Autonomous systems interconnection graph at the level of basic application services
Show objects with the number of links:
Description
The presented graph reflects the interconnections of autonomous systems at the level of basic application services: web sites, DNS servers, mail servers. The domain name (more strictly, the DNS zone) is the attribute used when constructing cross-sections. The nodes of the graph are autonomous systems that contain the IP addresses of nodes that provide services of the same class. Node colors correspond to class of service (NS, A, MX). The edges of the graph denote the relationship of services of different types, which are linked by a domain name. For example, if the authoritative name servers (NS) of the test.ru zone are located in the autonomous system NN, and the website addressed to test.ru is located in the autonomous system MM, then this situation on the graph corresponds to an edge with the NS-A type that connects nodes NN (NS) and MM (A). That is, the DNS servers serving the test.ru zone are located in AS NN, while the A record contains the IP address belonging to the AS MM block. Relationships between NS and MX records are defined similarly. Thus, the graph displays not routing, but logical connections of the application level between autonomous systems.
Methodology
Initial data is collected for Russian national domain zones: .RU, .SU, .РФ. Only second-level domain zones (like name.tld) are analyzed: for each delegated zone, a list of name servers is determined, which are polled for A-, AAAA-records (server IP-addresses) and MX-records. For the names of mail servers received in responses to the MX query, IP addresses are determined using DNS polling. In the same way, IP addresses corresponding to nameservers (NS) are determined. As a result of DNS analysis, a set of tuples is formed, consisting of the name of the domain zone (for example, test.ru) and a list of IP addresses corresponding to a particular service. An autonomous system is associated with each IP address, which announces the prefix to which the address belongs, and then the number of unique nodes with services in the AS is counted. Autonomous systems shown in the graph are filtered by the number of services - only the most populated ASs are displayed, containing over 1000 IP addresses corresponding to services.
Interpreting data
The graph shows how the main classes of Internet services on the Runet are distributed across autonomous systems. For example, a website is addressed with a DNS name located in a domain zone that uses a set of name servers. Name servers are often provided by a domain registrar, while the web server may be hosted by another provider. With this configuration, a specific website corresponds to an edge between the autonomous system of the registrar (NS) and the autonomous system of the hosting provider (A record), this edge will be of type NS-A, and can be interpreted as information about where the domain administrators who placed DNS services in a standalone registrar system, prefer to keep web hosting.