Case
DNS filtering at about 63,000 queries a second
Deze case is voorlopig alleen in het Engels beschikbaar.
Samenvatting
Het probleem
The ISP had to block malware and phishing domains and apply blocklists it was required to enforce, on resolvers that answer every subscriber’s queries, and it had no view of what was being queried or blocked.
Wat we deden
Built a platform around Knot Resolver: a policy module that checks each query against threat and category lists held in memory-mapped databases, list sync with incremental zone updates, query logs streamed through a message queue into a column store, and a web console for policies, lists and analytics. Deployed on an anycast pair of resolvers.
Resultaat
In production on two anycast resolvers at about 63,000 queries per second, with a 79% cache hit rate and blocking and query logging on both.
Meer in detail
- Toegestane queries
- Geblokkeerde queries
- Tegengehouden door uw beleid
Fast enough to forget about
Filtering on the resolver only works if subscribers never notice it. The lists live in memory-mapped databases next to each resolver process, so a lookup is a local read, and list updates arrive as incremental changes rather than full reloads.
Seeing what happens
Every query can be logged from the resolver’s dnstap stream, through a message queue, into a column store where it stays searchable. The console’s analytics and the anomaly detection both read from there.
This platform is now a Coplango product: see Nameward.