[ratelimits] dramatic effect of turning on RRL in BIND

[Paul Vlaar]

On 28/12/12 4:37 PM, Pierre Baume wrote:
>   Just out of curiosity, what's the color-coding on the graph (and/or
> does it come from a standard package)?

The colors are just our different network paths in and out of this
anycast node. I left out the legend to anonymize our data as much as
possible, but it's really not that exciting :)

The package I use for graphing our traffic and also some parts of our
DNS counters (such as which servers receive and send how many queries)
is called Cacti: http://www.cacti.net/  What I showed was just raw
traffic stats.

I've attached another Cacti-generated graph that shows the amount of DNS
qps versus rps in one particular node, so actually showing RRL
effectiveness. And an "aggregate" graph is also attached, created using
a plugin for Cacti which can be easily applied for adding up RRD data
sources.

I find Cacti a highly versatile package for graphing all sorts of
things, but it can take some work to get it all together. In this case,
I'm using Duane Wessel's dnstop as the underlying tool for counting DNS
queries and replies, from pcaps generated via port mirroring, and the
values from the capture servers are being read by Cacti via SNMP.

	~paul

-- 
Paul Vlaar
Content Propagation and Resolution
Afilias

e-mail: pvlaar at afilias.info
phone: +1-416-673-4078
mobile: +31-6-506-306-35
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screen Shot 2012-12-28 at 5.16.02 PM.png
Type: image/png
Size: 54334 bytes
Desc: not available
URL: <http://lists.redbarn.org/pipermail/ratelimits/attachments/20121228/ce970bc1/attachment-0002.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screen Shot 2012-12-28 at 5.18.00 PM.png
Type: image/png
Size: 119345 bytes
Desc: not available
URL: <http://lists.redbarn.org/pipermail/ratelimits/attachments/20121228/ce970bc1/attachment-0003.png>