARY2016
Windows37%
Android33%
iOS27%
Measuring Browsers –July 2015
Chrome'68%'
Firefox'12%'
Safari'8%'
Explorer'6%'
Mobile_Safari'4%'
Opera'2%'
Other'0%'
Mozilla'0%'
Netscape'0%'
Browsers'
Measuring Browsers –January 2016
Chrome52%
Safari38%
Firefox6%
MSIE3%
Opera1%
Silk0%
Chromium0%
Other0%
BrowserShare
2. Measuring DNS Behaviours
Measuring DNSSEC
Clientisgiven4 uniqueURLstoload:• DNSSEC-validlysignedDNSname• DNSSEC-invalidlysignedDNSname• UnsignedDNSname(control)• ResultreportingURL(10secondtimer)AllDNSisIPv4
What We See (DNS Log)1438646489.920[ap]04-Aug-201500:01:29.920202.188.0.254#141180du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net.INAAAA-ED()01571438646489.920[ap]04-Aug-201500:01:29.920202.188.0.254#291104u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net.INA-ED()01451438646489.921[ap]04-Aug-201500:01:29.921202.188.0.254#404610du-u281fd425-s1438646489-i5097.ap.dotnxdomain.net.INA-ED()01451438646489.922[ap]04-Aug-201500:01:29.922202.188.0.254#4875506u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net.INAAAA-ED()01571438646489.923[ap]04-Aug-201500:01:29.923202.188.0.254#1223006u-u281fd425-s1438646489-i5097.ap.dotnxdomain.net.INA-ED()0203
1453248859.615[ap]20-Jan-201600:14:19.615117.102.103.194#582700ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INA- ()01341453248860.616[ap]20-Jan-201600:14:20.616202.155.0.150#554300ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INA-ED()04051453248860.708[ap]20-Jan-201600:14:20.708202.155.0.150#389140ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INDS-ED()03931453248860.798[ap]20-Jan-201600:14:20.798202.155.135.9#276980ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INDS-EDC()03931453248860.887[ap]20-Jan-201600:14:20.887202.155.135.9#53440ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INA-EDC()04051453248860.978[ap]20-Jan-201600:14:20.978202.155.0.150#114340ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INDNSKEY-ED()05371453248861.067[ap]20-Jan-201600:14:21.067202.155.135.9#437050ds-ucae20ea3-s1453248859-i5121.ap.dotnxdomain.net.INDNSKEY-EDC()0537
DNSSEC Validation “signature”
DNSSEC Validation
DNSSEC Validation in Sweden
DNSSEC Validation in US
What Else?
• The“market”forDNSresolution:howmanyuserssendtheirqueriesthroughGoogle’sPublicDNSservers?
• Howmanyusersuseresolverslocatedinaforeigncountry?
• Whichcountries?
Foreign (CC) Resolution: Top Resolvers by AS
Rank AS Use AS Name
1 15169 42.69% GOOGLE - Google Inc.,US2 3356 7.47% LEVEL3 - Level 3 Communications, Inc.,US3 36692 7.05% OPENDNS - OpenDNS, LLC,US4 19994 2.56% RACKSPACE - Rackspace Hosting,US5 174 1.87% COGENT-174 - Cogent Communications,US
6 16880 1.70% AS2-TRENDMICRO-COM - TREND MICRO INCORPORATED,US7 2914 1.09% NTT-COMMUNICATIONS-2914 - NTT America, Inc.,US8 4134 0.91% CHINANET-BACKBONE No.31,Jin-rong Street,CN9 29791 0.70% VOXEL-DOT-NET - Voxel Dot Net, Inc.,US
10 3462 0.67% HINET Data Communication Business Group,TW
11 9121 0.64% TTNET Turk Telekomunikasyon Anonim Sirketi,TR12 3303 0.64% SWISSCOM Swisscom (Switzerland) Ltd,CH13 6939 0.63% HURRICANE - Hurricane Electric, Inc.,US14 6147 0.50% Telefonica del Peru S.A.A.,PE15 6713 0.48% IAM-AS,MA
16 8048 0.47% CANTV Servicios, Venezuela,VE17 3257 0.47% TINET-BACKBONE Tinet SpA,DE18 13238 0.43% YANDEX Yandex LLC,RU19 45595 0.41% PKTELECOM-AS-PK Pakistan Telecom Company Limited,PK20 9299 0.40% IPG-AS-AP Philippine Long Distance Telephone Company,PH
21 7643 0.39% VNPT-AS-VN Vietnam Posts and Telecommunications (VNPT),VN22 45758 0.39% TRIPLETNET-AS-AP TripleT Internet Internet service provider Bangkok,TH23 8151 0.38% Uninet S.A. de C.V.,MX24 7470 0.35% TRUEINTERNET-AS-AP TRUE INTERNET Co.,Ltd.,TH25 4837 0.35% CHINA169-BACKBONE CNCGROUP China169 Backbone,CN
Total: 21,770,772 (28% of total) end user query sets
Offshore DNS from HK Users
Offshore DNS from HK Users
Market Penetration of Google’s Public DNS
3. Digital Stalking
7
StreetArt:Banksy Geoff Huston, APNIC
Some Stalker Numbers
Inthefirst248daysof2014wesaw:– 123,110,633uniqueend-userIPaddressespresentedtoourserversfromthesetestscripts
– 317,309oftheseend-userIPaddressespresentedHTTPGETstringstousthatweresubsequentlypresentedtousfromadifferentclientIPaddress!
That’ssome1in400*usersthatseemtohaveattractedsomekindofdigitalstalker!
*Ormaybeabitmore,duetoNATshidingmultipleendusersbehindasinglepublicIPaddress
Online Privacy? Really?
It’shardtobelievethattoday’sInternetrespectspersonalprivacywhenitseemsthataround1in400usershaveattractedsomekindofdigitalstalkerthattrackstheURLstheyvisit.
Stalking Rates by CountryCC Samples Stalked Rate/1,000,000 CountryIR 674 111 164,688 Iran (Islamic Republic of)LA 28,506 2,875 100,855 Lao People's Democratic RepublicMO 38,761 2,954 76,210 Macao Special Administrative Region of ChinaSG 240,188 17,406 72,468 Singapore HK 486,101 22,136 45,537 Hong Kong Special Administrative Region of ChinaCN 10,419,638 435,040 41,751 China GB 872,124 28,845 33,074 United Kingdom of Great Britain and Northern IrelandTW 1,769,367 36,823 20,811 Taiwan JP 1,500,779 23,971 15,972 Japan AU 293,193 4,620 15,757 Australia US 4,491,711 53,370 11,881 United States of AmericaMY 1,035,434 10,214 9,864 Malaysia AL 437,399 4,043 9,243 Albania CA 947,922 6,244 6,587 Canada KH 143,886 897 6,234 Cambodia MM 16,411 97 5,910 Myanmar MK 458,820 2,214 4,825 The former Yugoslav Republic of MacedoniaBZ 8,139 35 4,300 Belize MN 57,622 233 4,043 MongoliaNZ 344,951 1,385 4,015 New ZealandCV 3,742 14 3,741 Cape VerdeME 223,005 775 3,475 MontenegroFJ 14,892 47 3,156 Fiji SR 44,116 136 3,082 Suriname AW 11,123 34 3,056 Aruba
Stalking Delay
The 15, 30 and 60 minute local peaks are likely to be local web proxy refresh cycles
This local peak matches a result timer in the test script
Top 25 International Stalkers
Rank IP Net # AVG Delay AS Description
1 119.147.146.0 205,033 130.7 4134 CHINANET-BACKBONE No.31,Jin-rong Street,CN
2 101.226.33.0 6,198 1,576.1 4812 CHINANET-SH-AP China Telecom (Group),CN
3 180.153.206.0 6,120 1,608.3 4812 CHINANET-SH-AP China Telecom (Group),CN
4 180.153.214.0 3,827 1,561.0 4812 CHINANET-SH-AP China Telecom (Group),CN
5 112.64.235.0 3,819 1,544.9 17621 CNCGROUP-SH China Unicom Shanghai network,CN
6 101.226.66.0 3,603 1,577.3 4812 CHINANET-SH-AP China Telecom (Group),CN
7 180.153.163.0 2,742 1,540.1 4812 CHINANET-SH-AP China Telecom (Group),CN
8 223.27.200.0 2,740 1.8 45796 BBCONNECT-TH-AS-AP BB Connect Co., Ltd.,TH
9 101.226.89.0 2,658 2,230.2 4812 CHINANET-SH-AP China Telecom (Group),CN
10 180.153.201.0 2,628 1,549.4 4812 CHINANET-SH-AP China Telecom (Group),CN
11 101.226.65.0 1,528 1,573.3 4812 CHINANET-SH-AP China Telecom (Group),CN
12 69.41.14.0 1,243 1,127.4 47018 CE-BGPAC - Covenant Eyes, Inc.,US
13 101.226.51.0 1,195 1,627.6 4812 CHINANET-SH-AP China Telecom (Group),CN
14 112.65.193.0 1,038 1,623.9 17621 CNCGROUP-SH China Unicom Shanghai network,CN
15 64.124.98.0 906 1,288.9 6461 ABOVENET - Abovenet Communications, Inc,US
16 180.153.114.0 819 1,632.6 4812 CHINANET-SH-AP China Telecom (Group),CN
17 180.153.205.0 765 1,497.7 4812 CHINANET-SH-AP China Telecom (Group),CN
18 208.184.77.0 649 1,419.5 6461 ABOVENET - Abovenet Communications, Inc,US
19 222.73.77.0 535 1,373.8 4812 CHINANET-SH-AP China Telecom (Group),CN
20 180.153.211.0 517 1,450.6 4812 CHINANET-SH-AP China Telecom (Group),CN
21 180.153.161.0 504 1,675.7 4812 CHINANET-SH-AP China Telecom (Group),CN
22 183.60.153.0 262 451.3 4134 CHINANET-BACKBONE No.31,Jin-rong Street,CN
23 222.73.76.0 255 1,512.7 4812 CHINANET-SH-AP China Telecom (Group),CN
24 101.226.102.0 235 2,012.7 4812 CHINANET-SH-AP China Telecom (Group),CN
25 208.80.194.0 227 10,731.5 13448 WEBSENSE - Websense, Inc,US
The Leakiest Browser!
Wow! “Public Security Equipment 110 No 0000000025!”
4. Access ISP Market Share
http://stats.labs.apnic.net/aspop
Market Share in HK
What Else?
AnalysisoffailurepatternstodetectevidenceofstructuredinterceptionofDNSandWebretrieval
Content Blocking in Iran?
0
2
4
6
8
10
12
14
16
18
20
22
24
26
28
30
32
34
36
38
40
42
44
46
48
50
52
54
56
58
60
62
64
66
68
70
72
74
76
78
80
82
84
86
88
90
92
94
96
98
100
academyaccountantsactoragencyairforcearmyassociatesattorneyauctionaudiobandbarbargainsbeerbestbid bikebio blackblackfridayblueboutiquebrusselsbuildbuildersbusinessbuzzbzhcabcameracampcapetowncapitalcardscarecareercareerscasacashcateringcenterceocheapchristmaschurchcityclaimscleaningclickclinicclothingcoachcodescoffeecolognecommunitycompanycomputercondosconstructioncontractorscookingcoolcountrycreditcreditcardcricketcruisescymrudancedatingdealsdegreedeliverydemocratdentaldentistdesidiamondsdietdigitaldirectdirectorydiscountdomainsdurbaneducationemailenergyengineerengineeringenterprisesequipmentestateeventsexchangeexpertexposedfailfarmfashionfinancefinancialfishfishingfitnessflightsfloristflowersforsalefoundationfrl fundfurniturefutbolgallerygardengentgiftgiftsgivesglassgraphicsgratisgripeguideguitarsguruhaushealthcarehelphiphopholdingsholidayhorsehosthostinghousehowil immoimmobilienindustriesink instituteinsureinternationalinvestmentsjetztjoburgjuegoskaufenkim kitchenkiwikoelnlandlawyerleaselgbtlife lightinglimitedlimolinkloanslondonmaisonmanagementmarketmarketingmediamemorialmenumobimodamoemoneymortgagemoscownagoyanamenavynetworkngoninjaokinawaongoooosakaparispartnerspartspartyphotophotographyphotospicspicturespinkpizzaplaceplumbingpokerpressproductionspropertiespropertypubqponquebecrecipesredrehabreisenrentalsrepairreportrepublicanrestrestaurantreviewsrip rocksrodeoryukyusaarlandsarlschulescienceservicessexyshikshashoessinglessocialsoftwaresolarsolutionssoyspacesuppliessupplysupportsurfsurgerysx systemstatartattootax technologytel tiendatipstirestiroltodaytokyotoolstowntoystradetraininguniversityunovacationsventuresvetviajesvillasvisionvlaanderenvodkavotingvoyagewaleswangwatchwebcamwebsiteweddingwhoswhowienwikiworkworksworldwtfxn--6qq986b3xlxn--80adxhksxn--80asehdbxn--80aswgxn--c1avgxn--i1b6b1a6a2exn--mgbab2bdxn--ngbc5azdxn--nqv7fxn--q9jyb4cxyzyogayokohamazone
%
Iran (Islamic Republic of) (IR) - 11025 Measurements
Web WebX NoWeb NoDNS LateWeb
.il appears to use DNSResponse blocking
.sexy appears to use WebResponse blocking
Hong Kong
0
2
4
6
8
10
12
14
16
18
20
22
24
26
28
30
32
34
36
38
40
42
44
46
48
50
52
54
56
58
60
62
64
66
68
70
72
74
76
78
80
82
84
86
88
90
92
94
96
98
100
academy
accountantsactoragencyairforcearm
yassociatesattorneyauctionaudiobandbarbargainsbeerbestbidbikebioblackblackfridayblueboutiquebrusselsbuildbuildersbusinessbuzzbzhcabcam
eracam
pcapetow
ncapitalcardscarecareercareerscasacashcateringcenterceocheapchristm
aschurchcityclaim
scleaningclickclinicclothingcoachcodescoffeecolognecom
munity
company
computer
condosconstructioncontractorscookingcoolcountrycreditcreditcardcricketcruisescym
rudancedatingdealsdegreedeliverydem
ocratdentaldentistdesidiam
ondsdietdigitaldirectdirectorydiscountdom
ainsdurbaneducationem
ailenergyengineerengineeringenterprisesequipm
entestateeventsexchangeexpertexposedfailfarmfashionfinancefinancialfishfishingfitnessflightsfloristflow
ersforsalefoundationfrl fundfurniturefutbolgallerygardengentgiftgiftsgivesglassgraphicsgratisgripeguideguitarsguruhaushealthcarehelphiphopholdingsholidayhorsehosthostinghousehowil im
mo
imm
obilienindustriesinkinstituteinsureinternationalinvestm
entsjetztjoburgjuegoskaufenkimkitchenkiw
ikoelnlandlaw
yerleaselgbtlifelightinglim
itedlim
olinkloanslondonm
aisonm
anagement
market
marketing
media
mem
orialm
enum
obim
odam
oem
oneym
ortgagem
oscownagoyanam
enavynetw
orkngoninjaokinaw
aongoooosakaparispartnerspartspartyphotophotographyphotospicspicturespinkpizzaplaceplum
bingpokerpressproductionspropertiespropertypubqponquebecrecipesredrehabreisenrentalsrepairreportrepublicanrestrestaurantreview
srip rocksrodeoryukyusaarlandsarlschulescienceservicessexyshikshashoessinglessocialsoftw
aresolarsolutionssoyspacesuppliessupplysupportsurfsurgerysx system
statartattootaxtechnologyteltiendatipstirestiroltodaytokyotoolstow
ntoystradetraininguniversityunovacationsventuresvetviajesvillasvisionvlaanderenvodkavotingvoyagew
alesw
angw
atchw
ebcamw
ebsitew
eddingw
hoswho
wien
wiki
work
works
world
wtf
xn--6qq986b3xlxn--80adxhksxn--80asehdbxn--80asw
gxn--c1avgxn--i1b6b1a6a2exn--m
gbab2bdxn--ngbc5azdxn--nqv7fxn--q9jyb4cxyzyogayokoham
azone
%
Hong Kong Special Administrative Region of China (HK) - 248750 Measurements
Web WebX NoWeb NoDNS LateWeb
That looks like a high (3%) DNS loss rate – why?
Top Related