但2002 年10月21日，對Internet的13台DNS根網域名稱伺服器的持續了一個小時的拒絕服務的攻擊，給人們敲響了警鐘，採用新的演算法，提升DNS效能，是一 種方法，Nominum出繼續升級免費的BIND外，還開發了新演算法的Nominum Foundation CNS DNS軟體，有好事同事，改不了工程師的老毛病，好奇並對BIND和Nominum的效能進行了對比測試，分享如下：
1。準備機器：
採用Sun Fire V240伺服器，1x 1GHz USIIIi, 512MB記憶體，4x 1000Base-T網口，裝Solaris 10， Sun Studio 10, 聯通到Internet外網。
v240:/# showrev
Hostname: v240
Hostid: 838af0bd
Release: 5.10
Kernel architecture: sun4u
Application architecture: sparc
Hardware provider: Sun_Microsystems
Domain:
Kernel version: SunOS 5.10 Generic_118822-08
v240:/# cd /opt/SUNWspro/bin
v240:/# ./version
Machine hardware: sun4u
OS version: 5.10
Processor type: sparc
...
Sun Studio 10
Sun Studio 10 C Compiler
Sun Studio 10 C++ Compiler
Sun Studio 10 Tools.h++ 7.1
...
v240:/# which cc
/opt/SUNWspro/bin/cc
2。配DNS - DIND 9.2.4
配主機檔案：
v240:/# vi /etc/hosts
#
# Internet host table
#
127.0.0.1 localhost
192.168.0.55 v240 v240.example.com loghost
開啟DNS開關檔案：
v240:/# cd vi /etc/nsswith.conf
...
hosts: files dns
...
配DNS client檔案，DNS client指向網通和本機：
v240# vi /etc/resolv.conf
nameserver 192.168.0.55 //本機IP
nameserver 202.x.x.x //xxDNS
配DNS伺服器rndc 檔案：
v240# vi /etc/rndc.conf
# Start of rndc.conf
key "rndc-key" {
algorithm hmac-md5;
secret "qb2cKV1j07PXbv//QQPytA==";
};
options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};
# End of rndc.conf
配DNS伺服器named.conf檔案：
v240# vi /etc/named.conf
key "rndc-key" {
algorithm hmac-md5;
secret "qb2cKV1j07PXbv//QQPytA==";
};
controls {
inet 127.0.0.1 port 953
allow { 127.0.0.1; } keys { "rndc-key"; };
};
options {
version "$Id, worldhello.net";
directory "/var/named";
pid-file "named.pid";
allow-query { any; };
notify yes;
recursion yes;
};
zone "." in {
type hint;
file "db.cache";
};
zone "example.com" in {
type master;
file "db.example.com";
};
zone "0.168.192.in-addr.arpa" in {
type master;
file "db.0.168.192";
};
zone "0.0.127.in-addr.arpa" in {
type master;
file "db.local";
};
配DNS伺服器cache檔案：
v240# vi /var/named/db.cache
. 3600000 NS D.ROOT-SERVERS.NET.
D.ROOT-SERVERS.NET. 3600000 A 128.8.10.90
;
; formerly NS.NASA.GOV
;
. 3600000 NS E.ROOT-SERVERS.NET.
E.ROOT-SERVERS.NET. 3600000 A 192.203.230.10
;
; formerly NS.ISC.ORG
;
. 3600000 NS F.ROOT-SERVERS.NET.
F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241
;
; formerly NS.NIC.DDN.MIL
;
. 3600000 NS G.ROOT-SERVERS.NET.
G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4
;
; formerly AOS.ARL.ARMY.MIL
;
. 3600000 NS H.ROOT-SERVERS.NET.
H.ROOT-SERVERS.NET. 3600000 A 128.63.2.53
;
; formerly NIC.NORDU.NET
;
. 3600000 NS I.ROOT-SERVERS.NET.
I.ROOT-SERVERS.NET. 3600000 A 192.36.148.17
;
; temporarily housed at NSI (InterNIC)
;
. 3600000 NS J.ROOT-SERVERS.NET.
J.ROOT-SERVERS.NET. 3600000 A 198.41.0.10
;
; housed in LINX, operated by RIPE NCC
;
. 3600000 NS K.ROOT-SERVERS.NET.
K.ROOT-SERVERS.NET. 3600000 A 193.0.14.129
;
; temporarily housed at ISI (IANA)
;
. 3600000 NS L.ROOT-SERVERS.NET.
L.ROOT-SERVERS.NET. 3600000 A 198.32.64.12
;
; housed in Japan, operated by WIDE
;
. 3600000 NS M.ROOT-SERVERS.NET.
M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33
配DNS伺服器本機檔案：
v240# vi /var/named/db.local
$TTL 5h
0.0.127.in-addr.arpa. IN SOA example.com. root.example.com. (
1999062801 ;serial number (yyymmmdd##)
10800 ;refresh every 3 hours
3600 ;retry every 1 hours
604800 ;expore after a week
86400 ) ;TTL of 1 day
; Name servers
0.0.127.in-addr.arpa. IN NS v240.example.com.
1 IN PTR localhost
配DNS伺服器本彧檔案：
v240# vi /var/named/db.example.com
$TTL 5h
example.com. IN SOA example.com. root.example.com. (
1999062804 ;serial number (yyymmmdd##)
10800 ;refresh every 3 hours
3600 ;retry every 1 hours
604800 ;expore after a week
86400 ) ;TTL of 1 day
; Name servers
example.com. IN NS v240.example.com.
; Addresses
localhost IN A 127.0.0.1
v240.example.com. IN A 192.168.0.55
v20z IN A 192.168.0.50
配DNS伺服器反向檔案：
v240# vi /var/named/db.0.168.192
$TTL 5h
0.168.192.in-addr.arpa. IN SOA example.com. root.example.com. (
1999070501 ;serial number (yyymmmdd##)
10800 ;refresh every 3 hours
3600 ;retry every 1 hours
604800 ;expore after a week
86400 ) ;TTL of 1 day
; Name servers
1.1.10.in-addr.arpa. IN NS v240.example.com.
55 IN PTR v240.example.com.
50
啟動DNS服務：
v240# svcs -a |grep dns
disabled 18:11:53 svc:/network/dns/server:default
online 18:12:42 svc:/network/dns/client:default
v240# svcs -a |grep dns
v240# svcadm enable svc:/network/dns/server:default
實驗DNS解析:
v240# bslookup
(可用www.sohu.com等）
v240# dig @202.106.0.20
; <<>;>; DiG 9.2.4 <<>;>; @202.106.0.20
;; global options: printcmd
;; Got answer:
;; ->;>;HEADER<<- opcode: QUERY, status: NOERROR, id: 83
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 13
;; QUESTION SECTION:
;. IN NS
;; ANSWER SECTION:
. 86440 IN NS B.ROOT-SERVERS.NET.
. 86440 IN NS C.ROOT-SERVERS.NET.
....
3。安裝queryperf測試程式：
解queryperf包：
v240# gzcat queryperf-nominum-2.1.tar.gz |tar xvf -
x queryperf-nominum-2.1, 0 bytes, 0磁帶塊
x queryperf-nominum-2.1/input, 0 bytes, 0磁帶塊
x queryperf-nominum-2.1/input/sample.0, 101 bytes, 1磁帶塊
x queryperf-nominum-2.1/input/sample.1, 304 bytes, 1磁帶塊
...
編譯：
v240# ./configure
checking for gcc... gcc
checking for C compiler default output... a.out
checking whether the C compiler works... yes
...
v240# make
gcc -DPACKAGE_NAME=/"/" -DPACKAGE_TARNAME=/"/" -DPACKAGE_VERSION=/"/" -DPACKAGE_STRING=/"/" -DPACKAGE_BUGREPORT=/"/" -DHAVE_LIBSOCKET=1 -DHAVE_LIBNS
L=1 -DHAVE_GETADDRINFO=1 -DHAVE_GETNAMEINFO=1 -c queryperf.c
gcc -DPACKAGE_NAME=/"/" -DPACKAGE_TARNAME=/"/" -DPACKAGE_VERSION=/"/" -DPACKAGE_STRING=/"/" -DPACKAGE_BUGREPORT=/"/" -DHAVE_LIBSOCKET=1 -DHAVE_LIBNS
L=1 -DHAVE_GETADDRINFO=1 -DHAVE_GETNAMEINFO=1 queryperf.o -lnsl -lsocket -lresolv -lm -o queryperf
...
4。測試BIND 9.2.4
編輯包含測試網域名稱的test檔案（>; 30000個測試網域名稱）：
v240# vi test
www.sina.com.cn A
www.sohu.com A
www.sun.com A
...
(more than 30000)
向Sun Fire V240發出帶30000測試網域名稱的請求：
v240:/# ./queryperf -d test -s 192.168.0.55
DNS Query Performance Testing Tool
Nominum Version 2.1
Version: $Id: queryperf.c,v 1.20 2005/03/08 19:10:03 gson Exp $
[Status] Processing input data
[Status] Sending queries (beginning with 192.168.0.55)
[Timeout] Query timed out: msg id 1
[Timeout] Query timed out: msg id 3
[...
Warning: Received a response with an unexpected (maybe timed out) id: 28
[Status] Testing complete
Statistics:
Parse input file: once
Ended due to: reaching end of file
Queries sent: 33000 queries
Queries completed: 32980 queries
Queries lost: 20 queries
Percentage completed: 99.94%
Percentage lost: 0.06%
Started at: Fri Jul 8 14:48:36 2005
Finished at: Fri Jul 8 14:48:53 2005
Ran for: 17.379295 seconds
Queries per second: 1897.660406 qps
即Sun Fire V240(1x 1Ghz USIIIi, 512MB記憶體）,在此測試環境下，處理 DNS請求1897.7個每秒，丟失率0.06%。
5。安裝Nominum Foundation CNS DNS軟體
修改配置並卸載BIND DNS服務：
v240:/# pkill -9 named
v240:/# svcadm disable svc:/network/dns/server:default
v240:/# vi /etc/resolv.conf
nameserver 192.168.0.20 //本機IP
解Nominum Foundation CNS包：
v240:/# uncompress cns-1.5.3.2e-2-2005.10.01-solaris-10-sparc.tar.Z
v240:/# tar xvf cns-1.5.3.2e-2-2005.10.01-solaris-10-sparc.tar
安裝Nominum Foundation CNS：
v240:/# pkgadd -d nomutils-2.0.27.0.1-sol10-sparc
v240:/# pkgadd -d cns-1.5.3.2.2-sol10-sparc
v240:/# pkgadd -d nomnanny-2.0.27.0.1-sol10-sparc
v240:/# pkgadd -d nomsdk-2.0.27.1.1-sol10-sparc
v240:/# pkgadd -d snmpproxy-1.0.3.3.3-sol10-sparc
（回答都是yes)
啟動Nominum Foundation CNS DNS服務：
v240:/# /etc/init.d/cns start
6。測試DNS - Nominum Foundation CNS
測試網域名稱同BIND 9.2.4
10 或 100個並發，向Sun Fire V240發大於30000個DNS請求：
v240:/# ./queryperf -d test -s v240 -q 10
DNS Query Performance Testing Tool
Nominum Version 2.1
Version: $Id: queryperf.c,v 1.20 2005/03/08 19:10:03 gson Exp $
[Status] Processing input data
[Status] Sending queries (beginning with 192.168.0.55)
[Status] Testing complete
Statistics:
Parse input file: once
Ended due to: reaching end of file
Queries sent: 33000 queries
Queries completed: 33000 queries
Queries lost: 0 queries
Percentage completed: 100.00%
Percentage lost: 0.00%
Started at: Fri Jul 8 15:41:28 2005
Finished at: Fri Jul 8 15:41:32 2005
Ran for: 4.336514 seconds
Queries per second: 7609.799023 qps
即Sun Fire V240(1x 1Ghz USIIIi, 512MB記憶體）,在此測試環境下，處理 DNS請求7609.8個每秒，無丟失0.00%。
效能提高：
7609.8個每秒 / 1897.7個每秒 = 4.01 倍
(Sun Fire V20z, 1x 1.6GHz AMD Opteron, 20354 qps)
7。結論
Nominum是 BIND和Nominum Foundation CNS的開發人員，真的就在1個CPU，512MB記憶體的小伺服器上， DNS效能能相差4倍的嗎？測試數值顯示的是這樣，但測試方法有何不妥之處呢？我自己有點疑問，請點評。
如真是這樣，常見省級DNS處理約4000qps, 豈不1個CPU就搞定啦？但電信常配Sun Fire V890伺服器，8x雙core，效能能否就說是16x倍呢？
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
