Introduction to SDNS-Mon DataSystemGroup@CNNIC

Outline 1 What SDNS-Mon is 2 What SDNS-Mon can do 3 Key Technologies of SDNS-Mon

What SDNS-Mon is What SDNS-Mon is SDNS-Mon is short for SDNS Monitoring Platform Multidimensional and distributed system, which serves as DNS measurement collecting, DNS service monitoring and DNS data analyzing platform for CN Five dimensions：service failure, configuration, performance, network flow and security（more than 20 monitor items） Goals：security monitoring, service failure alarm, DNS analysis and security guarantee 61 monitor servers，covering three major ISPs in 31 provinces of China, 4 of which are oversea servers What SDNS-Mon is

What SDNS-Mon is SDNS-Mon Real-time monitoring Alarm Statistics Important domestic DNS authoritative servers and recursive servers Statistics Multidimensional analysis and statistics of Domestic DNS servers Alarm DNS service failure alarm and service performance trend analysis Domestic Authoritative servers Domestic Recursive servers Domestic Websites monitor or measure Feature

What SDNS-Mon can do DNS real-time heath check report DNS monthly monitor metrics

What SDNS-Mon can do DNS service alarm monitor

What SDNS-Mon can do Domain security status report

What SDNS-Mon can do What SDNS-Mon can do Evaluate the effects of anycast on DNS servers in China Measure DNS servers, covering from dnssec support,recursiveness support, tcp support and so on from multiple location Monitor important domestic and recursive servers in real-time What SDNS-Mon can do

Key technologies of SDNS-Mon Architecture Task dispatch、real-time probe interface Scheduling Node DNS Server Probe node1 MQ WEB Oracle DNS Server API … DNS Server Probe noden MQ Data processing alarm（email） MC Storm SOS2 Hadoop/HIVE

Key technologies of SDNS-Mon Real-time task scheduling policy in heterogeneous environment for better service quality and fault tolerance Dynamic Load balancing policy in heterogeneous environment for better resource utilization Background 61 distributed probe nodes covering three major ISPs in 31 provinces of China, 4 of which are oversea servers, Complex network environment and dynamic load as well as heterogeneous nodes pose challenges for us. In order to gain better service quality and resource utilization, we propose the above solution Task scheduling Policy

Task type Small task：used for probing important domestic domain and recursive as well as website High frequency(every 5 min) 100 million rows daily Big task：used for achieving dns probe in batch Low frequency(every 1 month) 1 billion rows monthly Real-time task：used for real-time probing of monitoring items of given targets

Central Scheduling Node Scheduling Model 1. For small task scheduling, we adopt a push mode as below Central Scheduling Node Probe Node Probe Node Probe Node Probe Node

Central Scheduling Node Scheduling Model 1. For big task scheduling, we adopt a pull mode as below Central Scheduling Node Probe Node Probe Node Probe Node Probe Node

Central Scheduling Node Scheduling Model 1. For real-time task scheduling, we use a push mode depending on hash function computing plus multiple nodes scheduling for better service quality Probe Node Hash Function Probe Node Central Scheduling Node Probe Node Heart beat Probe Node Probe Node Probe Node

The summary of scheduling policy module Advantage Versatility scalability Modularization Disadvantage single point of failure

Monitor Metrics Availability DNSSEC support NSEC3 support DNSSEC algorithms IPv6 support TCP support TTL Abundant Version answer support Response time Operation system type and version EDNS0 support Wild support …

Key technologies of SDNS-Mon Independent algorithms development for 40 monitor metrics from 5 dimensions A hierarchal storage schema for dns monitor metrics Background In order to monitor and analyze DNS from 5 dimensions including service failure, configuration, performance, network flow and security, we independently develop algorithms for 40 monitor metrics and at the same time, we propose a storage schema according to business requirement Monitor Algorithms and storage model

Storage Hierarchical for different applications Oracle Online statistic 5 mins period Real-time MQ 1 day period Hive Offline statistic Alarm processing

Thank you!