DSC is an application for collecting and analyzing statistics from busy DNS servers. The application may be run directly on a DNS node or may be run on a standalone system that is configured to "capture" bi-directional traffic for a DNS node. DSC captures statistics such as: query types, return codes, most-queried TLDs, popular names, IPv6 root abusers, query name lengths, reply lengths, and much more. These statistics can aid operators in tracking or analyzing a wide range of problems including: excessive queriers, misconfigured systems, DNS software bugs, traffic count (packets/bytes), and possibly routing problems.

DSC can store data indefinitely, providing you with long-term, historical statistics related to your DNS traffic. In addition to DSC's operational utility, you will also find the historical data very useful for research, whether you share the data with OARC, researchers, or your own internal engineering groups.

While we are always anxious to have root/TLD operators join OARC, and submit DSC data for the benefit of other members and the research community, we are also anxious to have operators deploy DSC and use the data for their own benefit.

The latest version of DSC is attached at the bottom of this page. Full documentation is included in the source package. You can view the FAQ for DSC here.

DSC is developed and maintained by The Measurement Factory.

DSC currently has two major components:


Collector

The collector process uses libpcap to receive DNS messages sent and received on a network interface. It may run on the same machine as the DNS server, or on another system connected to a switch configured with port mirroring. A configuration file defines some number of datasets and other options. Datasets are dumped to disk every 60 seconds as XML files. A cron job copies the XML files to a separate server for archiving and further processing.


Presenter

This component receives XML datasets from collectors. Since parsing XML files is slower than we'd like, an extractor process converts them to another format. Currently that format is a line-based text file, although we may use a relational database in the future.

DSC uses a CGI script to display data in a web browser. The interface allows you to change time scales, select particular nodes within a server cluster, and isolate individual dataset keys.