DNS v2

Last update November 3, 2022 by rboucher@ns1.com

Extending pktvisor DNS handler metrics

The objective of the DNSv2 effort is to provide a number of significant enhancements to the DNS metrics currently provided by the pktvisor DNS handler, without the constraint of requiring reverse compatibility. That said, the changes should be made to be compatible as much as possible but important or significant enhancements should not be precluded because of this.

The following enhancements should be considered candidates for DNSv2:

• Normalize units of measure across similar metrics (packets versus queries versus responses versus transactions)
• Consistency of interpretation of metrics when filters are applied
• Provide explicit inbound versus outbound DNS query metrics
• Extend support of DNS transaction metrics when filters are applied (such as RCODEs)
• Support for new filters, such as
  • ANSWER payload content of responses
• Support for Prometheus/OpenMetrics style histograms

Metrics Structure

• All metrics should be based on transactions

Transaction data that needs to be cached from the query:

• QNAME
• ECS
• UDP/TCP
• Source IPv4/v6
• Destination IPv4/v6

Metric naming structure

Change: transaction direction should be a metric label called direction with possible values: in, out or unknown

The direction label behavior should be configurable using the handler filter:

...
  "filter": {
    "only_xacts_directions": [ 
      "in",
      "out",
      "unknown"
    ]
  }
...

Metric Name	Type	Unit of Measure	Metric Groups	Labels
dns_observed_packets	gauge	packets	Counters
dns_filtered_packets	gauge	packets	Counters
dns_deep_sampled_packets	gauge	packets	Counters
dns_xacts	gauge	transactions	Counters, In/Out/Unknown	direction
dns_ipv4_xacts	gauge	transactions	Counters, In/Out/Unknown	direction
dns_ipv6_xacts	gauge	transactions	Counters, In/Out/Unknown	direction
dns_tcp_xacts	gauge	transactions	Counters, In/Out/Unknown	direction
dns_udp_xacts	gauge	transactions	Counters, In/Out/Unknown	direction
dns_dnssec_xacts	gauge	transactions	Counters, In/Out/Unknown	direction
dns_ecs_xacts	gauge	transactions	Counters, In/Out/Unknown	direction
dns_noerror_xacts	gauge	transactions	Counters, In/Out/Unknown	direction
dns_nxdomain_xacts	gauge	transactions	Counters, In/Out/Unknown	direction
dns_srvfail_xacts	gauge	transactions	Counters, In/Out/Unknown	direction
dns_refused_xacts	gauge	transactions	Counters, In/Out/Unknown	direction
dns_nodata_xacts	gauge	transactions	Counters, In/Out/Unknown	direction
dns_cardinality_qname	gauge	number	Cardinality, In/Out/Unknown	direction
dns_xact_rates	quantiles	transactions/sec	Quantiles, In/Out/Unknown	direction, quantile
dns_xact_time_us	quantiles	microseconds	Quantiles, In/Out/Unknown	direction, quantile
dns_top_noerror_xacts	top	transactions	TopRcodes, In/Out/Unknown	direction, qname
dns_top_nxdomain_xacts	top	transactions	TopRcodes, In/Out/Unknown	direction, qname
dns_top_srvfail_xacts	top	transactions	TopRcodes, In/Out/Unknown	direction, qname
dns_top_refused_xacts	top	transactions	TopRcodes, In/Out/Unknown	direction, qname
dns_top_nodata_xacts	top	transactions	TopRcodes, In/Out/Unknown	direction, qname
dns_top_qname2_xacts	top	transactions	TopQnames, In/Out/Unknown	direction, qname
dns_top_qname3_xacts	top	transactions	TopQnames, In/Out/Unknown	direction, qname
dns_top_ecs_xacts	top	transactions	TopEcs, In/Out/Unknown	direction, ecs
dns_top_ecs_geo_xacts	top	transactions	TopGeo, In/Out/Unknown	direction, geo
dns_top_ecs_asn_xacts	top	transactions	TopAsn, In/Out/Unknown	direction, asn
dns_top_qtype_xacts	top	transactions	TopQtypes, In/Out/Unknown	direction, qtype
dns_top_slow_xacts	top	transactions	TopSlow, In/Out/Unknown	direction, qname
dns_top_udp_port_xacts	top	transactions	TopPorts, In/Out/Unknown	direction, port
dns_top_response_bytes	top	bytes	TopSize, In/Out/Unknown	direction, qname
dns_response_query_size_ratio	quantiles	ratio	TopSize, In/Out/Unknown	direction, quantile
dns_timeout_queries	gauge	queries	Counters, In/Out/Unknown	direction
dns_timeout_udp_queries	gauge	queries	TimeoutDetails, In/Out/Unknown	direction
dns_timeout_tcp_queries	gauge	queries	TimeoutDetails, In/Out/Unknown	direction
dns_timeout_ipv4_queries	gauge	queries	TimeoutDetails, In/Out/Unknown	direction
dns_timeout_ipv6_queries	gauge	queries	TimeoutDetails, In/Out/Unknown	direction
dns_timeout_top_qname_queries	top	queries	TimeoutDetails, In/Out/Unknown	direction, qname
dns_timeout_top_asn_queries	top	queries	TimeoutDetails, In/Out/Unknown	direction, asn
dns_timeout_top_geo_queries	top	queries	TimeoutDetails, In/Out/Unknown	direction, geo
dns_timeout_top_src_ipv4_queries	top	queries	TimeoutDetails, In/Out/Unknown	direction, ip
dns_timeout_top_src_ipv6_queries	top	queries	TimeoutDetails, In/Out/Unknown	direction, ip
dns_timeout_top_dst_ipv4_queries	top	queries	TimeoutDetails, In/Out/Unknown	direction, ip
dns_timeout_top_dst_ipv6_queries	top	queries	TimeoutDetails, In/Out/Unknown	direction, ip
dns_orphan_responses	gauge	responses	Counters, In/Out/Unknown	direction
dns_orphan_udp_responses	gauge	responses	OrphanDetails, In/Out/Unknown	direction
dns_orphan_tcp_responses	gauge	responses	OrphanDetails, In/Out/Unknown	direction
dns_orphan_ipv4_responses	gauge	responses	OrphanDetails, In/Out/Unknown	direction
dns_orphan_ipv6_responses	gauge	responses	OrphanDetails, In/Out/Unknown	direction
dns_orphan_top_qname_responses	top	responses	OrphanDetails, In/Out/Unknown	direction, qname
dns_orphan_top_asn_responses	top	responses	OrphanDetails, In/Out/Unknown	direction, asn
dns_orphan_top_geo_responses	top	responses	OrphanDetails, In/Out/Unknown	direction, geo
dns_orphan_top_src_ipv4_responses	top	responses	OrphanDetails, In/Out/Unknown	direction, ip
dns_orphan_top_src_ipv6_responses	top	responses	OrphanDetails, In/Out/Unknown	direction, ip
dns_orphan_top_dst_ipv4_responses	top	responses	OrphanDetails, In/Out/Unknown	direction, ip
dns_orphan_top_dst_ipv6_responses	top	responses	OrphanDetails, In/Out/Unknown	direction, ip