DNS v2

Last update November 17, 2022 by rboucher@ns1.com

Extending pktvisor DNS handler metrics

The objective of the DNSv2 effort is to provide a number of significant enhancements to the DNS metrics currently provided by the pktvisor DNS handler, without the constraint of requiring reverse compatibility. That said, the changes should be made to be compatible as much as possible but important or significant enhancements should not be precluded because of this.

The following enhancements should be considered candidates for DNSv2:

• Normalize units of measure across similar metrics (packets versus queries versus responses versus transactions)
• Consistency of interpretation of metrics when filters are applied
• Provide explicit inbound versus outbound DNS query metrics
• Extend support of DNS transaction metrics when filters are applied (such as RCODEs)
• Support for new filters, such as
  • ANSWER payload content of responses
• Support for Prometheus/OpenMetrics style histograms

Metrics Structure

• All metrics should be based on transactions

Transaction data that needs to be cached from the query:

• QNAME
• ECS
• UDP/TCP
• Source IPv4/v6
• Destination IPv4/v6

Metric naming structure

Change: transaction direction should be a metric label called direction with possible values: in, out or unknown

The direction label behavior should be configurable using the handler filter:

...
  "filter": {
    "only_xact_directions": [ 
      "in",
      "out",
      "unknown"
    ]
  }
...

General Handler Metrics

Metric Name	Type	Unit of Measure	Metric Groups	Labels
dns_observed_packets	gauge	packets	Counters
dns_filtered_packets	gauge	packets	Counters
dns_deep_sampled_packets	gauge	packets	Counters
dns_xacts	gauge	transactions	Counters	direction
dns_ipv4_xacts	gauge	transactions	Counters	direction
dns_ipv6_xacts	gauge	transactions	Counters	direction
dns_tcp_xacts	gauge	transactions	Counters	direction
dns_udp_xacts	gauge	transactions	Counters	direction
dns_ecs_xacts	gauge	transactions	Counters	direction
dns_noerror_xacts	gauge	transactions	Counters	direction
dns_nxdomain_xacts	gauge	transactions	Counters	direction
dns_srvfail_xacts	gauge	transactions	Counters	direction
dns_refused_xacts	gauge	transactions	Counters	direction
dns_nodata_xacts	gauge	transactions	Counters	direction
dns_authenticated_data_xacts	gauge	transactions	Counters	direction
dns_authoritative_answer_xacts	gauge	transactions	Counters	direction
dns_checking_disabled_xacts	gauge	transactions	Counters	direction
dns_cardinality_qname	gauge	number	Cardinality	direction
dns_xact_rates	quantiles	transactions/sec	Quantiles	direction, quantile
dns_xact_time_us	quantiles	microseconds	XactTimes	direction, quantile
dns_top_slow_xacts	top	transactions	XactTimes	direction, qname
dns_top_noerror_xacts	top	transactions	TopRcodes	direction, qname
dns_top_nxdomain_xacts	top	transactions	TopRcodes	direction, qname
dns_top_srvfail_xacts	top	transactions	TopRcodes	direction, qname
dns_top_refused_xacts	top	transactions	TopRcodes	direction, qname
dns_top_nodata_xacts	top	transactions	TopRcodes	direction, qname
dns_top_qname2_xacts	top	transactions	TopQnames	direction, qname
dns_top_qname3_xacts	top	transactions	TopQnames	direction, qname
dns_top_ecs_xacts	top	transactions	TopEcs	direction, ecs
dns_top_ecs_geo_xacts	top	transactions	TopGeo	direction, geo
dns_top_ecs_asn_xacts	top	transactions	TopAsn	direction, asn
dns_top_qtype_xacts	top	transactions	TopQtypes	direction, qtype
dns_top_udp_port_xacts	top	transactions	TopPorts	direction, port
dns_top_response_bytes	top	bytes	TopSize	direction, qname
dns_response_query_size_ratio	quantiles	ratio	TopSize	direction, quantile
dns_timeout_queries	gauge	queries	Counters	direction
dns_orphan_responses	gauge	responses	Counters	direction

DNSTAP Specific Metrics

Metric Name	Type	Unit of Measure	Metric Groups	Labels
dns_dot_xacts	gauge	transactions	Counters	direction
dns_doh_xacts	gauge	transactions	Counters	direction
dns_dnscrypt_udp_xacts	gauge	transactions	Counters	direction
dns_dnscrypt_tcp_xacts	gauge	transactions	Counters	direction
dns_doq_xacts	gauge	transactions	Counters	direction

Metrics for Future Consideration

The following metrics have been identified for future development. They will not be implemented for now.

Metric Name	Type	Unit of Measure	Metric Groups	Labels
dns_dnssec_ok_xacts	gauge	transactions	Counters	direction
dns_dnssec_xacts	gauge	transactions	Counters	direction
dns_timeout_udp_queries	gauge	queries	TimeoutDetails	direction
dns_timeout_tcp_queries	gauge	queries	TimeoutDetails	direction
dns_timeout_ipv4_queries	gauge	queries	TimeoutDetails	direction
dns_timeout_ipv6_queries	gauge	queries	TimeoutDetails	direction
dns_timeout_top_qname_queries	top	queries	TimeoutDetails	direction, qname
dns_timeout_top_asn_queries	top	queries	TimeoutDetails	direction, asn
dns_timeout_top_geo_queries	top	queries	TimeoutDetails	direction, geo
dns_timeout_top_src_ipv4_queries	top	queries	TimeoutDetails	direction, ip
dns_timeout_top_src_ipv6_queries	top	queries	TimeoutDetails	direction, ip
dns_timeout_top_dst_ipv4_queries	top	queries	TimeoutDetails	direction, ip
dns_timeout_top_dst_ipv6_queries	top	queries	TimeoutDetails	direction, ip
dns_orphan_udp_responses	gauge	responses	OrphanDetails	direction
dns_orphan_tcp_responses	gauge	responses	OrphanDetails	direction
dns_orphan_ipv4_responses	gauge	responses	OrphanDetails	direction
dns_orphan_ipv6_responses	gauge	responses	OrphanDetails	direction
dns_orphan_top_qname_responses	top	responses	OrphanDetails	direction, qname
dns_orphan_top_asn_responses	top	responses	OrphanDetails	direction, asn
dns_orphan_top_geo_responses	top	responses	OrphanDetails	direction, geo
dns_orphan_top_src_ipv4_responses	top	responses	OrphanDetails	direction, ip
dns_orphan_top_src_ipv6_responses	top	responses	OrphanDetails	direction, ip
dns_orphan_top_dst_ipv4_responses	top	responses	OrphanDetails	direction, ip
dns_orphan_top_dst_ipv6_responses	top	responses	OrphanDetails	direction, ip