Method and server for managing traffic-overload on a server

• US 10,021,176 B2
• Filed: 12/08/2015
• Issued: 07/10/2018
• Est. Priority Date: 01/07/2015
• Status: Active Grant

• Current Assignee: Efficient IP SAS
• Original Assignee: Efficient IP SAS
• Inventors: Galliano, Sylvain, Bisiaux, Jean-Yves
• Primary Examiner(s): Barot, Bharat N
• Application Number:
  US14/962,528
• Publication Number:
  US 20160197989A1
• Time in Patent Office: 945 Days
• Field of Search: 709202-203, 709223-224
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/101 based on network conditions
• CPC Class Codes: H04L 67/1036 Load balancing of requests to servers for services different from user content provisioning, e.g. load balancing across domain name servers
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/59 Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70

Abstract

Method(s) and System(s) for managing traffic-overload on Domain Name System (DNS) server during a network overload are described. The described system(s) may implement method(s) that include monitoring of traffic associated with the DNS server and identifying an occurrence of an event. Thereafter, activating (deactivating) a rescue mode and implementing one or more policies for handling the traffic during the rescue mode. In implementing the one or more policies, the method includes segregating the traffic into three sets of requests based on availability of responses in a cache, and a Time to Live (TTL) associated with the responses. Further, the method includes processing a first set of requests for which corresponding responses stored in the cache have expired based on TTL of corresponding responses. Furthermore, the method includes transmission of the corresponding responses with expired data to the client devices.

Claims

1. A method for managing traffic-overload in a DNS server during a network overload, the method comprising:

monitoring traffic associated with the DNS server, wherein the traffic includes at least one of a plurality of requests received by the DNS server and a plurality of responses transmitted by the DNS server;

identifying an occurrence of an event to trigger a rescue mode, wherein the rescue mode enables implementation of at least one policy for handling of the traffic associated with the DNS server; and

implementing the at least one policy upon occurrence of the event, for handling the traffic, wherein the at least one policy comprises;

segregating the plurality of requests into a first set of requests, a second set of requests, and a third set of requests based on availability of responses in a cache corresponding to the plurality of requests, and a Time to Live (TTL) associated with the responses, wherein the cache is associated with the DNS server;

processing, without communicating with a backend server, the first set of requests from amongst the plurality of requests for which a first set of responses stored in the cache has expired based on the TTL, wherein the first set of responses include at least one response for each request from amongst the first set of requests; and

transmitting the first set of responses to a plurality of client devices, wherein the first set of responses includes expired data.

2. The method as claimed in claim 1, wherein the at least one policy further comprises processing the second set of requests from amongst the plurality of requests for which a second set of responses are available in the cache, wherein the second set of responses includes at least one response for at least one request from amongst the second set of requests.

3. The method as claimed in claim 1, wherein the at least one policy further comprises forwarding the third set of requests from amongst the plurality of requests to the backend server, wherein the backend server is utilized for processing the third set of requests, and wherein a third set of responses for the third set of requests is unavailable in the cache associated with the DNS server, and wherein the third set of responses includes at least one response for at least one request from amongst the third set of requests.

4. The method as claimed in claim 3, wherein forwarding the third set comprises selecting the backend server based on at least one of a round trip time of the backend server in responding to the requests of the DNS server and a load on the backend server.

5. The method as claimed in claim 1, wherein the event is one of receiving at least one user command, at least one automatic command, at least one programmable command in relation with a third party, non-functioning of another server linked to the DNS server, and at least one of the plurality of requests received by the DNS server and the plurality of responses transmitted by the DNS server exceeding a predetermined threshold.

6. The method as claimed in claim 5, wherein the predetermined threshold is at least one of about 200000 of query per second (QPS) for the plurality of requests, and about 5000 QPS for the plurality of responses, and a ratio between outgoing requests and incoming responses.

7. The method as claimed in claim 1, wherein the TTL is one of a short TTL, a fixed TTL, a programmable TTL and a TTL correlated with a specific event.

8. The method as claimed in claim 1, wherein the network overload corresponds to at least one of a non-malicious overload, a payload, a network attack, a Denial of Service (DoS) attack and a Distributed Denial of Service (DDoS) attack on the DNS server.

9. The method as claimed in claim 3 further comprising:

receiving the third set of responses from the backend server, wherein the third set of responses corresponds to the third set of requests forwarded to the backend server, and wherein the third set of responses includes at least one response for at least one request from amongst the third set of requests; and

storing the third set of responses in the cache associated with the DNS server.

10. A DNS server for managing traffic-overload, the DNS server comprising:

a processor;

a traffic monitoring module coupled to the processor, wherein the traffic monitoring module is to monitor traffic associated with the DNS server, wherein the traffic includes at least one of a plurality of requests received by the DNS server and a plurality of responses transmitted by the DNS server;

an analytics module coupled to the processor, wherein the analytics module is to;

identify an occurrence of an event to trigger a rescue mode, wherein the rescue mode enables implementation of at least one policy for handling of the traffic associated with the DNS server; and

implement the at least one policy upon occurrence of the event, for handling the traffic, wherein the at least one policy comprises;

segregate the plurality of requests into a first set of requests, a second set of requests, and a third set of requests based on availability of responses in a cache corresponding to the plurality of requests, and a Time to Live (TTL) associated with the responses, wherein the cache is associated with the DNS server;

process without communicating with a backend server, the first set of requests from amongst the plurality of requests for which a first set of responses stored in the cache has expired based on the TTL, wherein the first set of responses include at least one response for each request from amongst the first set of requests;

a communication module coupled to the processor, wherein the communication module is to transmit the first set of responses to a plurality of client devices, wherein the first set of responses includes expired data.

11. The DNS server as claimed in claim 10, wherein the analytics module is to:

compare the traffic with a predetermined threshold to identify the occurrence of the event to trigger the rescue mode, wherein the event is identified in response to at least one of the plurality of requests received by the DNS server and the plurality of responses transmitted by the DNS server exceeding the predetermined threshold; and

select the backend server based on at least one of a round trip time of the backend server in responding to the requests of the DNS server and a load on the backend server.

12. The DNS server as claimed in claim 10, wherein the communication module is to:

forward the third set of requests from amongst the plurality of requests to the backend server, wherein a third set of response is unavailable in the cache associated with the DNS server, wherein the backend server is utilized for processing the third set of requests, and wherein the third set of responses includes at least one response for at least one request from amongst the third set of requests;

receive the third set of responses from the backend server corresponding to the third set of requests; and

store the third set of responses in the cache associated with the DNS server.

13. The DNS server as claimed in claim 10, wherein the event is one of receiving at least one user command, at least one automatic command, at least one programmable command in relation with a third party, non-functioning of another server linked to the DNS server, and at least one of the plurality of requests received by the DNS server and the plurality of responses transmitted by the DNS server exceeding a predetermined threshold.

14. The DNS server as claimed in claim 10, wherein the TTL is one of a short TTL, a fixed TTL, a programmable TTL and a TTL correlated with a specific event.