Domain name resolution path determination method and device, equipment, storage medium and product

Abstract

The embodiment of the invention provides a domain name resolution path determination method and device, equipment, a storage medium and a product. The method comprises the following steps: acquiring an internet protocol address IP of a target server; generating a prefix part of the second-level domain name according to the IP address of the target server; splicing the prefix part with the secondary domain name to determine a detection domain name of the target server; controlling the client to send an analysis request for the detection domain name to a target server, so that the target server sends a request data packet to an authoritative server; receiving all request data packets sent by the authoritative server, and screening all request data packets according to the detection domain name to obtain a first target data packet; judging whether a source address in the first target data packet is consistent with a target server IP; and if the source address is consistent with the IP of the target server, determining that the analysis path is composed of the client, the target server and the authoritative server. The method is used for achieving the effect of comprehensively restoring the recursive analysis path.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, equipment, storage medium and product for determining a domain name resolution path. Background Art

[0002] DNS (Domain Name System) is responsible for converting user-friendly domain names into IP addresses that computers can understand. Any delay or failure in the resolution process may result in slow or inaccessible access. Therefore, determining the DNS resolution path and protecting this path are crucial to ensuring network security.

[0003] In the prior art, DNS recursive resolution path detection sends a DNS resolution request to a target server, and then compares the target server address with the source address received by the authoritative server to determine the entry server and exit server involved in the recursive resolution process.

[0004] However, this method cannot identify whether there are other devices between the entry and exit servers, and the DNS resolution path is incomplete, which affects the network security of the resolution chain. Summary of the invention

[0005] The domain name resolution path determination method, apparatus, device, storage medium and product provided in the embodiments of the present application are used to achieve the effect of fully restoring the recursive resolution path.

[0006] In a first aspect, an embodiment of the present application provides a method for determining a domain name resolution path, which is applied to a computer device, and includes: obtaining an Internet Protocol address IP of a target server; generating a prefix part of a second-level domain name based on the IP address of the target server, wherein the second-level domain name is pre-registered by a user at a domain name registrar; concatenating the prefix part with the second-level domain name to determine a detection domain name of the target server; controlling a client to send a resolution request for the detection domain name to the target server, so that the target server sends a request data packet to an authoritative server; receiving all request data packets sent by the authoritative server, and screening all request data packets based on the detection domain name to obtain a first target data packet; determining whether a source address in the first target data packet is consistent with the target server IP; if the source address is consistent with the target server IP, determining that the resolution path is composed of the client, the target server, and the authoritative server.

[0007] In a possible implementation, after determining whether the source address in the first target data packet is consistent with the target server IP, it also includes: if the source address is inconsistent with the target server IP, obtaining the extended client subnet ECS information from the first target data packet; judging whether the IP of the detection node is consistent with the target server IP according to the subnet information of the detection node in the ECS information; if the detection node IP is consistent with the target server IP, determining that the resolution path is composed of the client, the target server, the export server and the authoritative server; wherein the target server receives the resolution request for the detection domain name sent by the client, and forwards the resolution request to the export server, and the export server interacts with the authoritative server.

[0008] In a possible implementation, after determining whether the IP of the detection node is consistent with the target server IP, it also includes: if the IP of the detection node is inconsistent with the target server IP, continue to determine whether the IP of the detection node is consistent with the IP of the client; if the IP of the detection node is consistent with the IP of the client, determine that the target server includes an entry IP and an exit IP; wherein the entry IP receives the resolution request for the detection domain name sent by the client, and the exit IP interacts with the authoritative server.

[0009] In a possible implementation, a prefix portion of a secondary domain name is generated based on a target server IP address, including: representing the target server IP in hexadecimal to generate a hexadecimal expression; generating a timestamp based on a preset detection start time; hashing data obtained by concatenating the hexadecimal expression and the timestamp, and determining a value of a preset number of bits as a random suffix; and concatenating the hexadecimal expression, the timestamp, and the random suffix in a preset order to obtain the prefix portion of the secondary domain name.

[0010] In a possible implementation, after continuing to determine whether the IP of the detection node is consistent with the IP of the client, it also includes: if the IP of the detection node is inconsistent with the IP of the client, determining that the resolution path at least includes the client, the target server, a middleware, the export server and the authoritative server.

[0011] In a possible implementation, after continuing to determine whether the IP of the detection node is consistent with the IP of the client, it also includes: iteratively executing the step of "for the IP of the detection node, using a preset network sniffer to analyze network traffic to obtain all data packets of the detection node; according to the detection domain name, all data packets are screened to obtain a second target data packet, and the IP of the detection node in the ECS information is obtained from the second target data packet" until the source address in the second target data packet is consistent with the target server IP, or the IP of the detection node in the ECS information obtained in the second target data packet is consistent with the target server IP, or the IP of the detection node in the ECS information obtained in the second target data packet is consistent with the IP of the client; determine that the resolution path includes the client, the target server, multiple middleware, the export server and the authoritative server.

[0012] In a second aspect, an embodiment of the present application provides a domain name resolution path determination device, which is applied to a computer device, including:

[0013] The data acquisition module is used to obtain the Internet Protocol address IP of the target server.

[0014] The domain name prefix generation module is used to generate the prefix part of the secondary domain name according to the target server IP address, wherein the secondary domain name is pre-registered by the user at the domain name registrar.

[0015] The detection domain name determination module is used to concatenate the prefix part with the secondary domain name to determine the detection domain name of the target server.

[0016] The control data packet sending module is used to control the client to send a resolution request for the detection domain name to the target server, so that the target server sends a request data packet to the authoritative server.

[0017] The data packet receiving module is used to receive all request data packets sent by the authoritative server and screen all request data packets according to the detected domain name to obtain the first target data packet.

[0018] The source address determination module is used to determine whether the source address in the first target data packet is consistent with the target server IP.

[0019] The resolution path determination module is used to determine that the resolution path consists of the client, the target server and the authoritative server if the source address is consistent with the target server IP.

[0020] In a third aspect, an embodiment of the present application provides a computer device, including: a memory, a processor;

[0021] Memory stores computer-executable instructions;

[0022] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0023] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0024] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0025] The domain name resolution path determination method, device, equipment, storage medium and product provided in the embodiments of the present application, by embedding the Internet Protocol address IP of the target server as the prefix part of the pre-registered secondary domain name into the detection domain name, and controlling the client to send a resolution request for the detection domain name to the target server, can ensure the correlation between the detection domain name and the target server, and improve the efficiency of querying the target data packet in the authoritative server. After the authoritative server receives the request data packet sent by the target server, all request data packets of the authoritative server are obtained, and all request data packets are screened according to the detection domain name to obtain the first target data packet. It is determined whether the source address in the first target data packet is consistent with the target server IP. If it is consistent, it is determined that all devices on the resolution path may include the client, the target server and the authoritative server. The device on the resolution path is determined by comparing the source address in the data packet with the IP address of the target server, thereby improving the efficiency of determining the resolution path. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0027] Figure 1 A schematic diagram of a scenario of a method for determining a domain name resolution path provided in this application;

[0028] FIG2(1) is a flowchart of a method for determining a domain name resolution path provided by the present application;

[0029] FIG2 (2) is a mode 1 of the recursive resolution path provided in an embodiment of the present application;

[0030] FIG2(3) is a second mode of the recursive resolution path provided in an embodiment of the present application;

[0031] FIG2(4) is a third mode of the recursive resolution path provided in an embodiment of the present application;

[0032] FIG2 (5) is a fourth mode of the recursive resolution path provided in an embodiment of the present application;

[0033] Figure 3 A schematic diagram of the structure of a device for determining a domain name resolution path provided in an embodiment of the present application;

[0034] Figure 4 A schematic diagram of the structure of a computer device provided in an embodiment of the present application.

[0035] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0036] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0037] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and corresponding operation entrances shall be provided for users to choose to authorize or refuse.

[0038] First, the terms involved in this application are explained:

[0039] ECS: EDNS Client Subnet, a mechanism that extends the Domain Name System protocol. The ECS extension allows the DNS resolver to append an additional field to the query that includes the subnet information of the user's IP address.

[0040] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail. DNS is responsible for converting user-friendly domain names into IP addresses that can be understood by computers. Any delay or failure in the resolution process may result in slow or inaccessible access. Therefore, determining the DNS resolution path and protecting this path is crucial to ensuring network security. In fact, the recursive resolution process may be participated by multiple devices. The resolver that communicates directly with the client is the entry server, and the one that communicates with the authoritative server is the exit server. There may also be other middleware between the entry server and the exit server to implement the forwarding of DNS resolution requests. In this process, all devices involved in the recursive resolution process constitute a recursive resolution path. In the prior art, DNS recursive resolution path detection sends a DNS resolution request to the target server, and then compares the target server address with the source address received by the authoritative server to determine the entry server and exit server involved in the recursive resolution process. However, this method cannot identify whether there are other devices between the entry server and the exit server, and the DNS resolution path is incomplete, which affects the network security of the resolution chain.

[0041] In response to the above technical problems, the inventors came up with the idea of ​​embedding the target server's Internet Protocol address IP as the prefix of the pre-registered secondary domain name into the detection domain name, controlling the client to send a resolution request for the detection domain name to the target server, and after the authoritative server receives the request data packet sent by the target server, obtaining all request data packets from the authoritative server, and filtering all request data packets according to the detection domain name to obtain the first target data packet. Determine whether the source address in the first target data packet is consistent with the target server IP. If consistent, it is determined that all devices on the resolution path may include the client, the target server, and the authoritative server. By comparing the source address in the data packet with the target server IP address, the efficiency of determining the resolution path is improved.

[0042] Based on the above creative findings, the inventor proposed the technical solution of the present application.

[0043] Figure 1 A schematic diagram of a scenario of a method for determining a domain name resolution path provided in this application. Figure 1 As shown, the specific application scenario of the present application includes a client 101 , a target server 102 , an authoritative server 103 and a computer device 104 .

[0044] Specifically, the computer device 104 first obtains the IP address of the target server 102, generates a prefix part of a pre-registered second-level domain name according to the target server IP address, and concatenates the prefix part with the second-level domain name to determine a detection domain name for the target server 102. The computer device 104 sends the detection domain name to the client 101 and controls the client 101 to send a resolution request for the detection domain name to the target server 102. The target server 102 sends a request data packet to the authoritative server 103. After the authoritative server 103 receives the request data packet, the computer device 104 obtains all request data packets in the authoritative server, and filters out the first target data packet for the target server according to the detection domain name, obtains the source address in the first target data packet, and determines whether the source address is consistent with the target server IP address. If they are consistent, it is determined that the devices included in the resolution path are the client, the target server, and the authoritative server.

[0045] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0046] FIG2(1) is a flow chart of a method for determining a domain name resolution path provided by the present application. As shown in FIG2(1), the method includes:

[0047] S201: Obtain the Internet Protocol address IP of the target server.

[0048] Specifically, the control client checks the currently used target server address, i.e., the DNS server address, through the network device interface. For example, in a Windows system, the properties of the network connection can be checked through the control panel or the network device. In a Linux system, the configuration file can be checked to list the IP address of the currently used DNS resolver.

[0049] S202: Generate a prefix part of a secondary domain name according to the target server IP address, wherein the secondary domain name is pre-registered by the user at a domain name registrar.

[0050] Specifically, first register a second-level domain name. For example, assume that the second-level domain name is test.com, and deploy a server A with a public IP. Assume that the public IP of server A is IP a , set the authoritative server of test.com to IP a, and deploy the resolution program on Server A. Configure records for all subdomains of test.com through wildcard records, so that all subdomains of test.com can be resolved normally. Through log settings, all DNS request packets received are recorded at Server A.

[0051] The wildcard record configuration is as follows: *.test.com A 1.2.3.4, which means that all subdomains of test.com are resolved to the address 1.2.3.4. In this way, any subdomain that is not explicitly configured will be resolved to the 1.2.3.4 wildcard record.

[0052] Specifically, the generation process of the prefix part of the second-level domain name includes steps Sa1 to Sa4:

[0053] Sa1: Express the target server IP in hexadecimal to generate a hexadecimal expression.

[0054] Specifically, convert each decimal part of the target server IP to hexadecimal and then combine them together.

[0055] For example, assuming that the target server IP is 192.168.1.1, the process of converting each decimal part into hexadecimal is: convert 192 into hexadecimal 'C0'; convert 168 into hexadecimal 'A8'; convert 1 into hexadecimal '01'; convert 1 into hexadecimal '01', and combine these hexadecimals together into 'C0A80101', so the hexadecimal expression generated by the target server IP conversion is 'C0A80101'.

[0056] Sa2: Generates a timestamp based on the preset detection start time.

[0057] Generating a timestamp typically involves converting a specific date and time into an integer value, usually representing a time since some starting point.

[0058] Specifically, a preset detection start time is determined, and based on the preset detection time, the system automatically generates a corresponding timestamp.

[0059] Sa3: Hash the data obtained by concatenating the hexadecimal representation and the timestamp, and determine the value of a preset number of digits as a random suffix.

[0060] Specifically, the data obtained by concatenating the hexadecimal expression and the timestamp is hashed, and a value of a fixed number of digits is extracted from the generated hash value as a random suffix.

[0061] For example, if an 8-bit random suffix needs to be extracted, the first 8 bits of the hash value may be taken.

[0062] Sa4: Concatenate the hexadecimal expression, timestamp, and random suffix in a preset order to obtain the prefix part of the second-level domain name.

[0063] Exemplarily, assuming that the preset concatenation order is hexadecimal expression+timestamp+random suffix, the hexadecimal expression 'C0A80101', the timestamp '1700000000' and the random suffix 'abcd1234' are concatenated according to the preset concatenation order to obtain the prefix part of the second-level domain name: C0A801011700000000abcd1234.

[0064] S203: Concatenate the prefix part with the secondary domain name to determine the detection domain name of the target server.

[0065] S204: Control the client to send a resolution request for the detection domain name to the target server, so that the target server sends a request data packet to the authoritative server.

[0066] Among them, the client can be deployed as an active request node on any host that can connect to the external network.

[0067] For example, assuming that the detection domain name is sub.test.com, where sub is the prefix part, the control client sends a resolution request for sub.test.com to the target server. When the target server sends a resolution request to the authoritative server, it constructs a request data packet, which follows the DNS protocol specification and usually uses the UDP protocol.

[0068] S205: Receive all request data packets sent by the authoritative server, and filter all request data packets according to the detected domain name to obtain a first target data packet.

[0069] Specifically, a network monitoring tool is used to capture outbound requests on the target server to observe whether it sends requests to the authoritative server. When it is determined that the target server sends a request to the authoritative server, all request data packets in the authoritative server are obtained, and all request data packets are screened according to the detection domain name to obtain the first target data packet.

[0070] S206: Determine whether the source address in the first target data packet is consistent with the target server IP.

[0071] The source address is the source IP address in the first target data packet, indicating the IP address of the device from which the data packet was initially sent.

[0072] Specifically, check whether the source address in the first target data packet is the same as the target server IP.

[0073] S207: If the source address is consistent with the target server IP, it is determined that the resolution path consists of the client, the target server and the authoritative server.

[0074] Specifically, if the source address is consistent with the target server IP, it means that the target server receives the request from the client with the same IP and interacts with the authoritative server. Figure 2 (2) is a mode 1 of the recursive resolution path provided by the embodiment of the present application.

[0075] Specifically, if it is determined that the source address in the first target data packet is inconsistent with the target server IP, steps Sb1 to Sb3 are also included:

[0076] Sb1: If the source address is inconsistent with the target server IP, the extended client subnet ECS information is obtained from the first target data packet.

[0077] ECS is part of the extended DNS protocol and is used to carry the client's subnet information in the DNS query, which helps the target server provide a more appropriate response based on the client's geographic location, such as returning the IP address of the CDN (Content Delivery Network) node closest to the client.

[0078] Among them, CDN is a technology that accelerates the delivery of Internet content through a geographically distributed server network. The main purpose of CDN is to reduce latency, improve content loading speed and user experience by caching content on servers closer to users.

[0079] Specifically, a network analysis tool or a programming library is used to capture and parse the first target data packet, and the first target data packet is ensured to contain an EDNS (Extension Mechanisms for DNS) option, wherein the EDNS option is generally present in an additional part of a DNS data packet. In the EDNS option, a specific option with an option code of '8' is searched, namely, extended client subnet ECS information.

[0080] Sb2: According to the subnet information of the detection node in the ECS information, determine whether the IP of the detection node is consistent with the target server IP.

[0081] Among them, ECS information usually contains the IP address or subnet information of the client that can initiate the DNS query, which is attached to the query by the DNS resolver that supports ECS so that the authoritative server can return a more appropriate response based on the client's geographic location or network location.

[0082] Specifically, the subnet information of the detection node in the ECS information is obtained, and it is determined whether the IP of the detection node is consistent with the target server IP.

[0083] Sb3: If the detection node IP is consistent with the target server IP, the resolution path is determined to be composed of the client, target server, export server and authoritative server; the target server receives the resolution request for the detection domain name sent by the client, and forwards the resolution request to the export server, and the export server interacts with the authoritative server.

[0084] Specifically, if the ECS information contained in the first target data packet is the subnet information of the target server, it means that the target server plays the role of a forwarder, receives the resolution request from the client, and then forwards it to the egress server, and the egress server interacts with the authoritative server. Figure 2 (3) is a second mode of the recursive resolution path provided by the embodiment of the present application.

[0085] Specifically, if it is determined that the IP of the detection node is inconsistent with the target server IP, steps Sc1 to Sc2 are also included:

[0086] Sc1: If the IP of the detection node is inconsistent with the target server IP, continue to determine whether the IP of the detection node is consistent with the IP of the client.

[0087] Specifically, if the IP of the detection node is inconsistent with the target server IP, it is further determined whether the IP of the detection node is consistent with the IP of the client.

[0088] Sc2: If the IP of the detection node is consistent with the IP of the client, the target server is determined to include an entry IP and an exit IP; the entry IP receives the resolution request for the detection domain name sent by the client, and the exit IP interacts with the authoritative server.

[0089] Specifically, if the ECS information contained in the first target data packet is the subnet information of the client, it means that the target resolver has two IPs, an ingress IP and an egress IP, receives the resolution request from the client from the ingress IP, and interacts with the authoritative server with the egress IP. Figure 2 (4) is a third mode of the recursive resolution path provided in an embodiment of the present application.

[0090] Specifically, if it is determined that the IP of the detection node is inconsistent with the IP of the client, step Sd1 is further included:

[0091] Sd1: If the IP of the detection node is inconsistent with the IP of the client, it is determined that the resolution path includes at least the client, the target server, a middleware, the export server and the authoritative server.

[0092] Specifically, if the IP of the detection node is inconsistent with the IP of the client and the IP of the target server, it means that the target resolver receives the resolution request from the client as a forwarder, and then forwards it to the export server after at least one forwarding, and the export server interacts with the authoritative server. The whole recursive process involves at least four devices: the client, the target resolver, a middleware and the export server. Figure 2 (5) is a mode 4 of the recursive resolution path provided in the embodiment of the present application.

[0093] In summary, by embedding the Internet Protocol address IP of the target server as the prefix of the pre-registered secondary domain name into the detection domain name, and controlling the client to send a resolution request for the detection domain name to the target server, the relevance of the detection domain name to the target server can be guaranteed, and the efficiency of querying the target data packet in the authoritative server can be improved. After the authoritative server receives the request data packet sent by the target server, all request data packets of the authoritative server are obtained, and all request data packets are filtered according to the detection domain name to obtain the first target data packet. It is determined whether the source address in the first target data packet is consistent with the target server IP. If consistent, it is determined that all devices on the resolution path may include the client, the target server and the authoritative server. The devices on the resolution path are determined by comparing the source address in the data packet with the IP address of the target server, thereby improving the efficiency of determining the resolution path.

[0094] In addition, the hexadecimal expression, timestamp and random suffix are concatenated in a preset order to obtain the prefix part of the secondary domain name, which can ensure the uniqueness of the detection domain name and the relevance of the detection domain name to the target server.

[0095] In addition, with the help of extended client subnet ECS information, on the basis of identifying the entry server and exit server of the recursive resolution process, it is determined whether there are other devices between the entry server and the exit server, and the recursive resolution path of the target server can be restored more comprehensively, thereby accurately identifying and repairing possible vulnerabilities in each device, effectively reducing security risks, and protecting the security of the recursive resolution chain.

[0096] After determining that the IP of the detection node is inconsistent with the IP of the client, multiple middleware devices involved between the entry server and the exit server of the target server can be further determined, specifically including S301~S302:

[0097] S301: Iteratively execute the steps of "for the IP of the detection node, using a preset network sniffer to analyze network traffic to obtain all data packets of the detection node; according to the detection domain name, all data packets are screened to obtain a second target data packet, and the IP of the detection node in the ECS information is obtained from the second target data packet" until the source address in the second target data packet is consistent with the target server IP, or the IP of the detection node in the ECS information obtained in the second target data packet is consistent with the target server IP, or the IP of the detection node in the ECS information obtained in the second target data packet is consistent with the IP of the client.

[0098] S302: Determine that the resolution path includes a client, a target server, multiple middlewares, an export server, and an authoritative server.

[0099] Exemplarily, for the IP of the detection node, a network sniffer is used to analyze network traffic to obtain all data packets of the detection node, and all data packets are screened according to the detection domain name to obtain a second target data packet, and it is determined whether the source address in the second target data packet is consistent with the target server IP. If it is consistent, it means that the target server includes two middlewares. If it is inconsistent, the subnet information of the detection node in the ECS information is obtained from the second target data packet. According to the IP of the detection node in the ECS information obtained in the second data packet, it is determined whether the IP of the detection node is consistent with the target server IP or the IP of the client. If they are not consistent, the step of using a network sniffer to analyze network traffic for the IP of the detection node is continued until the IP of the detection node in the ECS information obtained in the second target data packet is consistent with the IP of the target server, or the IP of the detection node in the ECS information obtained in the second target data packet is consistent with the IP of the client. Thus, the client, target server, multiple middlewares, export server and authoritative server included in the resolution path are determined.

[0100] In summary, using a network sniffer to perform iterative data packet analysis on the IP of the detection node can further determine the multiple middleware information involved in the target server, thereby further reducing security risks and protecting the security of the recursive resolution chain.

[0101] Figure 3 A schematic diagram of the structure of a domain name resolution path determination device provided in an embodiment of the present application, the device includes a data acquisition module 301, a domain name prefix generation module 302, a detection domain name determination module 303, a control data packet sending module 304, a data packet receiving module 305, a source address judgment module 306 and a resolution path determination module 307.

[0102] The data acquisition module 301 is used to acquire the Internet Protocol address IP of the target server.

[0103] The domain name prefix generating module 302 is used to generate a prefix part of a secondary domain name according to the target server IP address, wherein the secondary domain name is pre-registered by the user at a domain name registrar.

[0104] The detection domain name determination module 303 is used to concatenate the prefix part with the secondary domain name to determine the detection domain name of the target server.

[0105] The control data packet sending module 304 is used to control the client to send a resolution request for the detection domain name to the target server, so that the target server sends a request data packet to the authoritative server.

[0106] The data packet receiving module 305 is used to receive all request data packets sent by the authoritative server and screen all request data packets according to the detected domain name to obtain the first target data packet.

[0107] The source address determination module 306 is used to determine whether the source address in the first target data packet is consistent with the target server IP.

[0108] The resolution path determination module 307 is used to determine that the resolution path consists of the client, the target server and the authoritative server if the source address is consistent with the target server IP.

[0109] In a possible implementation, the device also includes a second resolution path determination module, which is used to obtain the extended client subnet ECS information from the first target data packet if the source address is inconsistent with the target server IP; determine whether the IP of the detection node is consistent with the target server IP based on the subnet information of the detection node in the ECS information; if the detection node IP is consistent with the target server IP, determine that the resolution path is composed of the client, target server, export server and authoritative server; wherein the target server receives the resolution request for the detection domain name sent by the client, and forwards the resolution request to the export server, and the export server interacts with the authoritative server.

[0110] In one possible implementation, the device also includes a third resolution path determination module, which is used to continue to determine whether the IP of the detection node is consistent with the IP of the client if the IP of the detection node is inconsistent with the IP of the target server; if the IP of the detection node is consistent with the IP of the client, it is determined that the target server includes an entry IP and an exit IP; wherein the entry IP receives the resolution request sent by the client for the detection domain name, and the exit IP interacts with the authoritative server.

[0111] In one possible implementation, the domain name prefix generation module 302 is specifically used to represent the target server IP in hexadecimal to generate a hexadecimal expression; generate a timestamp according to a preset detection start time; perform hash processing on the data after splicing the hexadecimal representation and the timestamp, and determine the value of a preset number of bits as a random suffix; splice the hexadecimal expression, the timestamp and the random suffix in a preset order to obtain the prefix part of the secondary domain name. In a possible implementation, the device also includes a fourth resolution path determination module, which is used to determine that if the IP of the detection node is inconsistent with the IP of the client, the resolution path at least includes the client, the target server, a middleware, the export server and the authoritative server.

[0112] In a possible implementation, the device also includes an iterative execution module, which is used to iteratively execute the steps of "for the IP of the detection node, using a preset network sniffer to analyze network traffic to obtain all data packets of the detection node; according to the detection domain name, all data packets are screened to obtain a second target data packet, and the IP of the detection node in the ECS information is obtained from the second target data packet" until the source address in the second target data packet is consistent with the target server IP, or the IP of the detection node in the ECS information obtained in the second target data packet is consistent with the target server IP, or the IP of the detection node in the ECS information obtained in the second target data packet is consistent with the IP of the client; determine that the resolution path includes the client, the target server, multiple middleware, the export server and the authoritative server.

[0113] The domain name resolution path determination device provided in this embodiment can execute the method provided in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be described in detail here.

[0114] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. Figure 4 As shown, the computer device provided in this embodiment includes: at least one processor 401 and a memory 402. Optionally, the computer device also includes a communication component 403. The processor 401, the memory 402 and the communication component 403 are connected via a bus 404.

[0115] In a specific implementation process, at least one processor 401 executes the computer-executable instructions stored in the memory 402, so that at least one processor 401 executes the above method.

[0116] The specific implementation process of the processor 401 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0117] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0118] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0119] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0120] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0121] An embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0122] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0123] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0124] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0125] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0126] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0127] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0128] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0129] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for determining a domain name resolution path, characterized in that: Applicable to computer equipment, including: Get the target server's Internet Protocol address IP; Generate a prefix portion of a second-level domain name according to the target server IP address, wherein the second-level domain name is pre-registered by the user at a domain name registrar; Concatenate the prefix part with the secondary domain name to determine the detection domain name of the target server; Control the client to send a resolution request for the detection domain name to the target server, so that the target server sends a request data packet to the authoritative server; Receiving all request data packets sent by the authoritative server, and screening all the request data packets according to the detection domain name to obtain a first target data packet; Determine whether the source address in the first target data packet is consistent with the target server IP; If the source address is consistent with the target server IP, it is determined that the resolution path is composed of the client, the target server and the authoritative server.

2. The method according to claim 1, characterized in that After determining whether the source address in the first target data packet is consistent with the target server IP, the method further includes: If the source address is inconsistent with the target server IP, obtaining the extended client subnet ECS information from the first target data packet; According to the subnet information of the detection node in the ECS information, determine whether the IP of the detection node is consistent with the target server IP; If the detection node IP is consistent with the target server IP, it is determined that the resolution path is composed of the client, the target server, the export server and the authoritative server; wherein the target server receives the resolution request for the detection domain name sent by the client, and forwards the resolution request to the export server, and the export server interacts with the authoritative server.

3. The method according to claim 2, characterized in that After determining whether the IP of the detection node is consistent with the IP of the target server, the method further includes: If the IP of the detection node is inconsistent with the target server IP, continue to determine whether the IP of the detection node is consistent with the IP of the client; If the IP of the detection node is consistent with the IP of the client, it is determined that the target server includes an entry IP and an exit IP; wherein the entry IP receives the resolution request for the detection domain name sent by the client, and the exit IP interacts with the authoritative server.

4. The method according to any one of claims 1 to 3, characterized in that: The step of generating a prefix portion of a secondary domain name according to the target server IP address includes: The target server IP is represented in hexadecimal to generate a hexadecimal expression; Generate a timestamp based on the preset detection start time; Performing hash processing on the data obtained by concatenating the hexadecimal representation and the timestamp, and determining a value of a preset number of digits as a random suffix; The hexadecimal expression, the timestamp and the random suffix are concatenated in a preset order to obtain a prefix portion of the secondary domain name.

5. The method according to claim 3, characterized in that: After continuing to determine whether the IP of the detection node is consistent with the IP of the client, the method further includes: If the IP of the detection node is inconsistent with the IP of the client, it is determined that the resolution path at least includes the client, the target server, a middleware, the export server and the authoritative server.

6. The method according to claim 5, characterized in that After continuing to determine whether the IP of the detection node is consistent with the IP of the client, the method further includes: Iteratively execute the step of "analyzing network traffic with a preset network sniffer for the IP of the detection node to obtain all data packets of the detection node; screening all data packets according to the detection domain name to obtain a second target data packet, and obtaining the IP of the detection node in the ECS information from the second target data packet" until the source address in the second target data packet is consistent with the IP of the target server, or the IP of the detection node in the ECS information obtained in the second target data packet is consistent with the IP of the target server, or the IP of the detection node in the ECS information obtained in the second target data packet is consistent with the IP of the client; Determine that the resolution path includes the client, the target server, a plurality of middlewares, the export server, and the authoritative server.

7. A device for determining a domain name resolution path, characterized in that: Applicable to computer equipment, including: A data acquisition module is used to obtain the Internet Protocol address IP of the target server; A domain name prefix generation module, used to generate a prefix part of a secondary domain name according to the target server IP address, wherein the secondary domain name is pre-registered by the user at a domain name registrar; A detection domain name determination module, used for concatenating the prefix part with the secondary domain name to determine the detection domain name of the target server; A control data packet sending module, used to control the client to send a resolution request for the detection domain name to the target server, so that the target server sends a request data packet to the authoritative server; A data packet receiving module, used for receiving all request data packets sent by the authoritative server, and screening all request data packets according to the detection domain name to obtain a first target data packet; A source address determination module, used to determine whether the source address in the first target data packet is consistent with the target server IP; The resolution path determination module is used to determine that the resolution path is composed of the client, the target server and the authoritative server if the source address is consistent with the target server IP.

8. A computer device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images