Edge DNS Analysis Module for Accurate Timestamping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current monitoring systems face inaccuracies in timestamping and incomplete packet collection due to latency and logistical difficulties, leading to unreliable analysis of network traffic, particularly in Domain Name System (DNS) traffic, which hampers issue identification and resolution.
Innovation Solution
Implementing an analysis module on edge network devices to extract and process DNS packets, apply timestamps, and transmit processed information to the monitoring system, ensuring accurate timestamping and complete packet analysis, including the use of machine learning for secondary processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If mirrored packets are transmitted to a centralized monitoring system for analysis, then network traffic analysis can be performed, but latency and path traversal cause timestamp inaccuracies
Solution Approach 1:
The patent segments the monitoring function by deploying analysis modules directly on edge network devices rather than centralizing it. This allows timestamping to occur at the source (edge devices) before packets are mirrored to the monitoring system, eliminating the latency-induced timestamp inaccuracies that would occur if packets traversed multiple paths to a centralized system.
Solution Approach 2:
The analysis modules on edge network devices perform preliminary timestamping of packets at the moment they are received. This preliminary action ensures that accurate timestamps are assigned before any latency occurs during packet transmission to the monitoring system, resolving the timestamp accuracy issue.
2Reliability
If all mirrored packets are collected from edge network devices, then complete packet analysis is achieved, but logistical difficulties prevent full collection
Solution Approach 1:
The analysis modules on edge network devices perform self-service by autonomously capturing, processing, and transmitting relevant packet information to the monitoring system. This eliminates the need for complex centralized collection mechanisms, as each edge device independently manages its own packet analysis and reporting.
Solution Approach 2:
The analysis modules act as intermediaries between the network traffic and the monitoring system. They filter, process, and selectively transmit only the most relevant packet information, reducing the complexity of collecting and managing all mirrored packets while ensuring reliable analysis of critical traffic patterns.
3Device complexity
If sample packets are collected instead of all packets, then collection complexity is reduced, but analysis accuracy decreases
Solution Approach 1:
The system changes the parameter of what is being transmitted from raw packet data to processed analysis results. The analysis modules on edge devices perform local analysis and transmit only the essential findings, maintaining analysis accuracy while significantly reducing collection complexity and bandwidth requirements.
Data Source
AI summary
A method for analyzing a pair of domain name system (DNS) packets, the method comprising: extracting a portion of a request DNS packet to obtain extracted request DNS information, wherein the extracted request DNS information comprises a first timestamp generated by the edge network device, obtaining a response DNS packet, extracting at least a portion of the response DNS packet to obtain extracted response DNS information, wherein the extracted response DNS information comprises a second timestamp generated by the edge network device, after the obtaining, processing the extracted request DNS information and extracted response DNS information to obtain processed information, wherein the processed information comprises a roundtrip time derived from the first timestamp and the second timestamp, and transmitting the processed information to a monitoring system, wherein the pair of DNS packets are not transmitted to the monitoring system.