Research And Design Of Dns Monitoring System Based On Passive Package Analysis

Domain name system (DNS) is a firm infrastructure of the internet. It is used to maps domain names to IP addresses. Whether the domain name server can efficiently and stably run has a direct impact to the user’s network experience. A good monitoring system is able to take appropriate measures timely to ensure that servers can run stably when exception occurs. A kind of monitoring system is implemented through the analysis of the domain name server logs, which is difficute to achieve the pupose of real-time monitoring. Further more, function of server logs are needed to be started, which reduces the performance of the server.In the paper, an improved monitoring system is proposed, which can monitor domain name server for real time. As function of server logs is not needed, the performance of servers is improved. The main work includes the following issues.1) A real-time monitoring system model has been designed and implemented. It receives data from network card passively, analyses the data, and then provides graphical display to users. The purpose of real-time monitoring is achieved. An experiment is performed to vertify the accuracy of the system.2) Off-line statistics of logs saved by the monitoring system is performed. In the paper, the Map/Reduce programming model is taken to analyse these logs, which provides statistic service of historic data for user, including domain name ranking, IP address ranking and classification’s response rankings. At the same time, it provides data source for domain name server’s cache in the initialization phase, which avoids server’s cold start.3) Message service of original system is extended, which enhances real-time monitoring of the server status.4) Several security strategies are proposed, which can effectively prevent denial of service attacks and cache poisoning.