Rega Kushandisa Ridiculously Low TTL yeDNS

Yakaderera DNS latency chinhu chakakosha chekukurumidza kubhurawuza. Kuti udzikise, zvakakosha kunyatsosarudza DNS maseva uye anonymous relay. Asi chinhu chekutanga chaunofanirwa kuita kubvisa mibvunzo isina basa.

Ichi ndicho chikonzero DNS yakatanga kugadzirwa seyakanyanya cacheable protocol. Vatariri venzvimbo vanoisa nguva yekurarama (TTL) yemarekodhi ega, uye vanogadzirisa vanoshandisa ruzivo urwu pavanochengeta marekodhi mundangariro kudzivirira traffic isingakoshi.

Ko caching inoshanda here? Makore mashoma apfuura, tsvakiridzo yangu diki yakaratidza kuti haina kukwana. Ngatitarisei mamiriro akaita zvinhu.

Kuti ndiunganidze ruzivo ndakaruka Yakavharidzirwa DNS Server kuchengetedza kukosha kweTTL kwemhinduro. Inotsanangurwa seyakaderera TTL yemarekodhi ayo, kune yega yega chikumbiro chinouya. Izvi zvinopa tarisiro yakanaka yekugovera kweTTL kwetraffic chaiyo, uye zvakare inofunga nezvekuzivikanwa kwezvikumbiro zvega. Iyo yakavharwa shanduro yeserver yakashanda kwemaawa akati wandei.

Iyo dataset inobuda ine 1 rekodhi (zita, qtype, TTL, timestamp). Heino kugovera kweTTL kwese (x-axis iri TTL mumasekonzi):

Rega Kushandisa Ridiculously Low TTL yeDNS

Kunze kwekubhomba kudiki pa86 (kunyanya yeSOA marekodhi), zviri pachena kuti maTTL ari muchikamu chakaderera. Ngatitarisei zvakanyanya:

Rega Kushandisa Ridiculously Low TTL yeDNS

Zvakanaka, maTTL anopfuura awa imwe haana kukosha. Ngatitarisei pane iyo 1-0 renji ipapo:

Rega Kushandisa Ridiculously Low TTL yeDNS

MaTTL mazhinji ari pakati pe0 ne15 maminetsi:

Rega Kushandisa Ridiculously Low TTL yeDNS

Huzhinji hunobva pa0 kusvika ku5 maminetsi:

Rega Kushandisa Ridiculously Low TTL yeDNS

Izvi hazvina kunyanya kunaka.

Cumulative kugovera kunoita kuti dambudziko rive pachena:

Rega Kushandisa Ridiculously Low TTL yeDNS

Hafu yemhinduro dzeDNS dzine TTL yeminiti imwe kana isingasviki, uye zvikamu zvitatu zvine TTL yemaminetsi mashanu kana pasi.

Asi chimbomira, zvatonyanya kuipa. Iyi ndiyo TTL kubva kumaseva ane chiremera. Nekudaro, vatengi vanogadzirisa (semuenzaniso marouters, macache emunharaunda) vanowana iyo TTL kubva kumusoro uko kunogadzirisa, uye inoderera sekondi yega yega.

Saka, mutengi anogona chaizvo kushandisa rekodhi yega yega, paavhareji, hafu yepakutanga TTL asati atumira chikumbiro chitsva.

Zvichida aya akaderera maTTL anongokanganisa zvikumbiro zvisina kujairika uye kwete mawebhusaiti akakurumbira uye maAPI? Ngatitarisei:

Rega Kushandisa Ridiculously Low TTL yeDNS

X-axis iTTL, Y-axis ndeye mukurumbira mukurumbira.

Nehurombo, iyo inonyanya kufarirwa mibvunzo ndiyo yakaipisisa cached.

Ngatiswededze pedyo:

Rega Kushandisa Ridiculously Low TTL yeDNS

Mutongo: Zvakaipa chaizvo. Zvakanga zvatoipa, uye zvatowedzera. DNS caching yave isingaite. Sezvo vanhu vashoma vanoshandisa yavo ISP's DNS solver (nezvikonzero zvakanaka), kuwedzera kwekunonoka kuri kuwedzera kuoneka.

DNS caching yakangoshanda kune zvemukati zvisingashanyirwe nemunhu.

Ndokumbirawo muone kuti software inogona zvakasiyana dudzira maTTL akaderera.

Nei zvakadaro

Sei DNS marekodhi akaiswa kune diki TTL?

  • Legacy load balancers inosara ine default settings.
  • Pane ngano dzekuti DNS load balancing inoenderana neTTL (ichi hachisi chokwadi - sezvo Netscape Navigator, vatengi vanotora isina kurongeka IP kero kubva kuRR set uye kuyedza imwe pachena kana vasingakwanise kubatana)
  • Vatungamiri vanoda kuisa shanduko nekukasika, saka zviri nyore kuronga.
  • Mutariri weDNS server kana loader balancer anoona basa rake sekushandisa zvinobudirira zvigadziriso zvakakumbirwa nevashandisi, uye kwete kukurumidzira kushanda kwemasaiti nemasevhisi.
  • Low TTL inopa rugare rwepfungwa.
  • Vanhu pakutanga vakaisa maTTL akaderera ekuyedza vobva vakanganwa kuvachinja.

Ini handina kusanganisira "akakundikana" nekuti zviri kuramba zvichinyanya kukosha. Kana iwe uchida kudzosera vashandisi kune imwe network kuti ungoratidza peji yekukanganisa kana zvese zvese zvaputswa, kunonoka kweinopfuura miniti imwe kunogamuchirwa.

Pamusoro pezvo, TTL yeminiti imwe zvinoreva kuti kana ane chiremera DNS maseva akavharirwa kweinopfuura miniti imwe, hapana mumwe munhu achakwanisa kuwana masevhisi anotsamira. Uye redundancy haizobatsiri kana chikonzero chiri chikanganiso chekugadzirisa kana hack. Kune rimwe divi, nemaTTL anonzwisisika, vatengi vazhinji vacharamba vachishandisa yakapfuura kumisikidzwa uye havambo cherechedza.

MaLow TTL ndiwo akanyanya kutadza kweCDN masevhisi uye mitoro yekutakura, kunyanya kana ichibatanidza maCNAME ane akaderera TTL uye marekodhi ane akaenzana akaderera (asi akazvimiririra) TTLs:

$ drill raw.githubusercontent.com
raw.githubusercontent.com.	9	IN	CNAME	github.map.fastly.net.
github.map.fastly.net.	20	IN	A	151.101.128.133
github.map.fastly.net.	20	IN	A	151.101.192.133
github.map.fastly.net.	20	IN	A	151.101.0.133
github.map.fastly.net.	20	IN	A	151.101.64.133

Pese painopera CNAME kana chero marekodhi eA, chikumbiro chitsva chinofanira kutumirwa. Ose ane makumi matatu echipiri TTL, asi haana kufanana. Iyo chaiyo avhareji TTL ichave 30 masekondi.

Asi chimbomira! Zvinowedzera kuipa. Vamwe vanogadzirisa vanozvibata zvakanyanya mune ino mamiriro ane maviri akabatana akaderera TTLs:

$ drill raw.githubusercontent.com @4.2.2.2 raw.githubusercontent.com. 1 IN CNAME github.map.fastly.net. github.map.fastly.net. 1 IN A 151.101.16.133

Iyo Level3 inogadzirisa pamwe iri kushanda paBIND. Kana ukaramba uchitumira mubvunzo uyu, unogara uchidzorera TTL ye1. raw.githubusercontent.com haana kuchengetwa.

Heino mumwe muenzaniso weiyi mamiriro ane mukurumbira wakanyanya domain:

$ drill detectportal.firefox.com @1.1.1.1
detectportal.firefox.com.	25	IN	CNAME	detectportal.prod.mozaws.net.
detectportal.prod.mozaws.net.	26	IN	CNAME	detectportal.firefox.com-v2.edgesuite.net.
detectportal.firefox.com-v2.edgesuite.net.	10668	IN	CNAME	a1089.dscd.akamai.net.
a1089.dscd.akamai.net.	10	IN	A	104.123.50.106
a1089.dscd.akamai.net.	10	IN	A	104.123.50.88

Anenge matatu CNAME marekodhi. Ouch. Imwe ine TTL yakanaka, asi haina basa zvachose. Mamwe maCNAME ane yekutanga TTL yemasekonzi makumi matanhatu, asi yemadomasi akamai.net Iyo yakanyanya TTL masekonzi makumi maviri uye hapana kana imwe yadzo iri muchikamu.

Zvakadini nemadomasi anogara achitsvaga Apple zvishandiso?

$ drill 1-courier.push.apple.com @4.2.2.2
1-courier.push.apple.com.	1253	IN	CNAME	1.courier-push-apple.com.akadns.net.
1.courier-push-apple.com.akadns.net.	1	IN	CNAME	gb-courier-4.push-apple.com.akadns.net.
gb-courier-4.push-apple.com.akadns.net.	1	IN	A	17.57.146.84
gb-courier-4.push-apple.com.akadns.net.	1	IN	A	17.57.146.85

Dambudziko rakafanana neFirefox neTTL inonamira pasekondi imwe nguva zhinji kana uchishandisa Level1 solver.

Dropbox?

$ drill client.dropbox.com @8.8.8.8 client.dropbox.com. 7 IN CNAME client.dropbox-dns.com. client.dropbox-dns.com. 59 IN A 162.125.67.3 $ drill client.dropbox.com @4.2.2.2 client.dropbox.com. 1 IN CNAME client.dropbox-dns.com. client.dropbox-dns.com. 1 IN A 162.125.64.3

Pakurekodha safebrowsing.googleapis.com TTL kukosha kwemasekonzi makumi matanhatu, senge Facebook domains. Uye zvakare, kubva pakuona kwemutengi, izvi zvakakosha zvakadzikiswa nepakati.

Zvakadini nekuisa shoma TTL?

Ndichishandisa zita, rudzi rwekukumbira, TTL, uye chitambi chenguva chakachengetwa, ndakanyora script kutevedzera 1,5 miriyoni zvikumbiro zvichipfuura nemugadziriso wecaching kufungidzira huwandu hwezvimwe zvikumbiro zvakatumirwa nekuda kwekupinda cache kwapera.

47,4% yezvikumbiro zvakaitwa mushure mekunge rekodhi iripo yapera. Izvi zvakakwirira zvisina musoro.

Chii chichava mhedzisiro pane caching kana shoma TTL yakaiswa?

Rega Kushandisa Ridiculously Low TTL yeDNS

Iyo X-axis ndiyo shoma TTL makoshero. Zvinyorwa zvine TTL mbishi pamusoro pehukoshi uhwu hazvikanganiswe.

Iyo Y axis iperesenti yezvikumbiro kubva kune mutengi atova necached yekupinda, asi yapera uye iri kuita chikumbiro chitsva.

Chikamu chezvikumbiro "zvekuwedzera" chinoderedzwa kubva pa47% kusvika pa36% nekungoisa shoma TTL kusvika kumaminitsi mashanu. Kuisa iyo shoma TTL kusvika kumaminitsi gumi nemashanu kunoderedza huwandu hwezvikumbiro izvi kusvika 5%. TTL shoma yeawa imwe inodzikisira kusvika 15%. Musiyano unokosha!

Zvakadini nekusachinja chero chinhu padivi pesevha, asi pachinzvimbo chekuisa mashoma maTTL mune mutengi DNS cache (marouter, emuno resolutions)?

Rega Kushandisa Ridiculously Low TTL yeDNS

Huwandu hwezvikumbiro zvinodiwa hunodonha kubva pa47% kusvika pa34% pakuisa TTL shoma kusvika ku5 maminetsi, kusvika 25% ine maminetsi mashoma gumi nemashanu, uye kusvika 15% neawa isingasviki 13. Zvichida maminetsi makumi mana ndiwo akanakisa.

Kukanganisa kwekuchinja kudiki uku kwakakura.

Migumisiro yacho ndeipi?

Chokwadi, unogona kutamisa sevhisi kune mutsva wegore mupi, sevha nyowani, network nyowani, uye inoda kuti vatengi vashandise azvino DNS marekodhi. Uye TTL diki yakakwana inobatsira kuti shanduko iite mutsetse uye isina musono. Asi kana iwe uchinge watamira kune nyowani nyowani, hapana anotarisira kuti vatengi vatamire kune itsva DNS marekodhi mukati meminiti 1, maminetsi mashanu, kana maminetsi gumi nemashanu. Kuisa iyo shoma TTL kusvika 5 maminetsi panzvimbo ye15 maminetsi hazvitadzise vashandisi kuwana sevhisi.

Nekudaro, izvi zvichaderedza zvakanyanya latency uye kuvandudza kuvanzika uye kuvimbika nekudzivisa zvikumbiro zvisingakoshi.

Chokwadi, maRFC anoti maTTL anofanirwa kutevedzerwa. Asi chokwadi ndechekuti iyo DNS system yanyanya kusashanda.

Kana uri kushanda nemaseva ane chiremera eDNS, ndapota tarisa maTTL ako. Unoda chaizvoizvo tsika dzakaderera zvakadaro?

Ehe, pane zvikonzero zvakanaka zvekuseta maTTL madiki eDNS marekodhi. Asi kwete ye75% yeDNS traffic iyo isinga shanduke.

Uye kana nekuda kwechimwe chikonzero iwe unonyatsoda kushandisa yakaderera TTLs yeDNS, zvakare ita shuwa kuti yako saiti haina caching inogoneswa. Nezvikonzero zvimwe chetezvo.

Kana iwe uine yemuno DNS cache inomhanya, senge dnscrypt-proxy, iyo inokubvumira kuti uise shoma TTL, shandisa basa iri. Izvi zvakajairika. Hapana chakaipa chichaitika. Isa iyo shoma TTL kune imwe nzvimbo pakati pe40 maminetsi (2400 seconds) uye 1 awa. Mutsara unonzwisisika.

Source: www.habr.com

Tenga inovimbika yekutambira kwemasaiti ane DDoS dziviriro, VPS VDS maseva 🔥 Tenga webhusaiti yakavimbika ine dziviriro yeDDoS, maseva eVPS VDS | ProHoster