Dissecting DNS Stakeholders in Mobile Networks

Abstract

When using mobile apps, users ignite a complex set of network operations. Among all protocols and elements behind the scenes, Domain Name System (DNS) is an almost omnipresent component. Despite being one of the oldest Internet system, DNS still operates with semi-obscure interactions among its stakeholders, i.e., domain owners, network operators, and apps/operating system (OS) developers. The goal of this work is to understand the dynamics of DNS in mobile traffic, and quantify the role of each of its stakeholders. To do so, we use two different but complementary anonymized datasets: traffic logs provided by an European mobile operator with about 19M customers, and a second one containing traffic logs from 5,000 Lumen users, an Android traffic monitoring app. Our analysis show that 10k domains (out of 198M) are responsible for 87% of total network flows. We complement our traffic analysis with active measurements which reveal that i) TTL values for such domains are mostly short (< 1 min) despite IPs mapping changes occurring at a lower pace, and ii) DNS lookup time cost, about 10% of page load time (PLT), can potentially be reduced with optimisations, but those are rarely used in the wild.