Methods, systems, and products for monitoring domain name servers

• US 9,608,886 B2
• Filed: 08/26/2012
• Issued: 03/28/2017
• Est. Priority Date: 08/26/2012
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Yan, He, Ge, Zihui, Gerber, Alexandre, Spatscheck, Oliver
• Primary Examiner(s): Nguyen, Tammy
• Application Number:
  US13/594,820
• Publication Number:
  US 20140059208A1
• Time in Patent Office: 1,675 Days
• Field of Search: 709/220, 709/204, 709/223, 709/226, 709/225, 711/118, 726/25
• US Class Current: 1/1
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/106 using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/58 Caching of addresses or names

Abstract

Methods, systems, and products infer performance of a domain name system. Queries to, and responses from, the domain name system are logged and categorized. Each category is associated with a different performance issue related to the domain name system. The number of entries in each category may be used to infer the performance of the domain name system.

Claims

1. A method, comprising:

capturing, by a server, queries sent from devices, each one of the queries requesting a domain name resolution of a corresponding domain name;

capturing, by the server, responses generated after performing the domain name resolution;

summing, by the server, a total number of the queries captured;

determining, by the server, that the corresponding domain name is locally stored;

summing, by the server, a cache number of the queries having the corresponding domain name locally stored;

categorizing, by the server, all the responses in a single category in response to the corresponding domain name successfully resolving to an Internet Protocol address; and

uniquely categorizing, by the server, the queries in which the corresponding domain name fails to match a domain tree.

2. The method of claim 1, further comprising time stamping each one of the queries and each corresponding one of the responses.

3. The method of claim 2, further comprising calculating a response time for the domain name resolution.

4. The method of claim 1, further comprising summing a total number of the queries received.

5. The method of claim 1, further comprising determining a ratio of the cache number to the total number.

6. The method of claim 1, further comprising determining a response time for the domain name resolution exceeds a threshold time.

7. The method of claim 6, further comprising inferring the domain name is not locally stored in response to the response time exceeding the threshold time.

8. A system, comprising:

a processor; and

a memory device, the memory device storing code, the code when executed causing the processor to perform operations, the operations comprising;

capturing a query sent from a device, the query addressed to a domain name service server, and the query requesting domain name resolution of a domain name;

capturing a response to the query, the response sent from the domain name service server to the device after performing the domain name resolution;

adding an entry to an electronic map, the electronic map having electronic associations between different queries to the domain name service server and different responses, the entry electronically associating the query to the response and to the domain name;

summing a total number of the different queries to the domain name service server;

summing a cache number of the different queries having a corresponding domain name locally stored;

categorizing the response in a single category in response to the domain name successfully resolving to an Internet Protocol address; and

categorizing the query according to an error code in response to the domain name failing to resolve to the Internet Protocol address.

9. The system of claim 8, wherein the operations further comprise time stamping the query and the response.

10. The system of claim 9, wherein the operations further comprise determining a response time for the domain name resolution.

11. The system of claim 8, wherein the operations further comprise determining a ratio of the cache number to the total number.

12. The system of claim 8, wherein the operations further comprise determining a response time for the domain name resolution exceeds a threshold time.

13. The system of claim 12, wherein the operations further comprise inferring the domain name is not locally stored when the response time exceeds the threshold time.

14. A memory device storing instructions that when executed cause a processor to perform operations, the operations comprising:

capturing queries sent to a domain name service server, each one of the queries sent from a device requesting domain name resolution for a corresponding domain name;

capturing responses to the queries sent from the domain name service server generated after performing the domain name resolution;

adding entries to an electronic map, the electronic map having electronic associations between the queries to the domain name service server and the responses, each entry of the entries electronically associating a corresponding query to a corresponding response and to the corresponding domain name;

summing a total number of the queries captured;

summing a cache number of the queries having the corresponding domain name locally stored;

if the corresponding response indicates the corresponding domain name successfully resolves to an Internet Protocol address, then categorizing the corresponding response in a single category; and

if the corresponding response indicates the corresponding domain name failed to resolve to the Internet Protocol address, then categorizing the corresponding query according to an error code.

15. The memory device of claim 14, wherein the operations further comprise:

determining a response time for the domain name resolution exceeds a threshold time; and

inferring the domain name is not locally stored when the response time exceeds the threshold time.