Monitoring DNS with Open-Source Solutions
summary
NIC Chile manages ~3,000 DNS qps per server and builds a real‑time monitor by integrating open‑source pieces rather than custom Hadoop stacks. Capture uses a custom pcap-based collector with IP fragment reassembly and TCP assembly; storage uses ClickHouse for storage after benchmarks against Prometheus, Druid, InfluxDB and Elasticsearch showed far lower CPU/RAM and subsecond query latency at 3k–10k qps. Visualization runs on Grafana/Kibana, alerts plug into the pipeline, and a 36‑hour 7k qps run stores and compresses terabytes of samples.
AI-written summary · about
chapters (7)
- 0:00Introduction to DNS monitor
- 2:39Limitations of current tools
- 4:54Designing the new system
- 7:47Database benchmark results
- 10:05System architecture and output
- 12:52Attack detection capability
- 14:52Conclusion and Q&A
related talks
37mPerformance Testing of DNS Servers
27mRapsheet: Continuous HTTP and DNS monitoring
08mNetwork Performance Monitoring
34mIt’s Always DNS: So Let’s Break It On Purpose
29mDNS: Old Solution for Modern Problems
Monitoring Cloudflare's Planet-Scale Edge Network
59mCatching Malware En Masse: DNS and IP Style
26mMisuse of DNS, the Second Most Used Protocol