Transcription
Neustar UltraDNS Managed ServicesReport Center Getting Started GuideVersion 3.0Neustar, Inc. AbstractThis document introduces the Neustar UltraDNS Managed Services Report Center and its extensivereporting capabilities that: Identify configuration issuesAssess the impact of changesMonitor resolution performanceIsolate traffic for trends and problem determination and resolutionNeustar, Inc.21575 Ridgetop CircleSterling, VA 20166Phone : (855) 638-2677www.neustarultraservices.biz/
This document is for informational purposes only. NEUSTAR MAKES NOWARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION INTHIS DOCUMENT.Complying with all applicable copyright laws is the responsibility of the user.Without limiting the rights under copyright, no part of this document may bereproduced, stored in or introduced into a retrieval system, or transmitted in anyform or by any means (electronic, mechanical, photocopying, recording, orotherwise), or for any purpose, without the express written permission ofNeustar.Neustar may have patents, patent applications, trademarks, copyrights, or otherintellectual property rights covering subject matter in this document. Except asexpressly provided in any written license agreement from Neustar, the furnishingof this document does not give you any license to these patents, trademarks,copyrights, or other intellectual property.Unless otherwise noted, the example companies, organizations, products,domain names, e-mail addresses, logos, people, places, and events depictedherein are fictitious, and no association with any real company, organization,product, domain name, email address, logo, person, place, or event is intendedor should be inferred. Neustar, Inc. All rights reserved.Neustar Ultra Services is a trademark and UltraCare is a service mark of Neustarin the United States and other countries. Other Neustar Ultra Services graphicsand logos are also trademarks or service marks of Neustar. Our trademarks andservice marks may not be used (1) in connection with any product or service thatis not an offering of Neustar Ultra Services, unless we have given express writtenpermission to so use our trademarks or service marks, or (2) in any manner thatis likely to cause confusion among customers, or disparages or discredits Neustar.All other trademarks and/or service marks identified or referenced are theproperty of their respective owners and subject to their usage requirements.
CONTENTSIntroduction .1What’s New .1Features . 1Reports . 1Documentation Conventions .2Important Notes .2Browser Prerequisites . 2Accessing the Report Center . 2Support . 2UltraDNS Managed Services Report Center Overview . 3Navigation and Detailed Data Analysis . 3Standard Reports .4Account Summary . 4Account Overview . 9Activity . 9Performance .10Query Types .11Host Response .12Response Comparisons .12Volume Changes .13Advanced Reports . 14Advanced Response Codes .14Advanced NXDOMAIN .15Advanced Client IP .16
Advanced Raw Queries .17Common Tasks. 20Download Data .20Print a Report .20FAQ . 21UltraDNS Managed Services Portal’s Reports Tab . 23DNS Activity.23Alerts .25SiteBacker and Traffic Controller .25LIST OF FIGURESFigure 1 Zone Filter (highlighted in red) . 1Figure 2 Navigation map in table reports . 3Figure 3 Account Summary Tab . 5Figure 4 Objects Under Management (table view) . 5Figure 5 Objects Under Management (graph view) . 6ndFigure 6 Projected Query Volumes: MTD Projections vs. Avg TTL (viewed on the 22 day of the month) 7rdFigure 7 MTD Projections vs. Daily Responses (viewed on the 23 day of the month) . 8Figure 8 Projected Query Volumes Table . 8Figure 9 Responses by Month . 9Figure 10 Query Types by Zone . 11Figure 11 Host Response . 12Figure 12 Response Comparisons . 13Figure 13 Volume Changes . 14Figure 14 Advanced Response Codes . 15Figure 15 Advanced NXDOMAIN . 16Figure 16 Advanced Client IP . 16
Figure 17 Advanced Raw Queries . 19Figure 18 DNS Activity Overall DNS Activity Report . 23Figure 19 DNS Activity Usage Summary . 24
INTRODUCTIONWelcome to the Neustar UltraDNS Managed Services Report Center. The new reporting capabilitiesempower you to: Identify configuration issuesAssess the impact of changesMonitor resolution performanceIsolate traffic for trends and problem determination and resolutionWHAT’S NEWFEATURES Zone filters allow you to filter a report by selecting one or more zones. Reports with thiscapability display the zone filter at the top right of the report.Figure 1 Zone Filter (highlighted in red) The Report Center now displays all reports, including Advanced Reports. If you have basicreporting and require the data in an Advanced Report, please contact sales atsales@ultradns.com or call (888) 367-4812.REPORTS Account Overview displays information for multiple accounts (displayed only if you havemultiple accounts).Host Response displays the percentage of total responses UltraDNS returned as an answer setfor a queried name.Response Comparisonso Day by Day Trend provides day over day query response totalso Day by Day Comparison provides a daily comparison against the hour of the dayAdvanced Raw Queries includes detailed query and response information.1
DOCUMENTATION CONVENTIONSWe use the following font and formatting conventions in this document: Text in green denotes a hyperlinked cross-reference to a place in this document or to anexternal mail address or URLItalic text indicates a defined term.Bold text denotes a screen object. For example:1. Open the Query Type tab.2. Click Go.Indicates a note or helpful hint.IMPORTANT NOTESBROWSER PREREQUISITES Microsoft Internet Explorer version 6 and laterFirefox version 3 and laterSafariACCESSING THE REPORT CENTERIn the UltraDNS Managed Services Portal open the Reports tab and clickor click the UltraDNS Report Center link in the navigation menu.SUPPORTContact Neustar Ultra Services Technical Support at ultrasupport@neustar.biz, (888) 367-4820, or(517) 434-5358.2
ULTRADNS MANAGED SERVICES REPORT CENTER OVERVIEWThe UltraDNS Managed Services Report Center has the following tabs by default: Account Summary (page 4)Activity (page 9)Performance (page 10)Query Types (page 11)Host Response (page 12)Response Comparisons (page 12)Volume Changes (page 13)Advanced Response Codes (page 14)Advanced NXDOMAIN (page 15)Advanced Client IP (page 16)Advanced Raw Queries (page 17)If you maintain multiple accounts, you will also see the Account Overview tab (page 9).The Advanced reports can analyze time data to the minute and location data to the client IPaddress level. Contact sales@ultradns.com for more information.NAVIGATION AND DETAILED DATA ANALYSISTABLE REPORTS Table reports include hyperlinked data elements that allow further analysis.At the bottom of the browser window, click Back to return one level or click Return to returnto the top level. For report data tables with multiple pages, clickto view all pages simultaneously(downloading a report to a spreadsheet exports all data).As you navigate a report, the UltraDNS Report Center includes a navigation map, as shown inFigure 2. Figure 2 Navigation map in table reports3
GRAPH REPORTSYou can view reports in the Account Summary, Account Overview, and Response Comparisons tabs asgraphs. Some graphs include hyperlinked graphic data elements for further analysis.Moving the pointer over a graphic element displays the element’s value.Right-click on a graph and select Zoom In for a more detailed view.Downloading graph data to a spreadsheet downloads the graphic—select Table view (orDetail Data) if you want to download the data to a spreadsheet.STANDARD REPORTSStandard reports include the following tabs: Account Summary (page 4)Account Overview (page 9, and viewable only if you have multiple accounts)Activity (page 9)Performance (page 10)Query Types (page 11)Host Response (page 12)Response Comparisons (page 12)Volume Changes (page 13)ACCOUNT SUMMARYThe Account Summary tab includes three reports, viewable as either graphs or tables: Objects Under Management (page 5)Projected Query Volumes (page 6)Responses by Month (page 9)If you have multiple accounts, select an account in the Account list at the top of thepage.4
Figure 3 Account Summary TabOBJECTS UNDER MANAGEMENTThe Objects Under Management report provides a snapshot of monthly activity and the objects inyour account. The report has two view options: Table or Graph. Click a month to view more reportdetails.Figure 4 Objects Under Management (table view)5
Figure 5 Objects Under Management (graph view)PROJECTED QUERY VOLUMESThe Projected Query Volumes report provides a snapshot of projected monthly volumes based on 7and 30 day average query amounts. See Performance by Zone on page 10 for further analysis. Thereport has three viewing options: MTD Projections vs. Avg TTL (graph)MTD Projections vs. Daily Responses (graph)TableMTD PROJECTIONS VS. AVG TTLThe MTD Projections vs. Avg TTL view shows the month to day (MTD) responses and projectionsoverlaid on the average time to live (TTL) of the resource records for each day’s responses. Based onthe MTD Responses on the current date, the graph shows the Projected MTD Responses based on a 7day and 30-day average.6
Figure 6 Projected Query Volumes: MTD Projections vs. Avg TTL (viewed on the 22nd day of the month)7
MTD PROJECTIONS VS. DAILY RESPONSESThe MTD Projections vs. Daily Responses view shows the month to day (MTD) responses andprojections overlaid on the actual daily responses. Based on the MTD Responses on the current date,the graph shows the Projected MTD Responses based on a 7-day and 30-day average.Figure 7 MTD Projections vs. Daily Responses (viewed on the 23rd day of the month)TABLEThe Table view lists all projected volume data (7 and 30 day projected query volumes, average TTL,and daily responses) that you can download to a spreadsheet.Figure 8 Projected Query Volumes Table8
RESPONSES BY MONTHThe Responses by Month report shows the total responses for the current month and previousmonths. The report has two view options: Graph or Table. For further analysis, use the Activity byZone report on page 9.Figure 9 Responses by MonthThe Response Comparisons report shows daily response trends and comparisons.ACCOUNT OVERVIEWIf you have multiple accounts, you will see the Account Overview tab. The reports available are similarto the Account Summary tab.You can click a bar in the Responses by Month report to expand the graph to include dailyresponses.ACTIVITYACTIVITY BY ZONEThe Activity by Zone report shows responses and response types for your zones. This report can helpyou determine if you need to investigate the size of an answer because of excessive TCP responses, orguide you in your adoption plan of IPv6.9
Four columns contain hyperlinked data: Zone: click a zone name to drill into the zone’s Host Name breakdowno HostName: click an entry to open the Host Response reportAll Dates: click to obtain data by day or hourAll Countries: click to obtain data on responses to particular countriesComparison: click Charts to access the Response Comparisons reportFive columns contain results data, which depend on the specified search criteria: Responses: the number of responsesTCP: the number of responses transmitted via TCPUDP: the number of responses transmitted via UDPIPV4: the number of responses transmitted via IPv4IPV6: the number of responses transmitted via IPv6PERFORMANCEPERFORMANCE BY ZONEThe Performance by Zone report analyzes the time, in milliseconds, for the UltraDNS resolver torespond to a query (and not the round-trip time of the DNS query). This report can help identifybottlenecks or pinpoint when responses slowed.Four columns contain hyperlinked data: Zone: click a zone name to display the zone’s queried Host Nameso Host Name: click an entry to open the Host Response reportAll Dates: click to obtain data by day or hourAll Countries: click to obtain data on response performance for particular countriesComparison: click Graphs to access the Response Comparisons reportSix columns contain results data, which depend on the specified search criteria: 10Responses%Resp 1 ms–10 ms Avg Resp Time (ms)%Resp 10 ms–100 ms % Resp 1 ms%Resp within 100 ms
QUERY TYPESQUERY TYPES BY ZONEThe Query Types by Zone report shows the types of resource records queried in your zone. This reportcan show, for example, what services your customers request most.Figure 10 Query Types by ZoneFour columns contain hyperlinked data: Zone: click a zone name to display the zone’s Host Nameso Host Name: click an entry to open the Host Response reportAll Dates: click to obtain data by day or hourAll Countries: click to obtain data on response performance for particular countriesComparison: click Charts to access the Response Comparisons reportThirty-two columns contain results data, including the resource record types: ResponsesAA6AAAAANYAXFRCERTCNAME DLVDNSKEYHINFOIPSECKEYIXFRLOCMFNAPTR MXNSNSECNSEC3NSEC3PARAMRPPTRRRSIG SOASPFSRVSSHFPTATSIGTKEYTXT11
HOST RESPONSEThe Host Response report displays the percentage of total responses UltraDNS returned as an answerset for a queried name. This report can help identify traffic shaping requirements for improvedperformance, resource management, and configuration.You must select an Account, Zone, and Host Name (the Host Name must be an FQDN that includesthe trailing dot). Select (All Column Value) in the Zone list to search for a Host Name in all zones.Wildcard characters are not allowed.Blank entries in the Answer column indicate that UltraDNS returned an empty response for the queryas a result of the query matching a code in the Advanced Response Codes (page 14).Clicking a hostname in other reports opens the Host Response tab.Figure 11 Host ResponseRESPONSE COMPARISONSThe Response Comparisons tab consists of two reports: Day by Day Trend and Day by DayComparison. These reports can help identify trends in volumes for a zone and pinpoint on which daysand/or hours volumes increased or decreased. You can then use other reports to determine a cause.Double-click a bar or data point in either Day by Day Trend or Day by Day Comparison report to drilldown to the hour or minute.Clicking Graphs in the Comparison column of other reports opens the ResponseComparisons tab.12
Figure 12 Response ComparisonsVOLUME CHANGESVOLUME CHANGES BY ZONEThe Volume Changes by Zone report indicates the percentage change in volume from the previousmonth’s volume and from the previous 3 months and 12 months. This report can help identify trendsin volumes for a zone and pinpoint in which month volumes increased or decreased. You can then useother reports for determine a cause.One column, Zone, contains hyperlinked data. Click a zone name to display the zone’s queried HostNames.Fourteen columns contain results data: one column for each month, %3 month for the volumechanges over the last three months, and %12 month for the volume changes over the last twelvemonths.13
Figure 13 Volume ChangesADVANCED REPORTSAdvanced reporting allows you to analyze time data to the minute and location data to the client ClassC address level. By comparison, the standard reporting package restricts analysis to only the hour andcountry level.The following reports are available in the Advanced Reporting package: Advanced Response Codes (page 14)Advanced NXDOMAIN (page 15)Advanced Client IP (page 16)Advanced Raw Queries (page 17)Contact sales@ultradns.com for more information on adding the Advanced Reporting package to youraccount.ADVANCED RESPONSE CODESRESPONSE CODES BY ZONEThe Response Codes by Zone report shows the DNS return codes for a zone’s responses. This reportcan indicate a trend in DNS return codes, or pinpoint where or when specific DNS return codes beganoccurring in responses.Four columns contain hyperlinked data: 14Zone: click a zone name to display the zone’s queried Host NamesComparison: click Graphs to access the Response Comparisons report
All Dates: click to obtain data by day, hour, or minuteAll Countries: click to obtain data on response codes for particular countries, regions, cities,zip codes, networks, or even client IPs.Seven columns contain results data: ResponsesCode 0 – NOERROR (no error)Code 1 – FORMERR (format error)Code 2 – SERVFAIL (server failure)Code 3 – NXDOMAIN (non-existent domain)Code 4 – NOTIMP (not implemented)Code 5 – REFUSED (query refused)Figure 14 Advanced Response CodesADVANCED NXDOMAINNXDOMAIN BY HOSTNAMEThe NXDOMAIN by Hostname report shows only those queried hostnames with NXDOMAIN returncodes.There are no hyperlinked columns.Four columns contain results data: HostnameComparison: click Charts to access the Response Comparisons report15
ResponsesCode 3-NXDOMAINFigure 15 Advanced NXDOMAINADVANCED CLIENT IPCLASS C CLIENTS IPSThe Class C Clients IPs report displays the number of responses sent to Class C networks.Six columns include hyperlinked data: Client Class C: click a network to view the Client IP addressesDrill to Zones: click to display zones or Host Names queried by the Class CComparison: click Charts to access the Response Comparisons reportCountry : click to display postal code of the Class CRegion: click to display postal code of the Class CCity: click to display postal code of the Class COne column (Responses) contains the results data.Figure 16 Advanced Client IP16
ADVANCED RAW QUERIESThe Advanced Raw Queries report includes copious data for both queries and responses. This reportcan provide details for query and response troubleshooting. There are two reports: Raw QuerySample and Raw Response Sample.The Raw Query Sample and Raw Response Sample reports contain the following columns:Column HeadingDescriptionPacket IDInteger that uniquely identifies the packetPacket Date TimeDate and time plus milliseconds (yyyy-mm-dd hh:mm:ss.ffffff)Host NameFQDN (dot-terminated)ZoneQuery nameQTypeQuery type (for example, A or AAAA)AN Answer SectionAR Additional RecordsNS Authoritative Name ServersThe order of records within a section. For example, if there aresix NS records being returned, then the records will have thenumbers 1 to 6 indicating the order returned in the DNSresponse.Response code:0 NOERROR, 1 FORMERR, 2 SERVFAIL, 3 NXDOMAIN,4 NOTIMP, 5 REFUSEDSection TypeSection SequenceRcodeRsp UsecResponse time in microsecondsClient IPClient IP (for example, 192.168.1.42)Client PortClient PortResolver IPResolver IP (for example, 192.168.1.42)Resolver PortResolver PortTLDTLD indicator: Served by TLD server or served by SLD serverIP VersionIP version: 4 IPv4, 6 IPv6UDPUDP or TCP packet indicatorDNS Msg LenLength of DNS message, excludes ether/IP/UDP/TCP headersPacket parsing error in ucap:0 no error, 1 IP header error, 2 DNS header error, 3 recordcount error, 4 query errorLength of the packetUcap PKT ErrPKT LenDNS IdDNS Identifier, ID generated by client and returned by resolverQD Record CountQuery record countNotesRaw QuerySample onlyRaw ResponseSample only17
AN Record CountAnswer record countNS Record CountAuthority record countAR Record CountAdditional record countRspResponse indicator. Response or QueryQuery code:0 QUERY, 1 IQUERY, 2 STATUSOpcodeAuth AnswrAuthentic data indicator: 1 true, 2 falseRcrsn DsrdRecursion desired indicator:1 true,2 falseTruncTruncation indicator: 1 message truncated,0 not truncatedRcrsn AvlRecursion available indicator: 1 true,2 falseAuthentic DataAuthentic data indicator: 1 true, 2 falseResource RecordTTLResource Record Time To LiveRaw ResponseSample onlyResource RecordNameResource record name, domain name that this record pertainstoResource record type code:1: A2: NS3: MD4: MF5: CNAME6: SOA7: MB8: MG10: NULL11: WKS12: PTR13: HINFO14: MINFO15: MX16: TXT17: RP18: AFSDB19: X2520: ISDN21: RT22: NSAP23: NSAP-PTR24: SIG25: KEY26: PX27: GPOS28: AAAARaw ResponseSample onlyRaw ResponseSample onlyResource RecordType18
29: LOC30: NXT31: EID32: NIMLOC33: SRV35: NAPTR44: SSHFP100: UINFO101: UID102: GID252: AXFR253: MAILA254: MAILB255: ANYResource RecordClassResource record class: 1 IN, 2 CS, 3 CH, 4 HSRaw ResponseSample onlyResource RecordData LenResource record data length, bytes in original DNS messageRaw ResponseSample onlyResource RecordDataResource record data, formatted readable dataRaw ResponseSample onlyFigure 17 Advanced Raw Queries19
COMMON TASKSDownload Data (page 20)Print a Report (page 20)DOWNLOAD DATA1. Open and configure your report (for reports in the Account Summary tab, select Table fromthe list).2. At the bottom of the page, click Download, and then selecta. PDFb. Excelc. Powerpointd. Excel 2003 i. Excel 2003ii. Excel 2007e. Web Page (MHTML)f. Datai. CSV formatii. Tab delimited formatiii. XML formatPRINT A REPORT1. Open and configure your report.2. Click Print at the bottom of the page and select Printable PDF or Printable HTML.The MTD Projections vs. Avg TTL and MTD Projections vs. Daily Responses report graphs printonly to a PDF file. Select Table from the view list for these reports to download data to aspreadsheet or print to HTML.20
FAQ How can I determine where my queries are coming from?Which records are receiving the most queries for my domain(s)?What can I do to reduce the number of queries?Why do I see IPv6 queries (AAAA) in the Query Types by Zone report when I do not have anyIPv6 records?Why do I see A record query counts for a CNAME record created for a specific queryname?Why do I see A record query counts for a CNAME record created for a specific queryname?Do my query totals include NX domain queries?What TTL value do NX domain queries use?Why do I see a customized report instead of a standard report?How can I return to the top level of a report after drilling down?How can I determine where my queries are coming from?Open the Activity tab, and click All Countries to the right of the zone you want to analyze.This expands the report to the country level.The Advanced Reporting option allows you to analyze location data to the clientIP address level in the Activity by Zone report. Contact support for moreinformation.Which records are receiving the most queries for my domain(s)?Open the Query Types tab. The Query Types by Zone report shows 31 types of resourcerecords.What can I do to reduce the number of queries?Increasing the TTL (Time to live) for your commonly queried resource records is theeasiest way to reduce the number of queries. There are several ways to do this in theManaged Services Portal:ooUse the bulk changes/search function in the Domains tabEdit individual recordsTo change the default TTL for newly created records, click My Information, open thePreferences tab, and set the values in the Domain and Record Preferences section.21
Why do I see IPv6 queries (AAAA) in the Query Types by Zone report when I do not have anyIPv6 records?Queries to your domain and resource records may include both standard IPv4 (A) and IPv6(AAAA) queries. In particular, the Microsoft Windows Vista operating system performsboth types of queries to determine the best connectivity for an answer. Although the DNSclient in Windows Vista behaves differently from other operating systems, the DNS IPv6queries are valid. 1To reduce the number of queries, we recommend configuring a wildcard AAAArecord with a high TTL value that sends users to an appropriate site.Why do I see A record query counts for a CNAME record created for a specific query name?Reports include what the client specified as the query type—not what was in the answer.Do my query totals include NX domain queries?Yes, UltraDNS considers NX domain queries DNS lookups on our system.The Advanced Reporting option’s Response Codes by Zone andNXDOMAIN by Hostname reports help troubleshoot excessive NXdomain queries. Contact support for more information.What TTL value do NX domain queries use?NX domain queries use the SOA record’s Min Cache TTL value.How can I return to the top level of a report after drilling down?At the bottom of the browser window, click Back to return one level or click Return to returnto the top level. See Navigation and Detailed Data Analysis on page 3 for more information.1See 5.aspx for more information.22
ULTRADNS MANAGED SERVICES PORTAL’S REPORTS TABBy default, your External DNS Service includes DNS Activity and Alerts report categories in theManaged Service
Neustar. Neustar may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Neustar, the furnishing of this document does not give you any license to these patents, trademarks,
