17 replies to this topic 3 votes

[+BudMan]

Are you jumping around with IPs like crazy?? Why in the world would the TTL for both the NS and A and cname be 60 seconds?

I was looking at dns queries -- and couldn't figure out why so many to neowin. Then I took a look at the ttl

******
;; ANSWER SECTION:
www.neowin.net. 60 IN CNAME neowin.net.
neowin.net. 60 IN A 74.204.71.245
neowin.net. 60 IN A 74.204.71.246
neowin.net. 60 IN A 74.204.71.247

;; AUTHORITY SECTION:
neowin.net. 60 IN NS ns3.neowin.net.
neowin.net. 60 IN NS ns1.neowin.net.
neowin.net. 60 IN NS ns2.neowin.net.

;; ADDITIONAL SECTION:
ns1.neowin.net. 60 IN A 74.204.71.249
ns2.neowin.net. 60 IN A 74.204.71.250
ns3.neowin.net. 60 IN A 208.43.57.26
********
Unless these IP are changing every couple of minutes -- why such a low TTL? Even freaking google does not have a 60 second ttl.

;; ANSWER SECTION:
www.google.com. 604800 IN CNAME www.l.google.com.
www.l.google.com. 300 IN A 74.125.225.146
www.l.google.com. 300 IN A 74.125.225.147
www.l.google.com. 300 IN A 74.125.225.144
www.l.google.com. 300 IN A 74.125.225.145
www.l.google.com. 300 IN A 74.125.225.148

See the length of that cname -- thats because they KNOW its not going to change.. Sure the A's that it points to do, so 5 minutes you have to recheck those. But neowin is 1 minute every single dns server on the planet that has users asking for neowin.net have to come and talk to one of the 3 ns every freaking minute. Not counting the extra traffic to re lookup the NS for neowin your causing.

That is just nuts!!!

[Neobond]

Told Dave, because I can't answer this

[DaveLegg]

It's low from when we last moved the servers, TTL doesn't get changed that often, and I simply forgot to raise it back again. I have done so now.

[+BudMan]

how often do change the 3 ips you have listed? 300 is still seems WAY to low for such a site.. Why would you want that added dns traffic?

Do you really move IPs that often?? You lower your ttl as you get close to a move - or if you expect an issue where you will be changing IPs on the fly, etc.

I see you bumped up the cname and ns to 6 hours..

But really 5 minutes on these ips
neowin.net. 205 IN A 74.204.71.247
neowin.net. 205 IN A 74.204.71.246
neowin.net. 205 IN A 74.204.71.245

You have been using the same IPs since what aug 2011 or something, this is what netcraft shows. Do you really need the extra dns traffic?

You could be talking some significant amount of bandwidth. I would assume with the number of users for neowin globally - that there is quite a bit of traffic.. Why not make that 5 minutes 1 hour, 12 hours? What are the odds that your IPs are going to change? Really..

Just talking a move to 1 hour vs 5 minutes would cut your dns to 1/12 of its current level??

If you plan a move to new servers or something in the future - then you just lower the ttl as you get close to the cut over. So that there is min amount of time before everyone sees the new ips. But I would think your generating significant traffic to your servers for no reason.

[+remixedcat]

If it's on a load balanced platform it might jump around like that....

[Neobond]

We do use load balancing.

[+BudMan]

load balanced or just round robin dns? Which is NOT load balancing btw, load distribution sure.. Unless you are using some form of api to change the order of the IPs based returned by your name server upon load on the server at any given moment, than its not load balancing if your only doing it with dns. There are ways to do this -- but I'm pretty sure you just doing the generic round robin order of the 3 ips returned.

Either way your handing out the 3 ips.. Does not mater if you hand them out for 5 minutes or 1 hour or 12.. Your still handing out the 3.. The isp dns once cached will round robin through them.

This is to my server - 3 queries back to back..
C:\Windows\System32>dig www.neowin.net +short
neowin.net.
74.204.71.246
74.204.71.245
74.204.71.247

C:\Windows\System32>dig www.neowin.net +short
neowin.net.
74.204.71.245
74.204.71.247
74.204.71.246

C:\Windows\System32>dig www.neowin.net +short
neowin.net.
74.204.71.247
74.204.71.246
74.204.71.245

Notice how the order changes.. This is from my cached server. All within the current ttl.

Does not matter if that ttl is 5 minutes or 12 hours. Still going to change the order every time a client asks. They are just going to ask less often is all -- the order of the ips the given is going to be distributed to the clients in different order. So globally you still get load across all 3 of your servers.

Just look at one isp dns for example - say comcast.

C:\Windows\System32>dig @75.75.75.75 www.neowin.net +short
neowin.net.
74.204.71.246
74.204.71.247
74.204.71.245

C:\Windows\System32>dig @75.75.75.75 www.neowin.net +short
neowin.net.
74.204.71.247
74.204.71.245
74.204.71.246

C:\Windows\System32>dig @75.75.75.75 www.neowin.net +short
neowin.net.
74.204.71.247
74.204.71.245
74.204.71.246

Order is changed every time I queried it. Now there is nothing saying that client has to go to 1st ip given, but that is normally the case. So now first isp client will go to ip 1, 2nd client that queries would go to ip 2, etc.. So your still distributing the load across the number of clients. Just not having to come ask your server every 5 minutes if the ips changed.

Your distributing the requests across the IPs - this is load distribution. In this case does not matter if you have 5 minute ttl or 12 hour.. Other than load on your DNS!! That is for sure!

You don't need a low ttl to distribute your load across your 3 ips.. But that will for sure generate way more traffic to your dns. That is just not needed..

I have to assume neowin.net has to pay for bandwidth they use?? Right -- so why have more traffic to your servers than needed. You don't need a 300 second ttl to distribute the load across your 3 ips. A 12 hour would do the same thing.

[Hum]

It's enuff that Neowin works.

[Miuku.]

Even if they had 500,000,000 DNS queries per month, it would be less than your average animated .gif on these forums.

Seriously though, the average query is what.. few hundred bytes tops - you might shave a little bandwidth here and there but I doubt it would make much of a difference in the hosting bill for Neowin.

And as for the comparison to "getting nowhere", people who tend to only view minuscule details lack the ability to look at the big picture - if we only dedicated ourselves to examining the most efficient way to do something, we would have spent so much time trying to perfect things we would have gotten nowhere either.

[+BudMan]

So 500 million queries * 100 bytes = 50GB of traffic.. What you don't think they pay for that? Why not make it 4GB with one simple change to 1 hour vs 5 minutes on their ttl?

And your talking more than 100bytes, with just the simple query for www.neowin.net returns

;; MSG SIZE rcvd: 207

So with your 500 million example your talking 103GBytes of traffic. This is nothing to sneeze at.. And I would bet they are seeing way more than 500 million queries a month to be honest..

[-Alex-]

BudMan, on 07 May 2012 - 17:17, said:

So 500 million queries * 100 bytes = 50GB of traffic.. What you don't think they pay for that? Why not make it 4GB with one simple change to 1 hour vs 5 minutes on their ttl?

And your talking more than 100bytes, with just the simple query for www.neowin.net returns

;; MSG SIZE rcvd: 207

So with your 500 million example your talking 103GBytes of traffic. This is nothing to sneeze at.. And I would bet they are seeing way more than 500 million queries a month to be honest..

Good answer!

[b10h4z4rd]

There are reasons and it's fine as it is right now.

[+cooky560]

PING neowin.net (74.204.71.247): 56 data bytes
64 bytes from 74.204.71.247: icmp_seq=0 ttl=51 time=121.680 ms
64 bytes from 74.204.71.247: icmp_seq=1 ttl=51 time=123.945 ms
64 bytes from 74.204.71.247: icmp_seq=2 ttl=51 time=133.143 ms

--- neowin.net ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 121.680/126.256/133.143/4.957 ms

Neowin seems to have connection issues. If I compare this result with say google:


PING google.com (173.194.34.166): 56 data bytes
64 bytes from 173.194.34.166: icmp_seq=0 ttl=57 time=28.229 ms
64 bytes from 173.194.34.166: icmp_seq=1 ttl=57 time=37.363 ms

--- google.com ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 28.229/32.796/37.363/4.567 ms

[+remixedcat]

I do notice that the site is pretty slow from time to time... this could be an explanation...

[xendrome]

<<Thread Cleaned>>