子网dns故障引发子网流量异常(DNS fault raises subnet traffic anomalies)

dns故障  时间:2021-03-15  阅读:()

dns故障引发子网流量异常DNS fault raises subnet trafficanomal ies

This is a friend of network fault, fault is typical,troubleshooting ideas more desirable. So the journey to findthe solution, all told the world, hope everyone after use.

1. Symptom description

Customers call report center network is basically normal, buta subnet suddenly slows down. This is the local railway networkservices company, the company provides Web services andInternet access service for ordinary users. A few days ago, thearea of service users reflect the network speed is very slow,Email also need towait more than60 seconds over time toUnicom.This area is divided into a sub network, network managementsystem from the host housing observation found that in additionto the area (subnet) router traffic is very high (test 97%) ,interactive traffic center network routers and other subnetworks was below 40%. In addition, no other specialphenomenon.

2 、 diagnostic process

Railway maintenance personnel conducted their own networkdebugging but did not find the fault, unable to disconnect thenetwork user service stop to check, and turn to us, I was sentout. It should be said that judging from the symptoms of thisfault is relatively simple, as long as the found routing subnettraffic sources can quickly determine the direction of faultfurther, it can find out the source of traffic immediately.

From the network topology, fault sub network and Network Centerfor the E1 link. There is a hall fault sub network below, onlyinteract with some business data center network should not havetoo much traffic. In addition, the number of Web server underthe subnet to 45 units, the network management system reportcenter 97% the traffic is certainly too high.

I consider the effective flow only in one situation can moreoccupy the E1 channel, that is the fault of multimedia documentsbetween the website and the subnet network site or servertransmission or download servicewill cause this situation. Butthe management staff asked that the network does not providesuch as multimedia video playback and download service. It canonly use tools to detect.

Because of the relatively small size of the network faultmanagement system, network support only to router levelmanagement, switch and server etc. using the desktop switchescheap, it can not support the network management. The networkaccess switch tester for testing, started carrying the networkmanagement function, you can see the router observation flowand network management system the flow is the same, are around97%. (ylmf skills)

This view is connected with the router traffic center network,is about 997%, indicating that the channel router linkperformance is basically normal. But this will inevitably leadto high flow channel router congestion and packet loss, so fromthe perspective of flow is not normal. Now need to understandis that the routing traffic is so high where it came from. The

packets arriving at the router and later to. So you can quicklylocate to the data source and the source channel trafficcongestion so high.

The router channel network traffic analyzer access networkmonitoring and analysis, results showed that 95%of the trafficf low data server, and the majority of HTTP and Email. Among them,Internet traffic accounted for 88%, traffic sourcesdistribution of local traffic accounted for 7%. instructionsto check the flow of the analyzer, no traffic concentrationapplication discovery,

IP address distribution is balanced, the highest rate accountedfor only 0.5%. . These data suggest that the applicationproportion of user equilibrium, the cause of the malfunctionshould be in the application process rather than a centralizeduser "bombardment" such as hackers. That is to say, the processand application of channel should be out of the question. Thereason is that these flow at channel design should not reachthe business hall network service server, but should enter theInternet directly from the Internet router center network. So,the flow is to be guided to the direction of the business hallserver?

Here we carry out further analysis, we know that the IP datapacket in the transmission process will address resolution inthe router (ARP) , or domain name analysis in the local DNS. Ifthe path analysis problems, the IP transmission of data packetand exchange will be a problem. According to the trafficanalyzer' s instructions, the arbitrary choose 10 IP addressrouting tracking test results for tracking network tester is

that they must pass through a DNS server. And imitate thebusiness hall of known members of the network are local andforeign users ICMP monitoring and route tracking test, the datapacket redirection ICMP monitoring target accounted for 82%.Not up to the number of data packets for 13%. which show thatonly about 2%of the users can access the normal route to thetarget site, the remaining 95% of the IP data packet to gothrough competition or re sent to the routing part Theopportunity arrives at the destination

This transformation can focus on examination of the main routerrouting table and DNS table. Since the majority of Internettraffic is directed to the business server, so you can focuson the server. Check the DNS query to the DNS server by networktester, observation results showed that DNS conversion tablehas a considerable proportion to business hall network serviceserver. I suspect the DNS server is out of the question!So the notification center network management personnel willrestart the DNS server and quickly set up a network managementnetwork business report later returned to normal. Using networkanalyzer Internet toolkit querying the DNS server, you can seeto business server data has disappeared, which indicates thatthe network has been fully restored to normal work but goodtimes don't last long. , about 3 minutes after the fault appearsagain, still have 97% of the channel flow is directed to asubnet.

Because the DNS server set only one, no backup server, and hadto immediately came to the center of network computer room, tocheck the DNS server and its peripheral equipment. The test

server adapter and cable and router. In order not to interruptthe normal service, the author makes network managementpersonnel set up a temporary installation of DNS server inanother backup server. After a brief interruption of business,the replacement of a new DNS server application started. Seethe subnet router traffic immediately reduced to 1.5%. after30 minutes of work after all users were restored to the normalworking state, fault elimination.

3, the cause of the failure

As we all know, the DNS server for the user domain names intoIP addresses, generally does not appear what problem. But forsome reason, causing all point to the business office networkservice server address translation in this case. The similarbusiness server does not have the routing function,

IP packets that are sent either are rejected, collocated,ignored, or returned to unreachable or redirected packets. Thisis what we often observe when monitoring ICMP

The number of users of local railway is not much, but with highernetwork bandwidth for the ATM link 155M, a large surplus, soInternet users access to the Internet speed is mainly affectedby the subnet bandwidth. Because many users through E1 invalidlink congestion, routing redirection and cause serious delayof IP data. A large number of packets to hold only 2M bandwidthof the subnet router, traffic reached 97%, resulting in subnetwork speed suddenly slow, serious congestion routerphenomenon.

4, two suggestions

(1) the.DNS server should have a regular medical examination"Based on DNS service in order to prevent instability caused bybusiness interruption or error, many network administratorsare installed in the alternate DNS server set up DNS server,which is not only the installation of a DNS server. But it alsoposes a potential danger, which is the main DNS server, backupserver automatically put into operation, it will sacrifice thenetwork bandwidth, the overall performance of the systemdecreased. The danger is that the decline in performance isoften to imperceptibly. So, in order to ensure that the networkis often in good working condition, the conversion networkmanagers need to periodically check the DNS server.

The fault at the DNS error led to the user' s IP data packetson the subnet server, but if the alignment is not a server inthe local network of network center instead of a machine, thenthe fault strength will be weakened, the user will not feel veryobviously slower. It may not feel obvious "discomfort" whichmakes the network for a long time to stop the operation. Likepeople, regular physical examination is necessary for timelydetection of disease and risk. And how to discover the problemsof routing optimization, and network test in the regularproject content on a large network, it is necessary, we mustadhere to the regular maintenance and testing.

(2) real time monitoring of network status

Many network devices such as routers, switches, hubs, can only

support SNMP network management function, but in order tomonitor the network channel function, network equipment alsoneed to support full RMON and RMON2. use this equipment set upthe network management and fault diagnosis function is verygood. But the real problem is that such a network device theprice of ordinary network equipment 6 ~ 10 times, it isdifficult for users to accept. Therefore, in order to monitorthe service flow and the proportion of application and networksources, unpack analysis records and when necessary,suggestions for users to install monitoring interface in theserver channel or channel routing. If necessary at any time willflow analyzer, network analyzer access monitoring and analysis.In this way, the fault detection time can be shortened to 20minutes or so. Of course, if the money. Xu, you can also flowanalyzer long-term access channel for a number of importantnetwork devices at full speed, transparent traffic monitoring,so that you can reduce the fault location time to less than 1m i nu t e s

This "home visit" generally works well. In fact, every visitis a chance to learn and improve. Maybe the above case is justa case. You may not meet,

But troubleshooting ideas or worth learning. In addition, Isuggest that the hope can cause everybody' s attention at theend of the two.

UCloud年度大促活动可选香港云服务器低至年134元

由于行业需求和自媒体的倾向问题,对于我们个人站长建站的方向还是有一些需要改变的。传统的个人网站建站内容方向可能会因为自媒体的分流导致个人网站很多行业不再成为流量的主导。于是我们很多个人网站都在想办法进行重新更换行业,包括前几天也有和网友在考虑是不是换个其他行业做做。这不有重新注册域名重新更换。鉴于快速上手的考虑还是采用香港服务器,这不腾讯云和阿里云早已不是新账户,考虑到新注册UCLOUD账户还算比...

酷番云78元台湾精品CN2 2核 1G 60G SSD硬盘

酷番云怎么样?酷番云就不讲太多了,介绍过很多次,老牌商家完事,最近有不少小伙伴,一直问我台湾VPS,比较难找好的商家,台湾VPS本来就比较少,也介绍了不少商家,线路都不是很好,有些需求支持Windows是比较少的,这里我们就给大家测评下 酷番云的台湾VPS,支持多个版本Linux和Windows操作系统,提供了CN2线路,并且还是原生IP,更惊喜的是提供的是无限流量。有需求的可以试试。可以看到回程...

tmhhost(100元/季)自带windows系统,香港(三网)cn2 gia、日本cn2、韩国cn2、美国(三网)cn2 gia、美国cn2gia200G高防

tmhhost可谓是相当熟悉国内网络情况(资质方面:ISP\ICP\工商齐备),专业售卖海外高端优质线路的云服务器和独立服务器,包括了:香港的三网cn2 gia、日本 cn2、日本软银云服务器、韩国CN2、美国三网cn2 gia 云服务器、美国 cn2 gia +200G高防的。另外还有国内云服务器:镇江BGP 大连BGP数据盘和系统盘分开,自带windows系统,支持支付宝付款和微信,简直就是专...

dns故障为你推荐
sonicchatwe chat和微信区别今日油条油条的由来及历史地图应用谁知道什么地图软件好用,求 最好可以看到路上行人留学生认证留学生回国学历认证 需要带什么材料xyq.163.cbg.com『梦幻西游』那藏宝阁怎么登录?seo优化工具SEO优化工具哪个好用点啊?网站检测请问论文检测网站好的有那些?同一服务器网站服务器建设:一个服务器有多个网站该如何设置?8090lu.com8090向前冲电影 8090向前冲清晰版 8090向前冲在线观看 8090向前冲播放 8090向前冲视频下载地址??m.2828dy.combabady为啥打不开了,大家帮我提供几个看电影的网址
vps侦探 ddos vps.net 512au info域名 华为4核 100m空间 免费美国空间 hdd 最漂亮的qq空间 阿里云邮箱怎么注册 googlevoice paypal兑换 neicun 电脑主机启动不了 电脑主机打不开 100m空间多少钱 美国主机购买 灵动:鬼影实录2 北京自住房申请网站 更多