<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"\@MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:16.0pt">Yashuiro, <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt">Thanks for the reply. This makes sense it would be overwhelming DNS on a CPE. My other concern would be around stateful firewalls, which would need to handle multiple short-lived TCP sessions both in session
per second creation and the overall amount, depending on if the TCP sessions close gracefully etc. It seems that Chrome is leveraging 1 TCP session per DNS query to prevent tracking of the DNS traffic, which unfortunately does not take advantage of TCP
pipelining/multiplexing or out-of-order TCP DNS responses over a single TCP stream.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"><br>
Thanks, <br>
<br>
</span><span style="font-size:14.0pt">Adam Casella | Solutions Architect<br>
Infoblox | infoblox.com<br>
914.953.8571</span><span style="font-size:16.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:16.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in">
<b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Yasuhiro Orange Morishita /
</span><span style="font-size:12.0pt;font-family:"MS Gothic";color:black">$B?92<BY9((B</span><span style="font-size:12.0pt;color:black"> <yasuhiro@jprs.co.jp><br>
<b>Date: </b>Wednesday, March 15, 2023 at 5:19 AM<br>
<b>To: </b>Adam Casella <acasella@infoblox.com><br>
<b>Cc: </b>dns-operations@lists.dns-oarc.net <dns-operations@lists.dns-oarc.net><br>
<b>Subject: </b>Re: Increase in DNS over TCP from Chrome Browser on Windows 11<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">!-------------------------------------------------------------------|<br>
This Message Is From an External Sender<br>
This message came from outside your organization.<br>
|-------------------------------------------------------------------!<br>
<br>
Hi,<br>
<br>
> Has anyone else seen an increase in DNS over TCP traffic in their<br>
> environment? We have been seeing a steady increase since late last<br>
> year and have believe we have narrowed down a major cause. After<br>
> reaching out to the Chromium folks and Cricket Liu reaching out to<br>
> the Microsoft folks it seems that there has been a recent behavior<br>
> change that is incompatible with each other, which is causing DNS<br>
> over TCP to be preferred over UDP.<br>
<br>
A few days ago, I saw an issue report from a router vendor that may be<br>
caused by it. It appears that some CPEs are unable to handle large<br>
amounts of TCP DNS traffic.<br>
<br>
Original page, in Japanese:<br>
<a href="https://urldefense.com/v3/__https:/www.aterm.jp/support/tech/2023/0224.html__;!!JYsgTRAg6ZQ!K8-4av385RV-2l85eIsNwjr5yvUWVuaAg8xs9Nmw071C2Ch7xjljl4lH-QNEyDf64CNYPnaD-BsGcAjaw2gO$">https://urldefense.com/v3/__https://www.aterm.jp/support/tech/2023/0224.html__;!!JYsgTRAg6ZQ!K8-4av385RV-2l85eIsNwjr5yvUWVuaAg8xs9Nmw071C2Ch7xjljl4lH-QNEyDf64CNYPnaD-BsGcAjaw2gO$</a>
<br>
Google Translation:<br>
<a href="https://urldefense.com/v3/__https:/www-aterm-jp.translate.goog/support/tech/2023/0224.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ja&_x_tr_pto=wapp__;!!JYsgTRAg6ZQ!K8-4av385RV-2l85eIsNwjr5yvUWVuaAg8xs9Nmw071C2Ch7xjljl4lH-QNEyDf64CNYPnaD-BsGcOV_YwC3$">https://urldefense.com/v3/__https://www-aterm-jp.translate.goog/support/tech/2023/0224.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ja&_x_tr_pto=wapp__;!!JYsgTRAg6ZQ!K8-4av385RV-2l85eIsNwjr5yvUWVuaAg8xs9Nmw071C2Ch7xjljl4lH-QNEyDf64CNYPnaD-BsGcOV_YwC3$</a>
<br>
<br>
> Cricket Liu reach out to the Microsoft folks and found that starting<br>
> with Windows 11, the OS began to use socket caching due to<br>
> exhaustion occurring with UDP ports. Meaning that DNS UDP port is<br>
> cached when communicating with the same server and any DNS client<br>
> will continue to get the same UDP src-port when connecting to that<br>
> DNS server.<br>
<br>
IMHO, this Windows 11 behavior seems to contain security risks...<br>
<br>
-- Yasuhiro 'Orange' Morishita <yasuhiro@jprs.co.jp><br>
<br>
From: Adam Casella <acasella@infoblox.com><br>
Subject: Increase in DNS over TCP from Chrome Browser on Windows 11<br>
Date: Tue, 14 Mar 2023 03:57:03 +0000<br>
<br>
> Hey Folks,<br>
> <br>
> Has anyone else seen an increase in DNS over TCP traffic in their environment? We have been seeing a steady increase since late last year and have believe we have narrowed down a major cause. After reaching out to the Chromium folks and Cricket Liu reaching
out to the Microsoft folks it seems that there has been a recent behavior change that is incompatible with each other, which is causing DNS over TCP to be preferred over UDP.<br>
> <br>
> Based on my discussion with the Chromium team, It appears that for about 3 years Chrome has a bit of internal logic around falling back to TCP when there is a detection of reduced UDP port entropy being handed out by the OS. When the Chrome stack falls
back to TCP, according to the Chromium folks, it will continue to use TCP until Chrome is restarted or there is a network change (port flap, IP address change, etc). The code that tracks the low entropy can be found here net::DnsUdpTracker.<br>
> <br>
> The Chromium folks confirmed that they are seeing an increase of TCP traffic from Windows client only. Crickey Liu reach out to the Microsoft folks and dfound that starting with Windows 11, the OS began to use socket caching due to exhaustion occurring
with UDP ports. Meaning that DNS UDP port is cached when communicating with the same server and any DNS client will continue to get the same UDP src-port when connecting to that DNS server. Now starting in Chrome 105, there was a change made by the Chromium
folks to leverage the internat Chrome DNS stack to to run more Windows DNS queries through the Chrome stack instead of delegating the resolutions to the OS. Due to the low UDP port entropy logic discussed above in combination to the socket caching introduced
Windows 11, we are seeing DNS clients preferring TCP over UDP for what seemed like to discernable reason until these discussions with the Chromium and Microsoft folks.<br>
> <br>
>>From our perspective this is and will cause a lot of issues for DNS providers as more and more Chrome + Windows clients begin to prefer TCP over UDP for DNS. And believe this has the potential to quickly become a rather large issue for DNS providers, especially
at scale.<br>
> <br>
> Is anyone here seeing a seemingly unexplained increase in DNS over TCP traffic and if it is causing any issues within their network?<br>
> <br>
> For reference, Google Chrome version 105 was released on August 30th, 2022 and Windows 11 was released on October 5th, 2021. Only with the combination of the two (post August 30th, 2022) would the issue be seen.<br>
> <br>
> Thanks,<br>
> <br>
> Adam Casella | Solutions Architect<br>
> Infoblox | infoblox.com<br>
> 914.953.8571<o:p></o:p></p>
</div>
</div>
</body>
</html>