A distributed DNS traffic monitoring system

The domain name system (DNS) is a complex distributed database on which most Internet services rely on. As its monitoring is critical, it is necessary to continuously monitor DNS traffic for identifying anomalies, measuring performance, and generating usage statistics. This paper describes the design and implementation of a distributed realtime DNS monitoring system, that is able to monitor the authoritative name servers of the it country code Top Level Domain (ccTLD). In addition to the production of usage records, it is able to understand trends, characterize economical relationships, and also track suspicious activities.