29.03.2016 Views

Hands-on DNSSEC with DNSViz

1LXLQe2

1LXLQe2

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

DNS Analysis Using <strong>DNSViz</strong><br />

(dnsviz graph command line)<br />

• Resp<strong>on</strong>ses analyzed (offline)<br />

• Resp<strong>on</strong>siveness<br />

• Query timeouts<br />

• Network errors<br />

• EDNS/fragmentati<strong>on</strong><br />

capabilities<br />

• C<strong>on</strong>sistency<br />

• Across servers<br />

• Between DNSKEY/RRSIG<br />

• Between DNSKEY/DS<br />

• Correctness<br />

• RRSIG<br />

• Expirati<strong>on</strong>/incepti<strong>on</strong> dates<br />

• Cryptographic signature<br />

• DS<br />

• Cryptographic hash<br />

• Negative resp<strong>on</strong>ses<br />

• NSEC proof correctness<br />

• SOA record correctness<br />

output.js<strong>on</strong><br />

Serialized <strong>on</strong>line<br />

analysis (JSON)<br />

$ dnsviz graph Analysis graph<br />

(jpg, png, html)<br />

Verisign Public<br />

32

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!