Missing Flows when reverse DNS is enabled?

Description

It is possible that large numbers of in-flight DNS requests can cause incoming Flows to be dropped. A spike of latency at the DNS resolver or simply too many requests for it to handle can result in data loss.

Acceptance / Success Criteria

None

Attachments

2
  • 26 Oct 2020, 04:29 PM
  • 26 Oct 2020, 04:29 PM
100% Done
0

Lucidchart Diagrams

Activity

Show:

fooker November 26, 2020 at 11:00 PM

Benjamin Reed November 2, 2020 at 6:09 PM

Seems like at this point step 1 is to add some tracing to the process of enriching flows with DNS so we can figure out where the bottleneck is.  do you have familiarity with the tracing stuff to be able to do that?

Zoë Knox October 26, 2020 at 4:30 PM

With reverse DNS enabled:

With reverse DNS disabled:

Fixed

Details

Assignee

Reporter

Docs Needed

No

Internal Priority

High Medium

FD#

Components

Sprint

Fix versions

Affects versions

Priority

PagerDuty

Created October 26, 2020 at 4:21 PM
Updated July 6, 2021 at 2:51 PM
Resolved May 12, 2021 at 3:17 PM

Flag notifications