Mikkel R Jakobsen
email: mikkelrj@diku.dk

Yvonne Jansen

Sebastian Boring
email: sebastian.boring@diku.dk

Kasper Hornbaek

Should I Stay or Should I Go? Selecting Between Touch and Mid-air Gestures For Large-Display Interaction

Keywords: Large display, mid-air, touch, freehand gestures, user study

Users can interact with large displays in many ways, including touch and mid-air gestures. However, it remains unclear how these ways compare and when users choose one over the other. In a first experiment, we compare touch and mid-air gestures to identify their relative performance for target acquisition. In a second experiment, participants choose freely between touch and mid-air gestures and we artificially require movement to simulate situations where midair is considered beneficial. Results from the first experiment show mid-air to be overall slower than touch depending on the task; in the second experiment, participants mostly chose touch in particular for selecting small targets and they rarely switched between mid-air and touch. Results also show that when faced with an increasing cost of using touch in the form of movement, participants chose mid-air over touch; touch remains as fast as mid-air on average.

Introduction

Users can interact with large displays in many ways, including through touch when being close to the display and through mid-air gestures when standing at a distance. Both touch and mid-air gestures leverage our basic human ability to point with our hands at objects of interest. Each of them has been researched in isolation [START_REF] Nielsen | Measuring usability: preference vs. performance[END_REF][START_REF] Swaminathan | Interaction design for large displays[END_REF] and they have been researched in combination [START_REF] Marquardt | The continuous interaction space: interaction techniques unifying touch and gesture on and above a digital surface[END_REF][START_REF] Müller | MirrorTouch: Combining Touch and Mid-air Gestures for Public Displays[END_REF][START_REF] Vogel | Interactive public ambient displays: transitioning from implicit to explicit, public to personal, interaction with multiple users[END_REF], but they have rarely been compared (except for specific public display scenarios [START_REF] Kurdyukova | Bodily or Mobile Interaction?: Comparing Interaction Techniques for Personalized Public Displays[END_REF]). Touch and mid-air gestures seem appropriate for different tasks or situations. For working with detailed information up close with a large high-resolution display, touch requires direct interaction through physical contact, which may be faster and preferred over indirect input (e.g., using a mouse [START_REF] Sasangohar | Evaluation of Mouse and Touch Input for a Tabletop Display Using Fitts' Reciprocal Tapping Task[END_REF]). In contrast, users may want to view large displays from a distance to gain an overview. At a distance, mid-air gestures allow users to interact with targets anywhere on the display [START_REF] Vogel | Distant Freehand Pointing and Clicking on Very Large, High Resolution Displays[END_REF]. Both interaction styles may be combined to support large-display interaction, allowing users to transition between them. However, an important question remains to be answered: When do users choose one over the other? This paper aims at answering this question.

Users may have different reasons for choosing to interact through touch or mid-air. First, the relative performance of touch and mid-air may influence users' choice.

There are several reasons for expecting touch and mid-air to perform differently for common tasks (e.g., target acquisition): Display space and input space are unified in touch but decoupled in mid-air; touch gives tactile support, but incurs friction while dragging, in contrast to mid-air movement; mid-air gestures can be performed at a distance, but distance affects accuracy; touch is limited to display parts within arms' reach and extensive movement is required to interact with remote parts; and touch onset naturally delimits gestures, whereas mid-air gestures need an explicit delimiter (e.g., pinching). Empirical studies are needed to help understand these differences.

However, users choose to interact through touch or mid-air not only based on their relative performance. For instance, mid-air gestures might be used for a task because they require less effort, even though they might be slower or less accurate than touch. This choice may depend on the task or result out of convenience (e.g., in order to avoid repetitive locomotion). Investigating when users choose one over the other and how they switch between touch and mid-air gestures is important for understanding how and when they might be combined.

We present two experiments: (1) a controlled experiment that compares the relative performance of touch and mid-air gestures for different target acquisition tasks in which we vary target size, distance, and whether target locations are known; and [START_REF] Ball | Move to improve: promoting physical navigation to increase user performance with large displays[END_REF] an experiment in which users can freely choose between touch and mid-air gestures, but are required to step away from the display at different intervals (i.e., simulating conditions that benefit from mid-air input and impose a cost on using touch). The experiments present the first empirical data on users' choice between touch and midair, which may help better take advantage of both types of input for wall-displays.

Related Work

Touch and mid-air gestures are particularly interesting input modes for interacting with large displays: they allow free movement in front of the display, can be used without a dedicated input device, and can therefore be used straight away and by several users at a time. Other input options that allow freedom of movement have been researched, including gyroscopic mice, handheld devices (e.g., smart phones [START_REF] Boring | Touch Projector: Mobile Interaction Through Video[END_REF][START_REF] Mccallum | ARC-Pad: Absolute+Relative Cursor Positioning for Large Displays with a Mobile Touchscreen[END_REF]), and tangibles [START_REF] Jansen | Tangible remote controllers for wall-size displays[END_REF]. However, in this paper we mainly discuss direct touch and mid-air gestures that use free hand movement. Also, while many types of gestures have been researched (e.g., for moving objects or executing commands), we focus on selection.

In the following, based on a review of literature, we discuss factors that may influence the use of, and choice between, touch and mid-air gestures. We also review research about the combination of touch input and mid-air gestures.

Touch-based Interaction

Touch is familiar to many people and simplifies interaction on large displays (e.g., by allowing direct pointing to an object instead of moving a mouse pointer [START_REF] Swaminathan | Interaction design for large displays[END_REF]). Yet, it introduces new challenges: First, finger occlusion makes accurate pointing at small targets difficult; this has been addressed through novel interaction techniques [START_REF] Vogel | Shift: a technique for operating pen-based interfaces using touch[END_REF].

Second, touch requires users to be within reach of the point of interaction. When people want to interact with content further away on a large display, they must physically move there. Techniques such as Frisbee [START_REF] Khan | A Remote Control Interface for Large Displays[END_REF] and Drag-and-pop [START_REF] Baudisch | Drag-and-pop and drag-and-pick: Techniques for accessing remote screen content on touch-and pen-operated systems[END_REF] provide access to distant content with less movement. Nacenta et al. [START_REF] Nacenta | There and Back Again: Cross-Display Object Movement in Multi-Display Environments[END_REF] compared different techniques for reaching distant targets located on multiple displays. They found a control-display ratio of 1:1 to be preferable to amplified touch movements.

Third, content further away is not always visible when standing close to the display; close proximity makes it difficult to search the display. Although users can step back in order to get an overview, and have been found to do so [START_REF] Jakobsen | Up Close and Personal: Collaborative Work on a High-resolution Multitouch Wall Display[END_REF], additional effort is required to go back to the display in order to interact. Several researchers have explored distant touch interaction that allow for overview at a distance (e.g., Touch Projector [START_REF] Boring | Touch Projector: Mobile Interaction Through Video[END_REF] or ARCPad [START_REF] Mccallum | ARC-Pad: Absolute+Relative Cursor Positioning for Large Displays with a Mobile Touchscreen[END_REF]), but they require the use of a handheld device.

Mid-air Gestures

Mid-air gestures have the advantage that users can directly point to an object, similar to touch, except that users can do so from a distance [START_REF] Swaminathan | Interaction design for large displays[END_REF]. Most prominent are mid-air techniques using ray casting, which extend a finger or object with an imaginary line to determine the point of contact with the display. Early research used laser pointers to interact with distant content [START_REF] Nacenta | There and Back Again: Cross-Display Object Movement in Multi-Display Environments[END_REF]. Later work has investigated freehand pointing [START_REF] Vogel | Distant Freehand Pointing and Clicking on Very Large, High Resolution Displays[END_REF].

Research on mid-air interaction has addressed several challenges. First, for techniques that continuously track the user's hand, there is no differentiation between action (i.e., selecting an object) and movement (i.e., moving towards a target). Naturally, techniques that require a dedicated device can have buttons to perform selection operations. For freehand pointing, several gestures have been proposed to trigger a selection: the most often used is the pinch gesture where users pinch together index finger and thumb to trigger an action [START_REF] Markussen | Vulture: A Mid-air Wordgesture Keyboard[END_REF][START_REF] Pierce | Image Plane Interaction Techniques in 3D Immersive Environments[END_REF][START_REF] Wilson | Robust Computer Vision-based Detection of Pinching for One and Two-handed Gesture Input[END_REF]; other techniques such as AirTap [START_REF] Vogel | Distant Freehand Pointing and Clicking on Very Large, High Resolution Displays[END_REF], ThumbTrigger [START_REF] Vogel | Distant Freehand Pointing and Clicking on Very Large, High Resolution Displays[END_REF], or SideTrigger [START_REF] Banerjee | Pointable: An In-air Pointing Technique to Manipulate Out-of-reach Targets on Tabletops[END_REF] use different gestures. Techniques differ in how fingers used for ray casting (often the index finger) move during the selection gesture, which affects pointing.

Second, mid-air pointing generally suffers from low accuracy. A common cause is the natural hand tremor, which is particularly problematic for small targets at far distance [START_REF] Myers | Interacting at a Distance: Measuring the Performance of Laser Pointers and Other Devices[END_REF]. Vogel et al. compensate for these problems by switching between relative pointing and absolute pointing [START_REF] Vogel | Distant Freehand Pointing and Clicking on Very Large, High Resolution Displays[END_REF]. Nancel et al. used different regions on a mobile device for different control-display ratios [START_REF] Nancel | High-precision Pointing on Large Wall Displays Using Small Handheld Devices[END_REF]. Relative pointing techniques can thus improve pointing accuracy, but require recalibration or clutching.

Third, users become less accurate without visual feedback even with direct pointing through ray-casting [START_REF] Cockburn | Air pointing: Design and evaluation of spatial target acquisition with and without visual feedback[END_REF]. Users have to relate hand movements to on-screen cursor movement because the input space is separated from the output space [START_REF] Hinckley | Input Technologies and Techniques[END_REF].

Combination of Touch and Mid-air Gestures

Having both touch and mid-air input available at the same time is feasible and earlier work has emphasized that the techniques may be integrated (e.g., [START_REF] Marquardt | The continuous interaction space: interaction techniques unifying touch and gesture on and above a digital surface[END_REF]). Directly related to our work is the study of Schick et al. that compared a touch-and-point condition, in which participants could point at an object and hold their arm still for .25s to select it, to a touch-only condition [START_REF] Schick | Extending Touch: Towards Interaction with Large-scale Surfaces[END_REF]. Touch-and-point was faster and preferred, requiring less physical effort. However, the study involved moving rather large 300 × 300 pixel blocks (on a 25ppi display) and did not control for target distance. Vogel and Balakrishnan developed an ambient display that supported transitions from implicit interaction at a distance to explicit interaction through touch [START_REF] Vogel | Interactive public ambient displays: transitioning from implicit to explicit, public to personal, interaction with multiple users[END_REF]; others have explored such transitions [START_REF] Marquardt | Gradual engagement: facilitating information exchange between digital devices as a function of proximity[END_REF][START_REF] Müller | MirrorTouch: Combining Touch and Mid-air Gestures for Public Displays[END_REF]. Touch and mid-air interaction has also been unified for tabletop displays: the continuous interaction space allows moving from touch to gestures above the surface [START_REF] Marquardt | The continuous interaction space: interaction techniques unifying touch and gesture on and above a digital surface[END_REF]; Hilliges et al. supported picking up objects for mid-air manipulation [START_REF] Hilliges | Interactions in the air: adding further depth to interactive tabletops[END_REF]. Pointable, which augments touch with in-air pointing to allow bimanual interaction with distant content, was found to perform comparable to multi-touch [START_REF] Banerjee | Pointable: An In-air Pointing Technique to Manipulate Out-of-reach Targets on Tabletops[END_REF].

In sum, empirical comparisons of touch and mid-air gestures for wall-display interaction are rare. Several factors might affect how users would choose between the two modalities if both were available at the same time, but it is unclear how users choose; we have found no research on this. Thus, with this paper we aim to contribute empirical data to help understand when users choose between touch and mid-air gestures.

Experiment 1: Touch vs. Mid-Air

We first conducted an experiment comparing touch and mid-air for target acquisition tasks. The purpose was to obtain empirical data on user performance and satisfaction for touch and mid-air gestures that would allow us to hypothesize about when users would choose one or the other for different tasks. Our aim was not to conclude on the relative performance of touch and mid-air in general; the results do not necessarily generalize to other implementations. The experiment focused on interaction with wall-sized displays, on which mid-air gestures have been primarily used [START_REF] Markussen | Vulture: A Mid-air Wordgesture Keyboard[END_REF][START_REF] Nancel | Mid-air panand-zoom on wall-sized displays[END_REF].

Interfaces

Participants used two interfaces that implement pointing and selection using either touch or mid-air. With the Touch interface, a touch cursor appears when a participant's finger touches the surface, and the touch is registered as a selection. With the Mid-air interface, participants move a cursor on the display using ray casting similar to Vogel and Balakrishnan's technique [START_REF] Vogel | Distant Freehand Pointing and Clicking on Very Large, High Resolution Displays[END_REF]: the cursor is placed at the point where the ray cast from the tip of the user's index finger intersects the display plane. We chose ray casting because it is the "canonical pointing technique" (according to Bowman et al. [START_REF] Bowman | Questioning naturalism in 3D user interfaces[END_REF], p. 82) and it is straightforward to use. Participants make a selection using a SideTrigger gesture [START_REF] Banerjee | Pointable: An In-air Pointing Technique to Manipulate Out-of-reach Targets on Tabletops[END_REF]: while pointing, they move their thumb towards the middle finger, which is curled toward the palm (see Fig. 1-C). "Clicking" the middle finger provides kinesthetic feedback while minimizing involuntary movements of the index finger during selection [START_REF] Banerjee | Pointable: An In-air Pointing Technique to Manipulate Out-of-reach Targets on Tabletops[END_REF]. We considered using the other hand to make selections, but decided against it, since touch is also (in the present experiment) a single-handed technique. We used the €1-filter [START_REF] Casiez | 1 € Filter: A Simple Speed-based Low-pass Filter for Noisy Input in Interactive Systems[END_REF] to compensate for jitter in cursor movements.

Apparatus

We conducted the experiment on a wall-sized display (see Fig. 1) that consists of 12 HD projectors with a total of 7680 × 3240 pixels and a resolution of around 68 pixels per inch. Touch on the display is detected through camera-based tracking. Input from six cameras, each capturing 640 × 480 pixels at 30 frames per second (fps), are processed by Community Core Vision. A custom program written in Java multiplexes the tracked touch points. The overall touch resolution is around 17 pixels per inch. Participants were tracked using an OptiTrack motion capture system (.5 mm tracking error, 50 fps). Participants wore a baseball cap, a belt, and a glove with markers attached. This helped quantify head turning and body movement, and gave position and orientation of the hand and the position of the tips of the index finger and thumb.

Tasks

We used two types of target selection task: Varied and Fixed. Both consisted of consecutive selections of targets, typical for evaluations of input devices. Previous studies have typically chosen to either (1) vary the size and distance of targets [e.g., 21] or (2) keep the size and distance constant within a sequence (e.g., the reciprocal task [START_REF] Sasangohar | Evaluation of Mouse and Touch Input for a Tabletop Display Using Fitts' Reciprocal Tapping Task[END_REF]). We designed our tasks to manipulate participants' ability to anticipate target locations, which may influence the relative performance of Touch and Mid-air. While participants can anticipate the next target location in a reciprocal selection task, mixing combinations of size and distance in a sequence requires them to visually search for targets, and they cannot anticipate the direction in which to move for selecting the next target. As Touch requires close proximity to the display, visual search is harder due to the limited field of view. We further expect larger anticipation effects for Touch where larger body movements are required to reach distant targets. Using both types of task helps us investigate these differences. The two tasks are as follows:

• Varied. Participants select 13 targets shown (as a red circle) one at a time. When they successfully select a target, the next target appears at a random location, but at a given distance from the previous target. All combinations of size and distance occur once in the sequence. The first target is always 128 pixels in diameter and placed in the center of the display. • Fixed. Participants perform nine alternate selections of two targets of a fixed size, spaced a given distance apart. The current target is shown as a red circle, while the other target is represented as a gray circle. Upon successful selection of the current target, the other target turns red.

The selection of the first target marks the beginning of both tasks; only data from the following selections were used. We also wanted to understand how the distance and size of targets influence the relative performance of touch and mid-air and thus varied both (see Table 1). We varied target size from 32 pixels to 512 pixels (1.2cm to 18.8cm on the display): smaller targets were deemed impractical for both Touch (due to occlusion) and Midair (due to limits in pointing accuracy). The corresponding visual angle was between 1.3° and 21° when standing 50cm from the display. The visual angle of a target varies proportionally to viewing distance: A 128px target has the same visual angle at 50cm distance (~ comfortable touching distance) as a 512px target at 2m.

We varied target distance from 768 pixels to 6144 pixels, which is 10% to 80% of the display width, and 31° to 132° visual angle viewed from 50cm distance.

Participants were allowed to move around freely in both interface conditions. We considered restricting movement in the Mid-air condition, but since movement is required for Touch, we allowed movement so as to make the conditions more similar. However, participants started each task from a fixed position (Fig. 1-A). For Mid-air participants could thus move in order to point more accurately; moving changes the control-display ratio, which depends on both the viewing distance and viewing angle.

Participants

We recruited 19 volunteers (14 male), 19-36 years old (M = 26), to participate; all but two were right handed. Participants received an equivalent of €25 as compensation.

Experimental Design

The experiment used a within-subjects design with interface (Mid-air, Touch), task type (Varied, Fixed), target size (3 levels), and target distance (4 levels) as factors.

For each interface, participants performed a series of tasks for both task types. The

Dependent Variables and Data Collection

As dependent variables we measured accuracy, target selection time, subjective satisfaction, and preference. We also collected data on participants' physical movement in order to describe how participants performed the tasks using the two interfaces.

• Accuracy: We calculated the error rate as percentage of targets that were not selected on the first attempt; outside-target selections do not cause the next target to appear, only a correct selection does. • Target Selection Time: We split the elapsed time into a pointing phase (time spent approaching the target) and a selection phase (time spent touching or making a selection gesture on target). For Mid-air, we determined when the cursor had first entered the target; as a proxy for the cursor in the Touch condition, we orthogonally projected participants' index finger onto the display plane. • Subjective Satisfaction: We used 12 questions from the ISO 9241-9 device assessment questionnaire [START_REF] Douglas | Testing Pointing Device Performance and User Assessment with the ISO 9241[END_REF] including questions on fatigue. We changed the anchors of questions from "too low" / "too high" to "appropriate" / "inappropriate" as we believe that the original anchors were confusing (i.e., what is too low fatigue?). • Physical movement: We quantified participants' locomotion (from belt position), head turning, and hand movements necessary for selecting targets. Our measures of movement were calculated from our tracking data, which we filtered using the Douglas-Peucker algorithm (1cm tolerance) to compensate for jitter.

Procedure

We first introduced participants to the experiment and calibrated the system. For calibration, we asked participants to raise their hand in a pointing gesture with their thumb touching the knuckle of their curled middle finger (Fig. 1-C), and repeat this gesture a number of times. This was captured to build a template for the selection gesture. Participants then did five practice tasks with each interface. Participants operated both interfaces using their preferred hand; we automatically verified that touch events were produced by the gloved hand. The introduction took around 15 minutes. Before each task, we asked participants to stand at the starting position 2m away from the center of the display (Fig. 1-A); an on-screen indication helped them find the position; when in position, the first target was shown. Participants selected the first target to begin the task. Participants were asked to select targets as quickly as possible, while maintaining high accuracy. Participants could rest after each task. Once they completed all tasks with one interface, they were handed the questionnaire.

After completing all tasks, participants were asked to explain which interface they preferred. The experiment lasted around an hour on average for each participant.

Hypotheses

We expected that the different control-display ratios of touch and mid-air would result in a speed-accuracy tradeoff. Moreover, mid-air should generally be slower, as input space and output space are decoupled and users therefore must relate movements to the visual feedback. We hypothesized the following:

• Touch is faster and less error-prone than mid-air for subsequent targets close to each other on the display. Compared to mid-air, direct coupling of motor space and display space gives users direct feedback on interaction as it occurs. • Mid-air is faster for distant targets as users can cover any distance to a target solely through arm/hand/finger movements. For touch, in contrast, distant targets require extensive body movements, which are slower. • Mid-air is slower for small targets, because the higher control-display ratio makes pointing more difficult; users may need to move closer to point more accurately. • Touch performs relatively worse for Varied tasks, especially with large distances and small targets, because visual search is harder due to the limited field of view.

Results

We report results based on the estimation approach [START_REF] Cumming | The New Statistics: Why and How[END_REF], that is, as effect sizes with confidence intervals following the latest recommendations from the APA [START_REF]The Publication manual of the American psychological association[END_REF]. We report geometric means, as they predict population means of completion times more reliably than other metrics [START_REF] Sauro | Average task times in usability tests: what to report?[END_REF], and 95% confidence intervals. Note that geometric means may lead to asymmetric confidence intervals.

Accuracy with Touch and Mid-Air. We observed a high error rate (M = 25%) affecting both Touch (M = 16%) and Mid-air (M = 34%). As shown in Table 2, the error rate depends on task type, target distance, and target size. Small targets were particularly difficult to select and produced high error rates with both interfaces (Touch: M = 39%, Mid-air: M = 59%); these error rates are consistent with previous studies of touch (29% for 1.26cm targets, 19-57cm distances [START_REF] Pedersen | An Experimental Comparison of Touch Interaction on Vertical and Horizontal Surfaces[END_REF]) and mid-air (56% for 1.6cm targets, 134-402cm distances [START_REF] Vogel | Distant Freehand Pointing and Clicking on Very Large, High Resolution Displays[END_REF]). However, error rates for larger sizes are higher than expected. We identified 3% of the errors as due to participants making selections far from the target or where a "double-selection" was made within 200ms after a successful selection. When we compare selection times below, we only analyze trials where targets were successfully selected in the first attempt (N = 5450). ). This is in line with our expectation of mid-air being generally slower because of the decoupled input and output spaces. We see from Fig. 2 that the mean selection time is higher for Mid-air for both task types, but that the difference is larger for Fixed tasks (1.6 times, CI [1.45, 1.77]), where target placement was predictable, than for Varied tasks (1.22 times, CI [1.1, 1.35]), where targets appeared in random locations. This difference in ratios is likely because searching for randomly appearing targets is easier when using Mid-air at a distance from the display.

One reason for the relatively poor performance of Mid-air is difficulties with the thumb trigger gesture. We occasionally had to recalibrate the trigger gesture during the experiment (mostly due to a shifted glove) in order to ensure correct recognition of selections. For Mid-air, a relatively large amount of time (M = 26%, CI [START_REF] Marquardt | The continuous interaction space: interaction techniques unifying touch and gesture on and above a digital surface[END_REF][START_REF] Nancel | Mid-air panand-zoom on wall-sized displays[END_REF]) is spent selecting the target after having pointed at the target.

Effects of distance and size. We expected the relative performance between Touch and Mid-air to depend on target size and distance. Fig. 3 shows selection times as the ratio of Mid-air to Touch; a ratio larger than 1 means that Mid-air is slower. The figure shows that the main effect of interface holds for most of the tested conditions: ratios are larger than 1 for 21 out of 24 (task type × size × distance) combinations.

The advantage of Touch diminishes with increasing distances, in particular when targets cannot easily be reached without much body movement (cf. Fig. 1-B1/B2). Mid-air even performs better than Touch for the combination of largest targets at the farthest distance, although the ratio is relatively small (0.89 times, CI [0.82, 0.97]).

Contrary to our expectations, there seems to be less variation in task completion times for randomly placed targets (the Varied task) than for reciprocal placements (the Fixed task). For small targets, the results are less reliable due to high error rates for these targets. Still, the overall trend is clear that Touch performs well for selections across short distances, which require little or no locomotion. Subjective satisfaction and preference. Participants gave Touch more positive scores on 6 out of 12 questions about subjective satisfaction (see Fig. 5). Interestingly, participants reported higher wrist and finger fatigue for Mid-air than for Touch, which contradicts movement data. Holding the hand and fingers in a static mid-air pointing gesture seems to be more straining than more dynamic movements for touch input.

Twelve participants preferred Touch, seven preferred Mid-air (not significant by X 2 -test). Participants hinted at the reasoning behind their preferences in their comments. Participants explained that Touch was accurate and reliable (9 participants), but that the requirement for moving was taxing (4). Mid-air was thought to give an overview and made it "easy to see targets" ( 5) and required less walking ( 4), but accuracy was low particularly for small targets (10).

Experiment 2: Movement Costs and User Choice

Our second experiment investigated which input modality users choose when both mid-air and touch are available. We were interested in how the introduction of conditions under which mid-air input is thought to be beneficial (e.g., backing away to overview a display [START_REF] Nancel | Mid-air panand-zoom on wall-sized displays[END_REF] or use a keyboard [START_REF] Markussen | Vulture: A Mid-air Wordgesture Keyboard[END_REF]) affects performance, preference, and choice of interface: we simulated these conditions by artificially requiring movement.

Hypotheses

Our first hypothesis was that participants overall would choose touch over mid-air. This hypothesis is based on the results of Experiment 1, which showed that touch performs the best except for one distance/size combination. However, about a third of the participants preferred mid-air input in Experiment 1, which suggests that they might choose mid-air interaction. Due to the cost of switching and incurred performance degradation for some targets, we still expect touch to be chosen overall.

Our second hypothesis for the experiment was exploratory. We investigated how manipulating the cost of location-dependent input (such as touch) changes perfor- mance and preference. We introduced a backing-up request, requiring participants to move to a particular place in the room. This request abstracts situations where users have to move during or in-between interaction (e.g., to type on a keyboard, write on paper, consult with peers, or get an overview); earlier work has thought that mid-air might be beneficial in such situations (e.g., [START_REF] Markussen | Vulture: A Mid-air Wordgesture Keyboard[END_REF][START_REF] Nancel | Mid-air panand-zoom on wall-sized displays[END_REF]). Our expectation was that-with an increasing cost associated with location-dependent input (i.e., having to walk back and forth between touch and backing-up requests)-mid-air would be chosen more often, perform better, and be more preferred.

Interface and apparatus

Our interface combines the two input techniques (Touch and Mid-air) used in Experiment 1: The experimental interface allows participants to either touch or, at a distance, point in mid-air. We found this to be simple to understand and thus decided against attempting to integrate the two techniques. When the participant's hand or index fingertip is more than 20cm from the display the ray-pointing cursor is shown.

As the participant's finger approaches to touch the display (<15cm distance, using hysteresis tolerance) that cursor disappears. This was done to avoid confusion about the cursor being shown while interacting with the display through touch.

Tasks

We used only the Fixed task from Experiment 1, for which there was the greatest performance benefit for touch input, in order to reduce the length of the experiment and the risk of tiring participants. We used the same target sizes (3 levels) and target distances (4 levels) as in Experiment 1.

The backing-up request required participants to move to a 40cm-wide circular area located 2m away from the display (see Fig. 1-A). The request abstracts situations in large-display interaction where users have to move away from the display, for example to gain an overview or to access a keyboard in a particular location. We considered asking participants to type on a keyboard, but since we were only interested in the consequent effects of having to move away from the display, we decided against introducing an arbitrary task. The request was signaled by a message on the display asking participants to move to the location: this message was removed when the participants had stayed in the area for 500ms (as determined by the tracked position of the head). We varied the frequency of backing-up requests as follows: Absent (no requests, corresponding to Experiment 1), Infrequent (a third of the trials), and Frequent (half of the trials). Requests were made after randomly determined trials.

Participants

We recruited 10 volunteers (5 female), 18-47 years old (M=24), to participate; all were right handed. Participants received an equivalent of €25 as compensation.

Experimental design

We varied backing-up requests within participants; size and distance were also varied within participants as in Experiment 1. We varied the order of levels of backing-up request across participants using a Latin square. Participants performed 8 repetitions for each combination of size and distance, for a total of 96 timed targets. Altogether, the experiment gave data from 10 participants × 3 (backing-up request frequencies) × 3 (target sizes) × 4 (target distances) × 8 (repetitions) = 2880 target selections.

Dependent variables and data collection

We collected task time, error rate, data on whether selections were done with touch or mid-air gestures, and participants' preference for either touch or mid-air gestures.

Procedure

The calibration and instructions were as in Experiment 1. Participants first performed four practice tasks with each input type to familiarize themselves with them; then they performed eight practice tasks (four with infrequent and frequent backing-up requests, respectively) where they could freely choose and switch between touch and mid-air.

Participants selected the first target to begin a task. In order to avoid bias against touch input, participants did not have to stand 2m away from the display to start each task, as was required in Experiment 1. After completing a task, they could rest and move freely in order to use either touch or mid-air gestures to begin the next task. The backing-up request required participants to move to the location 2m away from the center of the display (see Fig. 1-A), as described above. After standing there for 500ms participants could select the next target. After completing all tasks, participants stated which interface they preferred. The experiment lasted 45 minutes on average.

Results

Choice of input. Overall, participants completed 978 trials with touch (34%) and 1902 trials with mid-air gestures (66%). Touch was the most often used when backing-up requests were absent, see Fig. 6 (top row). This supports our first hypothesis. However, we had not expected mid-air to be chosen so often (42% of trials). We had hypothesized that the cost of using touch, which was imposed by the backing-up requests, would lead mid-air to be chosen more often. There was a significant association between backing-up requests and input used, X 2 (2) = 393.8, p < .001. Indeed, with more frequent requests, mid-air was chosen more often (83% of trials for frequent requests). The question then is whether target size and distance had an effect on choice? Fig. 6 (middle rows) shows how often touch and mid-air were chosen for different target sizes. It seems choice of input depends on target size. For medium-sized and large targets, touch and mid-air were used equally often when requests were absent, whereas almost all selections were done using mid-air when requests were frequent. Participants chose to use mid-air surprisingly often for selecting small targets, which are particularly challenging with mid-air, even in absence of backing-up requests. Fig. 6 (bottom rows) suggests that distance had less effect on participants' choice of input.

Switching input: Staying or going. Participants switched between using touch and mid-air for 158 (out of 1902) target selections, altogether, of which 67 times were associated with a backing-up request. After backing up, they switched to using midair 70% of the times; the remaining times they walked back to use touch (85% of which were for small targets). Considering that 840 backing-up requests were made, participants were prone to stay at a distance from the display. Also, 32 switches to using mid-air were not associated with a request. We saw no instances of alternating between using touch and mid-air for consecutive target selections.

The frequency of switches depends on the frequency of backing-up requests in the task: Participants switched more often (.61 times on average) when requests were infrequent than when they were absent or frequent (.32 and .39 times, respectively), which suggests that participants were more challenged in making the tradeoff between staying and using mid-air or going back to the display in order to use touch.

Task time. We hypothesized that mid-air would perform better with increasing cost of location-dependent touch input: the backing-up requests penalize touch because participants must spend time walking back to the display (in the following analysis of target selection times we exclude time spent backing up). Generally, it takes time to switch between the two modes of input, which impacts both mid-air and touch. As can be seen in Table 3 (rightmost column), the overall mean selection time (which includes selections with errors) is comparable for Mid-air and Touch. However, selection times depend much on whether participants switched from another input mode.

Preference. Seven out of ten participants preferred mid-air gestures (cf. only seven out of 19 in Experiment 1). It seems that with an increasing cost of touch, by way of movement induced by the backing-up requests, mid-air becomes preferable. As benefits of mid-air, seven participants mentioned the lack of a need to move (e.g., "little movement required") and the ease of selecting distant targets (e.g., "much easier to click dots that are far apart"). Five participants liked touch for being precise.

Discussion

Summary of results. Touch was between 22% and 60% faster than mid-air in Experiment 1. Selection with touch was uncomplicated and had lower error rates. Touch also scored higher than mid-air on several aspects of satisfaction. Touch performance suffered when a target's size and position could not be anticipated; participants turned their head much more, presumably searching for targets. In Experiment 2, touch was as fast as mid-air on average, even with the requirement to do additional movement. Mid-air was slow and error-prone in Experiment 1. In Experiment 2 mid-air was also slow compared to touch, but users chose it frequently, especially when they were asked to back away, and almost exclusively for selecting medium-sized and large targets (97%-99%). Preferences also shift between the two experiments: 7/10 preferred mid-air with backing-up requests in Experiment 2 versus 7/19 in Experiment 1. Mid-air required less movement and was therefore liked.

Interpretations of Results.

The results can be interpreted in several ways. First, the results suggest a place for mid-air interaction. While touch is hard to compete with, mid-air seems to work well and to be chosen by users in situations where earlier work has suggested that it is beneficial (e.g., walking to type on a keyboard [START_REF] Markussen | Vulture: A Mid-air Wordgesture Keyboard[END_REF]). Further, users might choose to manipulate even small targets from a distance when they do not need to inspect them in detail up close: Participants in Experiment 2 chose mid-air for over half of the smallest targets with frequent backing-up requests. This calls for accurate mid-air pointing techniques. These are key implications of the present study.

Second, the results seem to present a new case of performance-preference dissociation; several studies in usability research have shown that people are not necessarily performing best with the interfaces they prefer [START_REF] Hornbaek | Meta-analysis of correlations among usability measures[END_REF][START_REF] Nielsen | Measuring usability: preference vs. performance[END_REF]. Mid-air might benefit from the principle of least effort: users prefer not to move, even if small targets are hard to select at a distance. Similarly, a study found users largely preferring virtual navigation over locomotion for a classification task using a gyroscopic mouse, despite possible performance benefits of locomotion [START_REF] Jakobsen | Is Moving Improving? Some Effects of Locomotion in Wall-Display Interaction[END_REF]. Public display research has also presented subjective feedback that suggests users might minimize physical effort [START_REF] Kurdyukova | Bodily or Mobile Interaction?: Comparing Interaction Techniques for Personalized Public Displays[END_REF].

Third, the viewing angle and distance to the display has played an important role in earlier work when users need to overview [START_REF] Ball | Move to improve: promoting physical navigation to increase user performance with large displays[END_REF] or make visual comparisons [START_REF] Bezerianos | Perception of Visual Variables on Tiled Wall-Sized Displays for Information Visualization Applications[END_REF] of data on large displays. Here, we show it is also important for choice of input mode. The Table 3. Mean target selection times after having used the same mode of input as for the previous selection (i.e., not switched) and having switched from another mode of input. benefit of mid-air, in part, comes from the lower need to visually scan or to move in order to point at far-between targets, when users stand at a distance.

Limitations and Future Work. Several limitations of the study and avenues for future work are clear. First, the high error rates of the study are a concern. Even if comparable to earlier studies (e.g., [START_REF] Vogel | Distant Freehand Pointing and Clicking on Very Large, High Resolution Displays[END_REF]), investigating interaction techniques that may reduce them is crucial. Many such techniques exist [START_REF] Grossman | The bubble cursor: enhancing target acquisition by dynamic resizing of the cursor's activation area[END_REF][START_REF] Vogel | Shift: a technique for operating pen-based interfaces using touch[END_REF] that could be adapted and tested for mid-air. Improving the trigger implementation could also reduce error rates. Second, we studied just one task, pointing, but other tasks also need studying. Users' performance with and choice between touch and mid-air gestures may look quite different for other types of task (steering, manipulation of data, etc.), and for collaborative tasks in particular, which is an important use case for large displays.

Third, we artificially manipulated participants to move to a distant location. A next step for research is to study both realistic tasks and cognitively demanding tasks that benefit from using the display from a distance (e.g., overview of information) and from off-loading cognitive effort into physical movement. Such studies might see users choose differently between touch and mid-air gestures.

Fig. 1 .

 1 Fig. 1. Experimental setup: A-starting position for all tasks; B-maximum distance to cover in the touch condition; C-thumb trigger gesture used to make selections in the mid-air condition.

  Target selection time with Touch and Mid-Air. Interface has a clear effect on selection time: Participants spent 40%, CI [29%, 52%] more time selecting targets with Mid-air (M = 1698ms, CI [1570ms, 1863ms]) than Touch (M = 1214ms, CI [1111ms, 1327ms]

Fig. 2 .

 2 Fig. 2. Average target selection times showing main effects for interface and task type.

Fig. 5 .

 5 Fig. 5. Bootstrapped confidence intervals for ratings on questions about subjective satisfaction.

Fig. 6 .

 6 Fig. 6. Frequency of trials made with each input mode for each condition.

Table 1 .

 1 Target sizes and distances. Visual angle is at a 50cm distance to the display.

			Target sizes		Distances between targets
	pixels	32	128	512	768	1536	3072	6144
	cm	1.2cm	4.7cm	18.8cm	28cm	56cm	112cm	224cm
	visual angle	1.3˚	5.3˚	21˚	31˚	59˚	96˚	132˚

Table 2 .

 2 Error

rate across target size (rows) and distance (columns) for the two interfaces and task types.

Acknowledgements. This work has been supported in part by the Danish Council for Strategic Research under grant 10-092316.

Physical movement. As expected, more movement was required for Touch than for Mid-air (see Fig. 4). For Touch, participants naturally have to move their body to bring their hand within physical reach of the target on display: they moved their hand 237cm on average to reach targets at the largest distance of 224cm. For Mid-air, targets can be selected from a distance with arm and hand movements only.

Movement increased with larger distances for both interfaces (Fig. 4, top), but in particular for Touch (M = 115cm vs. M = 33cm for Mid-air, at the largest distance) as participants moved their whole body in order to get in a position to better reach the target. On average, participants moved more and approached the display more for small targets (Fig. 4, bottom). Also, participants moved sideways in order to gain a better visual angle, and therefore had to move more if they were closer to the display.

Participants also turned their head much more for Touch (M = 201°) than Mid-air (M = 92°). The field of view is limited when being close to the display and visual search for targets is likely more time consuming. This impacts only the Varied task, which explains the difference in relative performance between the two interfaces for the two task types.


Objective

The objective of this project is to discover the DNS infrastructure built by the different Internet actors. More specifically, the following points are interesting:

• the number of DNS caches, inbounds and outbounds;

1 http://confiance-numerique.clermont-universite.fr/redocs2016/ 2 English: National Cybersecurity Agency of France, the French national authority for the defence and the security of information systems, http://www.ssi.gouv.fr/ 3 https://www.ssi.gouv.fr/en/strategic-committee/the-french-internet-resilience-observatory/ 4 Domain Name System. 5 Internet Service Providers.

• the relationship betweeen the ISPs of the clients and the response from the DNS server;

• the presence or absence of load balancing;

• the similarities and differences between IPSs;

• the evolution of TTL6 .

The analysis does not stop to theses points. The objective is also to do some data mining in order to find some specific behaviors or patterns which are relevant regarding the DNS architecture.

Finally, another goal is to map the data collected to have a global visualization of the DNS architecture.

In order to do this, the project Atlas7 from the RIPE-NCC is used. The Atlas project is a global, open, distributed Internet measurement platform, consisting of thousands of probes that measure Internet connectivity in real time. These probes are dissiminated all around the world, in nearly all ISPs. Thanks to this, it is possible to lauch queries from all over the world and compare the results.

For this project, we first developed specific tools to access these probes and launch specific DNS queries. The second step was to analyze the collected data and interpret them regarding our objective. This report contains the conclusions of our analysis.

Outline

First, we will present in more details the context of this project in Chapter 2. An explanation of the DNS protocol is given, along with the overview of the Atlas project. Chapter 3 describes our methodology to analyze the data we collected. The results are given in Chapter 4, where several patterns of communication found in the data are presented. A focus on two different Autonomous Systems, Google and Orange, is done in Chapter 5. Finally, Chapter 6 concludes and explains the future work of this project.

Chapter 2 Context

DNS protocol

The Domain Name System emerged with the RFC10341 in 1987. It is a protocol for exchanging information about domain names of the entities on a network. The most common use we, as users, make of it is to find the IP address of a domain we want to reach. For example, when accessing http://atlas.ripe.net in your favorite browser, your computer asks: What is the IP of atlas.ripe.net? and gets an answer containing an IP, which can then be used for the actual HTTP connection to take place. DNS is much more versatile than just resolving IPs. There are several types of DNS records, for IP resolution it is a type A (IPv4) or AAAA (IPv6). In this study, we work with TXT records, since they allow any text content as the answer.

Another key feature of DNS is its decentralized, hierarchical structure. That is, the knowledge about the domain names is spread and organized in zones, with one or more authoritative servers each. In Figure 2.1 we detail the resolution for the domain 9872-42.zone-redocs.irisa.fr, assuming the resolver as no cached recoreds. It illustrates our study case.

1. The resolution process starts with a query to one of the root servers. The root servers do not answer directly, but respond with a referral to more authoritative servers, here .fr servers.

2. The resolver now queries the .fr servers referred to, and is given a referral to the irisa.fr servers.

3. This process is repeated to have the referral servers for zone-redocs.irisa.fr.

4. Finally, the authoritative server for zone-redocs.irisa.fr gives the answer.

As DNS resolutions happen all the time, and many users make identical requests, www.google.com for example, there are ways to optimize the resolution steps with use of DNS caches. At a company level for example, there might be one DNS server handling the recursive resolution for all the internal users so that it answers the IP of www.google.com multiple times, having made only one resolution to Google authoritative servers. Similar things happen at other scales, for example at Internet Service Provider or Autonomous System (AS) level. The DNS caches organization is a main focus of our study.

RIPE Atlas project

To analyze DNS infrastructures around the world, we want to make DNS queries as legitimate users would do, worldwide. For this purpose we use Atlas2 , "the largest measurement network ever made", initiated by RIPE NCC, the Regional Internet Registry for Europe, Middle East and Central Asia. This measurement network consists in more than 14 thousands probes and 2 hundreds anchors. The probes are small USB-powered devices with network connectivity, which can be tasked to perform

Probe side

On the probe side, we perform measurements where every probe is asked to request one unique domain with its default resolver. This unique domain is built as the concatenation of the timestamp, a dash and the probe ID. The necessity to ask for a unique domain is due to two reasons:

• it differentiates every query on the server side, we know exactly from which probe the query is coming;

• it bypasses the possible DNS caches since the same domain is never asked twice.

An example of response to a DNS query by a probe is given in Listing 3.1. This response is available on the Atlas API.

Only a few fields in this response are important regarding our objective. Using Sagan, the fields given in Table 3.1 are extracted.

Server side

For this project, we managed the authoritative server for the DNS zone zone-redocs.irisa.fr. We developed our own very small DNS server in python, using dnslib1 . This personalized DNS server gives us the ability to see the request from the server side and send a specific response. This server handles only TXT queries, because the format of the answer is free, meaning that we can send back the data we want.

Listing 3.1: Response for a DNS query [ { " type " : " dns " , " timestamp " : 1 4 7 7 4 8 7 8 6 5 , " r e s u l t s e t " : [ { " time " : 1 4 7 7 4 8 7 8 6 5 , "submax " : 1 , " s u b i d " : 1 , " s r c a d d r " : " 1 9 2 . 1 6 8 . 1 7 9 . 2 4 " , " r e s u l t " : { " s i z e " : 1 0 0 , " r t " : 6 9 . 7 5 1 , " an s we r s " : [ { "TYPE" : "TXT" , "RDATA" : [ " 8 1 . 1 7 3 . 1 9 4 . 7 7 61643 Wed27257 -29405" ] , "NAME" : "Wed27257 -29405. zone-r e d o c s . i r i s a . f r " } ] , " abuf " : "\/KWBgAABAAEAAAAADldlZDI3MjU3LTI5NDA1C3pvbmUtcmVkb . . . WQyNzI1Ny0yOTQwNQ==", "QDCOUNT" : 1 , "NSCOUNT" : 0 , "ID " : 6 4 6 7 7 , "ARCOUNT" : 0 , "ANCOUNT" : 1 } , " p r o t o " : "UDP" , " l t s " : 1 9 , " d s t a d d r " : " 1 9 2 . 1 6 8 . 1 7 9 . 1 " , " a f " : 4 } ] , " p r b i d " : 2 9 4 0 5 , "msm name " : " Tdig " , "msm id " : 6 9 0 6 2 0 1 , " l t s " : 1 9 , " g r o u p i d " : 6 9 0 6 2 0 1 , " fw " : 4 7 4 0 , " from " : " 8 7 . 7 9 . 2 0 0 . In order to know where the origin of the request, the TXT data is the following: Remote IP, Remote Port, Domain Requested. We also log the following fields from the server side: the DNS cache remote IP, the port it uses, the probe ID (we extract it for the requested subdomain) and the TTL we set (only 120 for this study).

Retrieving the results

We launched two campaigns of measurements: first on all French probes, second on all possible probes in the world. To do this, we requested all available probes using the Atlas API. Due to the limitation of the API of Atlas, only one hundred queries can be launched at the same time. This means that we have to time the requests we made.

Table 3.2 sums up the number of probes and the time taken for our measurements.

Chapter 4

Analysis

During our analysis, we have identified some interesting behavioral patterns. In this section, we present the patterns observed during our experiments.

Global view

We used a graphical visualization tool, Gephi1 , to facilitate our analysis of DNS infrastructures. Figure 4.1 reflects a glimpse of DNS request and responses for the probes from France. The nodes in the graph represent the probes, probes resolvers, DNS cache servers and our DNS server. Using this graph we were able to quickly find new behaviors. To facilitate the understanding, we will explain some scenario by considering a small portion of this visual graph. At that time of our experiement (October 26th, 2016), 8605 probes were available. Figure 4.2 illustrates the geographic repartition of the probes. These probes are situated in 176 countries all around the globe. This confirms that thanks to the Atlas project, queries will be coming from the whole world.

If we take a closer look, we can see that the majority of them are in Europe and North America.

Regarding the autonomous systems of the probes, there are 3187 different AS in our data. The AS with the biggest number of probes are also the european and the american operators, as we can see in Table 4.1.

Queries per probe

While looking at the number of queries requested by the probes in general, we observed that a single probe can explicitly send a DNS query to more than one resolver. For instance a probe can send a DNS request to a local resolver and a public DNS resolver like public Google DNS server. This is described in Figure 4.3.

We can see in Figure 4.4 that a little bit more than 80% of the probes make 1 or 2 queries, and roughly 17% make 3 queries. None made more four or more queries itself. If we consider an example from our experimentation results, in the Figure 4.5, one can observe ording ording that probes (yellow nodes) 17096, 19762 and 17157 sent DNS queries to only single resolver. On the contrary the probes with a green frame (like the 12821) are sending queries to several DNS resolvers.

Probe DNS resolvers

A DNS resolver can be used by multiple probes. This is a typical generic DNS client-server case, where multiple DNS clients, probes in our context, are interacting with a single DNS resolver as shown in Figure 4.6. If we consider an example from the experimentation results, in Figure 4.7, we can observe that the nment. nment.

DNS resolver with the IP address 109.0.64.102 is serving the three probes 12821, 17096, 28784.

Considering the campaign data we used for our experimentation, we observed that they are more than 700 DNS cache servers that serve multiple probes. Out of these queries to probe resolvers with public IPs, 30% were served by the google public DNS cache servers. In particular, the DNS cache server 8.8.8.8 server is the top most queried server, followed by 8.8.4.4 server. The Figure 4.8 projects the number of probes served by DNS resolvers.

DNS caches

In this section, we analyze the link between our authoritative server and DNS caches.

Query replication

We observed this scenario when one probe made one query to one probe resolver and that trigger queries from other caches, cf Figure 4.9. Unlike the case where a single probe interacts with multiple cache servers, here the probe DNS request is replicated at DNS cache server level. And therefore, from IRISA server side, we see several queries for a same probe and respond to each separately. This pattern is observed by comparing the number of DNS requests entries in the log file on at probe level with the number of DNS response entries in the IRISA server log. In Table 4.2 we report the cases with most replications. For example, the probe 121 has originally initiated one query to its resolver and this query has triggered 29 queries from different DNS caches to IRISA DNS cache server.

This behaviour could indicate that there is a replication strategy in the ISP. More focused measurements would allow us to better outline entities doing this.

Several layers of caches

Next we identified when probe resolvers and DNS caches form a multi-layers structure. More precisely, we see several probes using the same probe resolver and from the authoritative side we see queries coming from different DNS caches, see Figure 4.10. The first case to think of is that of Google: 8.8.8.8 and 8.8.4.4 are used by many probes and on the DNS side we see queries coming from several hundreds IPs.

Overall, we found a total of 282 probe resolvers and 1024 outbound cache servers. There are certainly more resolvers and caches involved in such structure, more measurements and more analyses could extract them. Figure 4.11 provides a glimpse of inbound DNS traffic between yellow probe nodes to google DNS resolvers. And the outbound DNS traffic is observed between the DNS cache servers close to IRISA DNS server.

Separation between AS

In this section, we analyze the relationship between autonomous systems.

Probe resolver and DNS cache in different AS

In this first case we report observations on scenario where the probe resolver interacts with a DNS cache in a different ISP. This can be strange for big ISPs of which we could expect that they perform DNS recursions themselves.

Overall there are 1263 of such probe requests in our world data campaign.

Probe and probe resolver in different AS

In general, a probe is likely to interact with a probe resolver that is either local (private IP) or public in the same ISP as the probe. However, in some cases we observed probes interacting with probe resolvers outside its ISP. This could indicate that the probe does not get automatic IP configuration optimized for its ISP but some settings are overridden by the user for example. Overall, we found around 2624 probes that interact with the DNS caches outside from their home AS.

TTL modification

Aside of the previous analysis on DNS caches organization, we also had a quick look at the TTL value.

This field is set by the authoritative server as a validity period for the record. For DNS caches and clients it means that they need not ask again the same question to the authoritative server in this time frame. This value allow to decrease the authoritative server load, yet keeps a dynamic in the system in case of updates. Typical observed values count in minutes. So, for our experiments we set a TTL of 120 seconds at the DNS server level and made observations of the values received by the probes. We see in the Figure 4.14 below that most of the caches forward the original (or decreased) value to the probes, but some raise it to 150, 300, 600, 1800, 3600, or even 86400 (24 hours).

While this increase is understandable from a load management point of view, DNS cache providers may wish to avoid too frequent updates, it can lead to service unavailability to users. For example, in case of IP relocation, as it happens these days of IPv4 penury, a service provider would announce a new IP for his domains. But its clients behind caches which increase TTL values too much, will not update their local information for some time and thus fail to connect to the correct IP.

Further study would be interesting on this aspect. For example, what happens in the case where the authoritative server set a very high value? Do the caches lower it or further increase it? Also we could study the real time during which the cache keeps the value. Does it follow strictly the TTL of the authoritative? Does it depends on the popularity of the domains? (How often clients ask for it?).

Focus on two AS

In this last section, we present our detailed study on two DNS resolver providers. The first is Google with its widely known public DNS resolvers 8.8.8.8 and 8.8.4.4 and the IPv6 counterparts. The second is Orange, the largest French ISP (in terms of number of users). The results presented here comes from extracts of our world campaign data.

Google

At the end of 2009, Google announced the availability of its DNS service, open to everyone for free1 . Setup is made very simple thanks to easy to remember IPs 8.8.8.8 and 8.8.4.4, this service is now used by large amount of users.

Out of the 8,605 probes used during our world campaign, 1,835 (21.3%) used this service, accounting for 2,805 queries out of 15,204 total queries (18.6%). From the authoritative server view, we saw queries coming from 546 different IPs. Figure 5.1 displays the situation for IPv4 measurements.

With this picture only, we could think there are two bottlenecks in this strategy. However, as Google advertised in its dedicated FAQ2 , we could confirm that regional resolvers are used and not all traffic get routed to the same two places. Below is a map 5.2 where the 546 different resolvers IPs are located. We can see there are resolvers in North and South America, Europe, East and South-East Asia.

With 546 requesters, we looked also at how well distributed the queries are. As shown in Figure 5.3, some are used for up to 40+ queries whereas 3/4 of them resolved less than 5 queries. It could be interesting to look at this data with respect to probe repartition, which might induce biases.

Orange

Orange is a French multinational telecommunications corporation. 147 probes haved used Orange resolvers in our data. From the authoritative server view, we saw 174 queries coming from 146 different IP addresses.

We also looked at how well distributed the queries are. As shown in Figure 5.4, there is way less load on the Orange DNS caches than the Google ones.

Finally, we can see that Orange has put its DNS caches in four locations in France. These locations are shown in Figure 5.5.

Conclusion and future work

The results presented here summarize the work done over 3 days during REDOCS. It is obviously not all that can be said. Nevertheless, we were able to outline some behaviours and notice some patterns in DNS caches organization at ISP/AS level, as our main objective was.

Further work could extend the results. First on the same dataset, it could be interesting to improve the pattern detection and understanding. Then, new measurements could highlight the dynamic of the DNS infrastructures: monitoring TTL compliance, discovering load-balancing elements... Also with a focus on a DNS provider we could obtained more data and more information about its configuration or strategy.

  view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 Probes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2.1 Probes around the world . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2.2 Queries per probe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3 Probe DNS resolvers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4 DNS caches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4.1 Query replication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4.2 Several layers of caches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5 Separation between AS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5.1 Probe resolver and DNS cache in different AS . . . . . . . . . . . . . . . . . . . 4.5.2 Probe and probe resolver in different AS . . . . . . . . . . . . . . . . . . . . . . 4.6 TTL modification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Focus on two AS 5.1 Google . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 Orange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The work pusblished in this report has been accomplished during REDOCS 2016 1 . REDOCS stands for Rencontres Entreprises DOCtorants Sécurité. It is a French event, where PhD students are working together during one week to solve real life problems given by companies. This year, one of these companies was the Agence nationale de la sécurité des systèmes d'information (ANSSI) 2 . One of the mission of the ANSSI is to improve knowledge of the French Internet by studying the technologies critical to its proper functioning, with the French Internet Resilience Observatory 3 . The DNS 4 protocol is essential for the Internet, and one of the metrics studied by the French Internet Resilience Observatory. Having a map of the DNS infrastructure of web providers and ISPs 5 is crucial. So the ANSSI suggested a study of the DNS infrastructure.

Figure 1 . 1 :

 11 Figure 1.1: Logo of the ANSSI

Figure 2

 2 Figure 2.1: Recursive DNS resolution done by DNS resolvers (caches)

Figure 3

 3 Figure 3.1: Experiment set-up

Figure 4

 4 Figure 4.1: Visual graph for France.

Figure

  Figure 4.2: Distribution of the probes in the world

  Figure 4.3: A probe sending several queries.

Figure 4

 4 Figure 4.4: Number of queries per probe.

Figure 4 . 5 :

 45 Figure 4.5: Probes making several queries in our experimentation.

Figure 4 . 6 :

 46 Figure 4.6: Several probes use the same resolver.

Figure 4

 4 Figure 4.7: Same DNS resolver for several probes in our experimentation.

Figure 4

 4 Figure 4.8: DNS cache load repartitions.

Figure 4 . 9 :

 49 Figure 4.9: Replications of probe query.

Figure 4 .

 4 Figure 4.10: Multi-layer caches organization.

Figure 4 .

 4 Figure 4.11: Multi layers of caches in our experimentation.

Figure 4 .

 4 Figure 4.12: Probe resolver and DNS cache in different AS.

Figure 4 .

 4 Figure 4.13: Probe and probe resolver in different AS.

Figure

  Figure 4.14: TTL modifications

Figure 5

 5 Figure 5.1: Google public DNS service structure

1

  Introduction 1.1 REDOCS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Objective . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2 Context 2.1 DNS protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 RIPE Atlas project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Methodology 3.1 Probe side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Server side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Retrieving the results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Table 4

 4

	Probe id # probe queries # DNS cache queries
	121	1	29
	23857	1	26
	17382	2	19
	12155	2	17
	3189	2	12

.2: Probe queries with most replications.

Time to live.

https://atlas.ripe.net/

ftp://ftp.isi.edu/in-notes/rfc1034.txt

https://atlas.ripe.net

https://github.com/RIPE-NCC/ripe-atlas-cousteau

https://github.com/RIPE-NCC/ripe.atlas.sagan

https://bitbucket.org/paulc/dnslib/

http://gephi.org/

https://googleblog.blogspot.fr/2009/12/introducing-google-public-dns.html

https://developers.google.com/speed/public-dns/faq