DNS Packet Interception for Bandwidth Limiting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In public wireless local area networks (PWLANs), domain name server (DNS) transactions often go unauthenticated, allowing unauthorized users to tunnel traffic, making it difficult to enforce bandwidth limitations and block malicious activities.
Innovation Solution
Implementing a method to intercept and examine DNS packets for suspect criteria such as oversized packets, high frequency, or specific record types, and taking actions like dropping or delaying packets to limit bandwidth, thereby rendering DNS tunneling impractical.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If DNS transactions are allowed without authentication in PWLANs, then network accessibility and ease of operation are improved, but unauthorized users can tunnel traffic and bandwidth control is lost
Solution Approach 1:
The patent introduces a gateway device as an intermediary between user devices and DNS servers. This gateway intercepts DNS packets, examines them for tunneling criteria, and enforces bandwidth limitations. The intermediary enables continued DNS functionality while blocking malicious tunneling activities, resolving the contradiction between maintaining network accessibility and preventing unauthorized traffic.
2Object-affected harmful factors
If bandwidth limitations are enforced on DNS transactions, then unauthorized tunneling is prevented, but legitimate DNS traffic may be affected
Solution Approach 1:
The patent applies different quality treatments to different DNS packets based on their characteristics. Legitimate DNS packets receive normal processing, while packets exhibiting tunneling criteria (oversized packets, high frequency, specific record types) are subject to bandwidth limitations or blocking. This localized differentiation maintains reliable DNS service for legitimate users while preventing tunneling abuse.
Solution Approach 2:
The system monitors and compares DNS packet parameters (size, frequency, record type) against configured thresholds. When parameters exceed acceptable ranges indicating potential tunneling, the system changes the treatment parameter from normal processing to bandwidth limitation or blocking. This dynamic parameter-based approach distinguishes legitimate from malicious traffic.
3Object-affected harmful factors
If all DNS packets are monitored and examined for tunneling criteria, then security is improved, but device complexity and processing overhead increase
Solution Approach 1:
The gateway device monitors specific parameters of DNS packets (size, frequency, record type) against pre-configured thresholds. This parameter-based approach simplifies the examination process by focusing on key indicators of tunneling behavior rather than analyzing complete packet contents, reducing processing overhead while maintaining security effectiveness.
Solution Approach 2:
The system discards packets that clearly exhibit tunneling criteria (exceeding size limits, abnormal frequency, suspicious record types) without requiring full analysis. By discarding obviously malicious packets based on simple criteria checks, the system reduces processing complexity for clearly harmful traffic while maintaining security.
Data Source
AI summary
A method of limiting domain name server (DNS) transaction bandwidth comprises intercepting one or more DNS packets, examining said one or more packets for the presence of a suspect transaction criterion and, if said suspect transaction criterion is present, implementing a transaction bandwidth limitation action.