Domain name resolution method, DNS (Domain Name Server) server and system

Abstract

The invention discloses a domain name resolution method, a DNS (Domain Name Server) server and a system. The method comprises the following steps of: after the DNS server receives a domain name resolution request initiated by an accessed user, a corresponding DNS response message is obtained; when the obtained DNS response message is a disconnected DNS response message based on a UDP (User Datagram Protocol), a value of a specified zone bit is set in the DNS response message to generate a DNS response message after change; after the value of the specified zone bit is set to indicate that the accessed user receives the DNS response message after change, the domain name resolution request initiated in a TCP (Terminal Control Protocol) mode is cancelled and the DNS response message after change is returned to the accessed user. By adopting the scheme, the domain name resolution search based on the TCP mode is avoided, therefore, the system can not be attacked by the TCP mode, the DDOS (Distributed Denial of Service) attack resisting capability of the system is effectively increased, and the domain name resolution efficiency of the system is improved.

Description

technical field [0001] The present invention relates to the field of IP (Internet Protocol, Internet Protocol) network, in particular to a domain name resolution method, DNS (Domain Name Service, domain name service) server and system in the IP network. Background technique [0002] In the IP (Internet Protocol, Internet Protocol) network, the main function of DNS (Domain Name Service, domain name service) is to convert the domain name (Domain Name) that is easy for people to remember and the IP address that the network can recognize. The conversion between domain name and IP address is called domain name resolution, and the network host that performs domain name resolution can be called DNS server. [0003] In the prior art, DNS provides three domain name resolution methods: local query, cache query and iterative query. If an access user of an ISP (Internet Service Provider, Internet Service Provider) enters a website domain name in a browser, the access user initiates a d...

AI Technical Summary

Problems solved by technology

[0015] SYN-Flood attack is the most classic denial-of-service attack. It takes advantage of a flaw in the implementation of the TCP protocol. By sending a large number of attack packets with forged source addresses to the port where the network service is located, it may cause a half-open connection in the target server. The queue is full, preventing other legitimate users from accessing

[0016] ACK Flood attack is after the TCP connection is established, all data transmission TCP packets are with the ACK flag bit, the server needs to do two processing: look up the table, respond to ACK / RST, a high number of ACK Flood will cause the server network card The interrupt frequency is too high, the load is too heavy and it stops responding

Images