Hello everyone,This is my first post on the SIDN Labs’ blog. I've joined the team recently as a Data Scientist, and my role, together with the rest of the team, is to work on big data analytics on the traffic of the .nl top-level domain (TLD) servers, in order to improve security and stability of the .nl TLD.Enough of introductions, let's move to the topic of this post: IPv6 traffic on our name servers.
DNS resolution process: the basics
Whenever a user types on his/her browser a .nl website (e.g., www.example.nl), his/her computer must first figure out the IP address of the machine that hosts the website. This name resolution process is done in a hierarchical way, so the user's computer sends a DNS request to typically a DNS server provided by the respective ISP, known as DNS resolver. These, in turn, then have to ask for the IP addresses of the .nl name servers (those the maintain the list of all .nl domains). Once they find it, they finally ask this server for the IP addresses of example.nl, and respond back to the user's computer. To avoid redundant queries, DNS resolvers, at your ISP, maintain a local cache of domain names it has already resolved recently. Therefore, at SIDN, we do not get queries for every single .nl query on the Internet. Instead, we receive part of all .nl DNS requests that people or computer programs issue on the Internet. This is important because it interferes on how we measure IPv6 usage.
OK, so what do we see at SIDN's .nl servers?
What we measure: we monitor the traffic of one of the four unicast .nl name servers (there are also other anycast servers), which corresponds roughly to 10% of all the traffic to .nl. We have been doing this since May 2014 and have stored it in the ENTRADA platform, a Hadoop-based platform that we use to develop new services and applications that further increase the security and stability of .nl and the Internet. ENTRADA comes with a privacy framework, which we published last year. We also use ENTRADA to produce other statistics about the traffic it stores (see SIDN Labs stats page).IPv4 vs IPv6 resolvers: Figure 1 shows the number of daily unique IP addresses querying one of the .nl servers, for both IPv4 and IPv6. We can learn a few things from it:
IPv6 addresses amount to 6.5% of all unique daily IPs (~ 750K/daily IPv4, ~52K/daily IPv6).
The number of IPv6 unique IPs is growing faster than IPv4 ones – from 40K daily average in 2014 to 60K average May/June – a 50% growth. IPv4 daily addresses, on the other hand, has been stable over the same period.
Both have diurnal and weekly patterns – i.e., higher traffic on weekdays and working hours, which is also expected.
Figure 1: Time series of unique daily IP Addresses (May 2014 – June 2015) – log scale.
Our results contrast to the results observed in 2011/2013 for .com and .net top-level-domains, in which the number of unique of IPv4 and IPv6 addresses observed has been stable (3.5 million vs. 68K). It would be interesting to compare for the same time frame. It's important to remember that some resolvers may be dual-stacked, i.e., have both IPv6 and IPv4 enabled, so the actual number of resolvers may be slightly smaller.It's interesting to note that, by 2015, IPv6 addresses to the .nl server amount to 78% of IPv6 observed for .com and .net combined. By comparing the size of the zone files of both (.nl has ~ 5.5M domains registered, while .com and .net combined have 133.4M domains combined), we see how IPv6 is proportionally more adopted in the .nl than in .com and .net. Other measurements of IPv6 adoption: Due to the effects of caching, the number IPv6 queries cannot be used to directly measure IPv6 adoption by end users, but rather an indication of support of IPv6 by ISPs and companies, since these are the ones that typically run DNS resolvers. Some websites, such as Google IPv6 adoption, show that 6% of their users access Google via IPv6, and that has been a growth of 79% in the ratio of IPv6 users between May 1st 2014 and June 8th 2015.Compared to our .nl name server, we saw 6.5% of all the IPs querying are IPv6, and a growth in the same period of 50% in the number of IPv6 addresses. Since the nature of these measurements is very different, it is hard to draw conclusions from that, other than that the growth of IPv6 resolvers that request .nl has been smaller than the number of IPv6 Google users. (Other websites, such as Cisco's 6lab and APNIC's IPv6 show figures from their own measurements.)
Volume of DNS queries
OK, so IPv6 resolvers for the monitoring period corresponded ~6.5% of all IPs observed, but what about the volume of queries for each version of the IP protocol? To reduce the effect of diurnal/weekly patterns, we reduced the number of data points by averaging the daily averages per month, i.e., producing a single number of daily queries for each month. This can be seen in Figure 2. We can learn that:?
IPv6 traffic is becoming significant on the .nl server: we observe that 16.6% of all queries are now sent by IPv6 addresses. Those queries, in turn, are sent by only 6.5% of all IP addresses observed, which suggest that IPv6 resolvers, on average, send more queries that IPv4 ones.
The IPv6 growth in number of queries has been around 40% (comparing the first and last month averages) over a period of a bit more than a year, while IPv4 has been effectively zero growth.
We can further down explore why IPv6-enabled resolvers are likely to issue more queries – but one hypothesis is that they are the “big resolvers”, i.e., resolvers serving many thousands of costumers are more likely to have IPv6 enabled in comparison with small resolvers. The results here presented can be compared against backbone traffic. We can see that Amsterdam Internet Exchange (AMS-IX), the second-largest IX in the world, has less than 1% of IP traffic is IPv6 . We, on the other hand, observe 16% of the DNS queries being IPv6 (measure in number of queries ; not bytes)
Figure 2: Time Series of Daily Queries (average over per month)
Summary
We have employed our ENTRADA platform to analyze 13 months of DNS traffic between May 01, 2015 and June 6th, 2015.
We saw that the number of IPv6-enabled resolvers and the volume of IPv6 queries has grown by 50% and 40%, respectively, while the number of IPv4-only resolvers has been stable for both version of the IP protocol, a very different picture that was has been observed on .com and .net in 2011/2013. However, even though not directly comparable, our measurements show a similar increase in the number of IPv6 users as Google.
In total, IPv6 queries amounts to 16.6% of all DNS queries we observed. That is a much larger figure than general backbone traffic, as in the AMS-IX, in which less than 1% of the traffic is IPv6 for all applications combined.
We will be producing more statistics and observing how the IPv6 usage evolves over time. In the mean time, we recommend visiting internet.nl (supported by SIDN), a website in which you can check the IPv6 reachability of websites and mail servers.
Acknowledgments:
Thanks Maarten Wullink, Moritz Müller, Marco Davids, and Cristian Hesselman for reviewing this post
