ats-tls is performing 3k DNS queries per second on cp5001
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Vgutierrez
	Sep 6 2019, 11:01 AM

Description

ATS is trying to resolve 127.0.0.2 almost 3k per second on cp5001:

10:42:06.662114 IP cp5001.eqsin.wmnet.51789 > recdns.anycast.wmnet.domain: 30362+ PTR? 2.0.0.127.in-addr.arpa. (40)
10:42:06.662204 IP recdns.anycast.wmnet.domain > cp5001.eqsin.wmnet.51789: 30362 NXDomain 0/1/0 (89)

This is triggered by the remap rule:

map / http://127.0.0.2:3120

Details

	Subject	Repo	Branch	Lines +/-
	ATS: Disable DNS resolution for TLS instance	operations/puppet	production	+6 -0

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Open	None	T92298 Investigate our mitigation strategy for HTTPS response length attacks
Resolved	Vgutierrez	T170567 Support TLSv1.3
Resolved	Vgutierrez	T231433 Move cache upload cluster from nginx to ats-tls
Resolved	Vgutierrez	T232209 ats-tls is performing 3k DNS queries per second on cp5001

Event Timeline

Vgutierrez created this task.Sep 6 2019, 11:01 AM

Change 534783 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] ATS: Disable DNS resolution for TLS instance

https://gerrit.wikimedia.org/r/534783

gerritbot added a project: Patch-For-Review.Sep 6 2019, 11:06 AM

Change 534783 merged by Vgutierrez:
[operations/puppet@production] ATS: Disable DNS resolution for TLS instance

https://gerrit.wikimedia.org/r/534783

Vgutierrez closed this task as Resolved.Sep 6 2019, 1:27 PM

Vgutierrez triaged this task as Medium priority.

Maintenance_bot removed a project: Patch-For-Review.Sep 6 2019, 2:10 PM

Vgutierrez mentioned this in T242778: ATS strict round robin parent select policy doesn't work as expected.Jan 15 2020, 10:07 AM