KR100788130B1 - Method and system for CPU utilization management in DNS server - Google Patents

Abstract

The present invention discloses a method and a management system for managing the DNS server so that the CPU utilization rate does not exceed the limit.

The CPU utilization management method of the DNS server of the present invention includes a first step of collecting TCP packets between the DNS server and the clients for a predetermined time; Identifying a TCP connection corresponding to each of the collected TCP packets and classifying the corresponding TCP connections by type; Obtaining a distribution of the classified TCP connections by their characteristics and corresponding IP addresses of the clients; And a fourth step of blocking or restricting traffic from the IP address by searching for the IP address having the greatest delay among the distributions of the third step, and finding an element affecting the CPU utilization rate of the DNS server. By eliminating the problem, the DNS server can be operated normally by preventing the CPU utilization from rising above the limit in advance.

Description

CPU utilization rate management method of DNA server and its utilization rate management system {Method and system for CPU utilization management in DNS server}

1 shows a TCP connection to a normal DNS query between a client and a server.

2A-2D illustrate examples of abnormal TCP connections.

3 is a configuration diagram showing the configuration of the CPU utilization management system of the DNS server of the present invention.

4 is a flowchart for explaining a CPU utilization management method in the management system of FIG.

FIG. 5 is a flowchart for explaining in more detail the steps of classifying TCP connections in FIG. 4; FIG.

The present invention relates to a method of managing CPU utilization of a DNS (Domain Name Server) and a management system thereof. More particularly, the present invention relates to analyzing a TCP packet of a DNS server to find a user terminal affecting the performance of the DNS server. The present invention relates to a method of managing CPU utilization, which prevents the CPU utilization rate of the server from increasing by limiting traffic from the terminal, and a management system using the method.

DNS is the most important interface between the user and the Internet network. It is responsible for translating the domain name entered by the user into an IP address. This DNS server must be managed with reasonable performance without interruption, so that users are not restricted from access to the Internet.

The traffic of DNS server is composed of DNS query and answer. DNS query is a question mainly related to domain name or IP address from user terminal.

DNS queries can use User Datagram Protocol (UDP) datagrams or Transmission Control Protocol (TCP) connections, with over 90% using UDP datagrams.

Conventionally, a method of controlling CPU utilization by adjusting the inflow amount according to the traffic amount flowing into the DNS server is used.

However, the actual CPU utilization rate of the DNS server is often independent of the amount of traffic flowing into the DNS server.Therefore, there is a problem that the CUP utilization rate cannot be effectively managed by the conventional method. You need a form of approach.

Accordingly, an object of the present invention to solve the above-mentioned problem is to classify and manage TCP traffic between DNS server and clients to find out the factors affecting CPU utilization of DNS server and to remove the factors, thereby limiting CPU utilization. This is to prevent the above rise in advance so that the DNS server can operate normally.

The CPU utilization management system of the DNS server of the present invention for achieving the above object, when the CPU utilization rate of the DNS server exceeds a predetermined utilization threshold, collecting TCP traffic between the DNS server and the client to remove the abnormal TCP connections Load monitoring outputting control signals for controlling traffic inflow with the searched IP addresses after searching for IP addresses which have the most influence on CPU utilization by classifying by characteristics and IP addresses of the clients corresponding to each characteristic And a management server; And switching TCP traffic flowing into the DNS server at a front end of the DNS server, and selectively blocking or restricting traffic having the retrieved IP address according to the control signal from the load monitoring and management server. With a switch.

The CPU utilization management method of the DNS server of the present invention includes a first step of collecting TCP packets between the DNS server and the clients for a predetermined time; Identifying a abnormal TCP connection in each of the collected TCP packets and classifying the corresponding TCP connections by type; Obtaining a distribution of the classified TCP connections by their characteristics and corresponding IP addresses of the clients; And a fourth step of searching for an IP address having the greatest delay among the distributions of the third step and blocking or restricting traffic having the corresponding IP address from flowing into the DNS server.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

First, when the correlation between the DNS server traffic and the CPU utilization rate, as shown in Table 1, even if some TCP traffic is present in the DNS server, the CPU utilization rate of the server is much higher.

 Server farm Traffic (PPS) CPU load (%) DNS server 1 DNS server 2 DNS server 1 DNS server 2 UDP TCP UDP A 1680 20 1680 20 4 B 1700 160 1600 90 5 C 1800 20 1800 30 5 D 900 30 900 72 2

In Table 1, A, B, C, and D represent server farms connecting multiple servers to one load balancing switch, and DNS servers 1 and 2 represent respective server farms (A, B, C, The DNS servers connected to D) are shown. DNS server 1 handles TCP and UDP traffic at the same time, while DNS server 2 processes only UDP traffic. In the present embodiment, only traffic using port 53 is allowed to flow into the load balancing switch, and only DNS related traffic is introduced into the DNS server.

Therefore, as shown in Table 1, since the TCP traffic greatly affects the CPU utilization rate of the server, the present embodiment analyzes the TCP packet of the DNS server to find the user terminal affecting the performance of the DNS server, By limiting traffic, the server's CPU utilization is prevented from increasing.                     

1 shows a TCP connection to a normal DNS query between a client and a server.

 To attempt a TCP connection, the client sends a SYN message to the server. In response, the server sends a SYN + ACK message to the client and stores information about the connection in progress on the stack. The TCP connection is then made by sending a ACK message to the server for the SYN + ACK message.

After a TCP connection is made, the client sends a DNS query to the server, which sends a DNS response to the client. At this time, except for the initial SYN packet, all the packets that have established a connection have the ACK bit set.

When the DNS query and the response exchange are completed, the TCP connection is terminated. The connection is terminated by generating a FIN packet from the terminal (client or server) and transmitting it to the counterpart terminal. In addition, although not shown, if a terminal generates a RESET packet and transmits it to the counterpart terminal, the connection is immediately terminated regardless of the TCP packet sequence.

However, when abnormal TCP connections are generated as shown in FIGS. 2A to 2D, the CPU utilization of the DNS server is greatly affected.

FIG. 2A illustrates a TCP connection in which ACK packets are repeated. The DNS server generates 9 ACK packets and then terminates the connection by transmitting RESET packets. Since the ACK packet is transmitted at 75 second intervals, the repetition of the ACK packet causes a long delay time, and the delay due to the repetition of the ACK packet tends to be high in the number of TCP connections and packets. This delay is caused intensively from a particular user terminal.

2B is a TCP connection in which a ServFail packet is repeated. When the DNS server cannot send a proper response to the client, the ServFail packet is sent. If the client sends an ACK packet to the server, the connection is terminated normally. However, if the client does not respond to the ServFail packet, the server continues to send the ServFail packet to the client, which affects the delay and CPU utilization. In this case, although the ratio of the total number of TCP packets and connections is small, the connection latency is long.

2C is a TCP connection in which a FIN packet is repeated. This is also the case in which the FIN packet is repeatedly transmitted because the client does not transmit the ACK packet even though the server sends the FIN packet. This connection has a low incidence but long delay of 186 seconds.

2D is a TCP connection in which SYN packets are repeated. The client sent a RESET packet at the beginning of a TCP connection, but the DNS server delayed the termination by sending SYN packets repeatedly. These connections make up the largest percentage of non-terminating TCP connections, with one user concentrated on each server, which is a SYS attack using TCP port 53.

The present invention is to detect such abnormal TCP connections to limit the traffic of the user terminal.

3 is a configuration diagram showing the configuration of the CPU utilization management system of the DNS server of the present invention.

The CPU utilization management system of the present invention includes a load monitoring and management server 10 and a load balancing switch 20.

The load monitoring and management server 10 compares the CPU utilization of the DNS server 40 with a preset utilization threshold and collects TCP traffic between the DNS server 40 and the clients 30 when the current utilization exceeds the threshold. Classify unconnected TCP connections by their characteristics. Next, the load monitoring and management server 10 reclassifies the classified TCP connections by the IP addresses of the clients 30 to search for the IP which has the greatest influence on the CPU utilization of the DNS server 40, and then load balances them. Command 20 to block or limit traffic from the IP.

The load balancing switch 20 is installed between the clients 30 and the DNS server 40 to transmit traffic between the clients 30 and the DNS server 40 under the control of the load monitoring and management server 10. Switch.

FIG. 4 is a flowchart for describing a CPU utilization management method in the management system of FIG. 3.

First, the load monitoring and management server 10 sets in advance a threshold value of the CPU utilization rate at which the DNS server 40 can operate normally (step 410), and then at the current CPU utilization rate and the step 410 of the DNS server 40. The set CPU utilization thresholds are compared (step 420).

As a result of the comparison of step 420, if the current CPU utilization is not greater than the preset CPU utilization threshold, the load monitoring and management server 10 does not apply the CPU utilization management method according to the present invention, CPU utilization rate of the DNS server 40 It constantly monitors and maintains the current operating state.

However, if the current CPU utilization exceeds the predetermined CPU utilization threshold, the load monitoring and management server 10 transmits and receives between the DNS server 40 and the clients 30 for a predetermined time (eg, 5 minutes). Collect the received TCP packets (step 430).

When the TCP packet collection is completed, the load monitoring and management server 10 reads the collected TCP packets one by one to identify whether the packet is for a newly generated connection or packets for an existing connection. The TCP connections are classified by types according to the characteristics of the received packets (step 440).

Next, in order to find out the factors influencing the CPU utilization of the DNS server, the load monitoring and management server 10 checks the TCP characteristics and the connection for each client IP address as shown in Table 2 for the TCP connections classified in step 440. Create an IP address distribution table (step 450).

TCP connection count distribution TCP latency distribution Repeated ServFail xxx.xxx.xxx.xxx-46% ooo.ooo.ooo.ooo-10% aaa.aaa.aaa.aaa-9%… xxx.xxx.xxx.xxx-77% ooo.ooo.ooo.ooo-38%… xxx.xxx.xxx.xxx-66% ooo.ooo.ooo.ooo-22%… Repeated FIN TCP packet count distribution bbb.bbb.bbb.bbb-30% ccc.ccc.ccc.ccc-15% Normal DNS Query xxx.xxx.xxx.xxx-50% aaa.aaa.aaa.aaa-9% ooo.ooo.ooo.ooo-8%… Repeated ACK xxx.xxx.xxx.xxx-68% ooo.ooo.ooo.ooo-15% ddd.ddd.ddd.ddd-9%. xxx.xxx.xxx.xxx-53% ooo.ooo.ooo.ooo-43%…

That is, the load monitoring and management server 10 is the "TCP connection number", "TCP packet number", "TCP connection delay time", and each for each IP address of each client 30 using the DNS server 40 A distribution table is generated by arranging the distribution of TCP connection types (type of abnormal termination and normal DNS query) as shown in Table 2. Of these, the delay time of the TCP connection has the most relation with the CPU utilization of the DNS server, and the delay of the TCP connection has the greatest effect on the TCP connection in which "repeated ACK" and "repeat ServFail" occur as described above. Gives.

Therefore, the load monitoring and management server 10 determines that the IP of the terminal that occupies the highest ratio in the "TCP connection delay time" of the created distribution table generates a lot of inappropriate traffic and has the greatest influence on the CPU utilization. Determine the IP of the server (step 460).

The load monitoring and management server 10 blocks the traffic by instructing the load balancing switch 20 located in front of the DNS server to block or limit the inflow of traffic generated from the corresponding IP (470).

FIG. 5 is a flowchart illustrating the process of step 440 in FIG. 4 in more detail.

The load monitoring and management server 10 reads the TCP packets collected in step 430 of FIG. 4 one by one (step 511). The load monitoring and management server 10 identifies whether the collected packets are for a new TCP connection or for an existing TCP connection if the collected TCP packets have not yet been read (step 512). 513).                     

At this time, the structure holding the TCP connection is "IP address", "port number", "FIN count", "ServFail count", "ACK count", "TCP flag", "start time", "end time" "And" type ". Therefore, the load monitoring and management server 10 reads an array of structures maintaining a TCP connection to determine whether a connection having the same "IP address" and "port number" value exists, and if a connection having the same value exists in the corresponding item. The packet is for an existing TCP connection, otherwise it is for a new TCP connection.

In step 513, if the packet is for a new TCP connection, the load monitoring and management server 10 creates a new structure and adds the TCP connection to the array of structures to generate a new data structure (step 514). At this time, "IP address", "port number", "start time", "TCP flag", etc. are recorded in the new structure, and "end time" is recorded as the time of the current packet.

However, in step 513, if the packet is for an existing TCP connection, the information in the existing data structure is modified (step 515). In other words, the "end time" in the structure is updated to the time of the current packet.

Next, the load monitoring and management server 10 checks whether the existing TCP connection is terminated (step 516), and if it is terminated, records the corresponding TCP connection and deletes the corresponding data structure (step 517). Whether to terminate at step 516 can be determined by whether a FIN packet is generated or whether a RESET packet is generated. However, in the case of RESET, since the DNS server 40 proceeds further after receiving the RESET packet, in step 516, the FIN is determined. It is determined whether the packet is terminated through the generation of the packet. At this time, the load monitoring and management server 10 is generated twice or more FIN packets, and determines that the current TCP packet is terminated when the ACK.

In step 516, if the TCP connection is not terminated, the load monitoring and management server 10 first determines whether the contents of the packet is ServFail in order to classify the type of TCP connection (step 518). If it is determined that the content of the packet is ServFail, the load monitoring and management server 10 increments the ServFail count by one (step 519).

In step 518, if the content of the packet is not ServFail, the load monitoring and management server 10 determines whether the packet is a FIN (step 520). As a result of the determination, if the packet is the FIN, the load monitoring and management server 10 increments the FIN count by one (step 521).

In step 520, if the packet is not a FIN, the load monitoring and management server 10 determines whether both the previous packet and the current packet are ACK (step 522). If the determination result is all ACK, the load monitoring and management server 10 increases the ACK count by one (step 523).

In step 522, if both the previous packet and the current packet are not ACK, the load monitoring and management server 10 determines whether the packet is a DNS query (step 524). If it is determined that the packet is a DNS query, the load monitoring and management server 10 records the packet as a normal query (step 525).

The operations of steps 518 to 525 described above proceed until all the collected packets are read. In step 512, if no TCP packets are present, the load monitoring and management server 10 terminates with unterminated TCP connections and RESET. The associations are classified and recorded (step 526). At this time, if the ServFail count is 2 or more, "Repeat ServFail" in the item of Table 2, if the FIN count is 2 or more, "Repeat FIN", if the packet ends with SYN, "Repeated SYN", and the ACK count is 2 If greater, each is classified as a "repeatable ACK."

Information about each of these classified TCP connections is recorded in a separate storage device.

Through this process, the characteristics of each TCP connection can be known. In particular, the time at which the packets constituting the TCP connection are first shown in step 519 and the time at which the packet was last shown are shown at the start and end times of the connection. The time difference can be used to calculate the delay time of the TCP connection. In addition, TCP connections that are not terminated wait for some time after the DNS server 40 sends or receives the last packet. Since the values are different for each operating system used by the DNS server 40, the TCP connection is added to the TCP connection. Calculate the delay time.

As described above, the CPU utilization management method of the DNS server of the present invention classifies and manages the TCP traffic between the DNS server and the clients to find out the factors affecting the CPU utilization of the DNS server and to remove the factors. This prevents the DNS server from operating normally by preventing it from going above the limit.

Claims (8)

When the CPU utilization rate of the DNS server exceeds a preset utilization limit, TCP traffic between the DNS server and the clients is collected, and abnormal TCP connections are classified by their characteristics and IP addresses of the clients corresponding to the characteristics, and among them, the CPU A load monitoring and management server for searching for an IP address having the most influence on the utilization rate, and outputting a control signal for controlling traffic inflow with the found IP address; And A load balancing switch provided at the front end of the DNS server for switching TCP traffic flowing into the DNS server, and selectively blocking or restricting traffic having the retrieved IP address according to the control signal from the load monitoring and management server. CPU utilization rate management system of the DNS server having a. According to claim 1, wherein the load monitoring and management server The CPU utilization management system of the DNS server, characterized in that the IP of the terminal having the highest TCP connection latency ratio among the TCP connections as the IP having the most influence on the CPU utilization.  A first step of collecting TCP packets between the DNS server and the clients for a predetermined time; Identifying a abnormal TCP connection in each of the collected TCP packets and classifying the corresponding TCP connections by type; Obtaining a distribution of the classified TCP connections by their characteristics and corresponding IP addresses of the clients; And And a fourth step of searching for an IP address having the greatest delay among the distributions of the third step and blocking or restricting traffic having the corresponding IP address from flowing into the DNS server. The method of claim 3, wherein the first step Comparing the current CPU utilization of the DNS server with a preset utilization threshold and collecting TCP packets when the current CPU utilization exceeds the utilization threshold. The method of claim 3, wherein the second step A method of managing CPU utilization of a DNS server, characterized by classifying unterminated TCP connections by their type. The method of claim 5, wherein the TCP connection is terminated or not CPU usage ratio management method of the DNS server, characterized in that it is determined based on whether the FIN packet is generated in the TCP connection. The method of claim 3, wherein the third step And calculating the TCP connection number distribution, TCP packet number distribution, TCP connection delay time distribution, and distribution for each TCP connection type for each IP address of each client. The method of claim 7, wherein each TCP connection type distribution is A method for managing CPU utilization of a DNS server, characterized by obtaining distributions for repeated FIN, repeated ServFail, repeated ACK, repeated SYN, and normal DNS queries.

Images