Methods, systems, and products for monitoring domain name servers

• US 10,250,554 B2
• Filed: 02/18/2017
• Issued: 04/02/2019
• Est. Priority Date: 08/26/2012
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Yan, He, Ge, Zihui, Gerber, Alexandre, Spatscheck, Oliver
• Primary Examiner(s): Nguyen, Thanh T
• Application Number:
  US15/436,770
• Publication Number:
  US 20170163596A1
• Time in Patent Office: 773 Days
• Field of Search: 709224, 709220, 37039552, 705 39, 705 55, 705 1445, 711118
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/58 Caching of addresses or names

Abstract

Methods, systems, and products infer performance of a domain name system. Queries to, and responses from, the domain name system are logged and categorized. Each category is associated with a different performance issue related to the domain name system. The number of entries in each category may be used to infer the performance of the domain name system.

Claims

1. A method, comprising:

capturing, by a server, a query requesting a domain name resolution of a domain name;

capturing, by the server, a response to the query, the response generated after performing the domain name resolution;

determining, by the server, a response time of the domain name resolution exceeds a threshold value;

inferring, by the server, that the domain name was not locally cached based on the response time that exceeds the threshold value;

categorizing, by the server, the response in a single category in which the domain name successfully resolved to an Internet Protocol address; and

uniquely categorizing, by the server, the query in which the domain name failed to resolve according to the domain name resolution.

2. The method of claim 1, further comprising determining that the domain name resolution failed.

3. The method of claim 1, further comprising determining that the domain name was locally cached based on the response time.

4. The method of claim 1, further comprising querying a domain tree.

5. The method of claim 4, further comprising inferring the domain name is locally cached.

6. The method of claim 1, further comprising querying a domain tree for the domain name resolution of the domain name.

7. The method of claim 6, further comprising retrieving an address associated with the domain name.

8. A system, comprising:

a hardware processor; and

a memory device, the memory device storing code, the code when executed causing the hardware processor to perform operations, the operations comprising;

capturing queries requesting a domain name resolution of a domain name;

capturing responses to the queries generated after performing the domain name resolution;

determining response times of the domain name resolution exceed a threshold value;

inferring that the domain name was not locally cached based on the response times of the domain name resolution exceeding the threshold value;

categorizing the responses in a single category in which the domain name successfully resolves to an Internet Protocol address; and

uniquely categorizing the queries in which the domain name fails the domain name resolution.

9. The system of claim 8, wherein the operations further comprise determining that the domain name resolution fails.

10. The system of claim 9, wherein the operations further comprise determining that the domain name is locally stored based on the response times.

11. The system of claim 9, wherein the operations further comprise determining the response times are less than the threshold time.

12. The system of claim 11, wherein the operations further comprise inferring the domain name is locally stored based on the response times less than the threshold time.

13. The system of claim 8, wherein the operations further comprise querying a domain tree for the domain name resolution of the domain name.

14. The system of claim 13, wherein the operations further comprise retrieving an address associated with the domain name.

15. A memory device storing instructions that when executed cause a processor to perform operations, the operations comprising:

capturing queries requesting a domain name resolution of a corresponding domain name;

capturing responses to the queries generated after performing the domain name resolution;

determining response time of the domain name resolution exceeds a threshold value;

inferring that the corresponding domain name was remotely cached based on the response time exceeding the threshold value;

categorizing all the responses in a single category in which the corresponding domain name successfully resolves to a corresponding Internet Protocol address; and

uniquely categorizing the queries in which the corresponding domain name fails the domain name resolution.

16. The memory device of claim 15, wherein the operations further comprise determining that the domain name resolution fails.

17. The memory device of claim 16, wherein the operations further comprise determining that the corresponding domain name is locally stored based on the response time.

18. The memory device of claim 16, wherein the operations further comprise determining the response time is less than the threshold time.

19. The memory device of claim 18, wherein the operations further comprise inferring the corresponding domain name is locally stored based on the response time less than the threshold time.

20. The memory device of claim 15, wherein the operations further comprise querying a domain tree for the domain name resolution of the corresponding domain name.