[Pdns-users] Query Logging

[Brad Knowles]

At 12:16 PM -0700 2005-09-29, Max Clark wrote:

>  So then crazy question... Companies like UltraDNS, Netriplex, DNSMadeEasy,
>  etc... make money based on the number of queries a particular domain/RR
>  gets. How do they track this?

	First off, I don't believe that they make money based on the 
number of queries received.  I'm sure they make money on a per-domain 
basis, and they probably have classes of service, which are 
presumably roughly based on traffic generated -- but only roughly.


	However, if they do track this sort of stuff at all, then (based 
on past experience), they most likely track it using "span" and 
"mirror" ports on switches, which direct copies of all packets coming 
in to given server addresses to one or more alternative destination 
ports.

	On those alternate ports, they run dedicated network sniffer 
devices (basically, a customized version of tcpdump), which have a 
database of all the domains and records served by a given set of 
servers, and counters for each of those domains and records.  Note 
that this means that they almost never do any disk I/O, except to 
load in the data about the domains/records being served.

-- 
Brad Knowles, <brad at stop.mail-abuse.org>

"Those who would give up essential Liberty, to purchase a little
temporary Safety, deserve neither Liberty nor Safety."

     -- Benjamin Franklin (1706-1790), reply of the Pennsylvania
     Assembly to the Governor, November 11, 1755

   SAGE member since 1995.  See <http://www.sage.org/> for more info.