Solaris上对比测试BIND和Nominum两个DNS软件性能

关注

原创最新推荐文章于 2026-11-11 14:26:07 发布 3.3k 阅读 AI 写同款· GEO 优化 ›

构建企业级DNS系统（八）bind DNS解析性能测试及调优详细介绍基于bind搭建的DNS系统的性能测试方法及性能调优方法。阅读详情

BIND，没什么说的了，自1983年Paul Mockapetris发明后，就成为Internet中DNS的事实上的标准，由ISC(Internet　Software　Consortium)负责维护，具体的开发由
Nominum(www.nominum.com)公司来完成，BIND 9.x是免费软件，为Solaris的标准配置，即便电信中也绝大多数采用BIND8.x/9.x。

但2002 年10月21日，对Internet的13台DNS根域名服务器的持续了一个小时的拒绝服务攻击，给人们敲响了警钟，采用新的算法，提升DNS性能，是一种方法，Nominum出继续升级免费的BIND外，还开发了新算法的Nominum Foundation CNS DNS软件，有好事同事，改不了工程师的老毛病，好奇并对BIND和Nominum的性能进行了对比测试，分享如下：

1。准备机器：

采用Sun Fire V240服务器，1x 1GHz USIIIi, 512MB内存，4x 1000Base-T网口，装Solaris 10， Sun Studio 10, 联通到Internet外网。

v240:/# showrev
Hostname: v240
Hostid: 838af0bd
Release: 5.10
Kernel architecture: sun4u
Application architecture: sparc
Hardware provider: Sun_Microsystems
Domain:
Kernel version: SunOS 5.10 Generic_118822-08

v240:/# cd /opt/SUNWspro/bin
v240:/# ./version
Machine hardware: sun4u
OS version:       5.10
Processor type:    sparc
...
Sun Studio 10
      Sun Studio 10 C Compiler
      Sun Studio 10 C++ Compiler
      Sun Studio 10 Tools.h++ 7.1
...

v240:/# which cc
/opt/SUNWspro/bin/cc

2。配DNS - DIND 9.2.4

配主机文件：

v240:/# vi /etc/hosts
#
# Internet host table
#
127.0.0.1    localhost
192.168.0.55 v240 v240.example.com loghost

打开DNS开关文件：

v240:/# cd vi /etc/nsswith.conf
...
hosts:    files  dns
...

配DNS client文件，DNS client指向网通和本机：

v240# vi /etc/resolv.conf
nameserver 192.168.0.55    //本机IP
nameserver 202.x.x.x       //xxDNS

配DNS服务器rndc 文件：

v240# vi /etc/rndc.conf
# Start of rndc.conf
key "rndc-key" {
algorithm hmac-md5;
secret "qb2cKV1j07PXbv//QQPytA==";
};

options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};
# End of rndc.conf

配DNS服务器named.conf文件：

v240# vi /etc/named.conf
key "rndc-key" {
   algorithm hmac-md5;
   secret "qb2cKV1j07PXbv//QQPytA==";
};

controls {
   inet 127.0.0.1 port 953
            allow { 127.0.0.1; } keys { "rndc-key"; };
};

options {
               version "$Id, worldhello.net";
               directory "/var/named";
               pid-file  "named.pid";
               allow-query { any; };
               notify yes;
               recursion yes;
      };
      zone "." in {
               type hint;
               file "db.cache";
      };
      zone "example.com" in {
               type master;
               file "db.example.com";
      };
      zone "0.168.192.in-addr.arpa" in {
               type master;
               file "db.0.168.192";
      };
      zone "0.0.127.in-addr.arpa" in {
               type master;
               file "db.local";
      };

配DNS服务器cache文件：

v240# vi /var/named/db.cache
.                      3600000    NS D.ROOT-SERVERS.NET.
D.ROOT-SERVERS.NET.    3600000    A    128.8.10.90
;
; formerly NS.NASA.GOV
;
.                      3600000    NS E.ROOT-SERVERS.NET.
E.ROOT-SERVERS.NET.    3600000    A    192.203.230.10
;
; formerly NS.ISC.ORG
;
.                      3600000    NS F.ROOT-SERVERS.NET.
F.ROOT-SERVERS.NET.    3600000    A    192.5.5.241
;
; formerly NS.NIC.DDN.MIL
;
.                      3600000    NS G.ROOT-SERVERS.NET.
G.ROOT-SERVERS.NET.    3600000    A    192.112.36.4
;
; formerly AOS.ARL.ARMY.MIL
;
.                      3600000    NS H.ROOT-SERVERS.NET.
H.ROOT-SERVERS.NET.    3600000    A    128.63.2.53
;
; formerly NIC.NORDU.NET
;
.                      3600000    NS I.ROOT-SERVERS.NET.
I.ROOT-SERVERS.NET.    3600000    A    192.36.148.17
;
; temporarily housed at NSI (InterNIC)
;
.                      3600000    NS J.ROOT-SERVERS.NET.
J.ROOT-SERVERS.NET.    3600000    A    198.41.0.10
;
; housed in LINX, operated by RIPE NCC
;
.                      3600000    NS K.ROOT-SERVERS.NET.
K.ROOT-SERVERS.NET.    3600000    A    193.0.14.129
;
; temporarily housed at ISI (IANA)
;
.                      3600000    NS L.ROOT-SERVERS.NET.
L.ROOT-SERVERS.NET.    3600000    A    198.32.64.12
;
; housed in Japan, operated by WIDE
;
.                      3600000    NS M.ROOT-SERVERS.NET.
M.ROOT-SERVERS.NET.    3600000    A    202.12.27.33

配DNS服务器本机文件：

v240# vi /var/named/db.local
$TTL 5h
0.0.127.in-addr.arpa. IN SOA example.com. root.example.com. (
            1999062801    ;serial number (yyymmmdd##)
            10800          ;refresh every 3 hours
            3600          ;retry every 1 hours
            604800       ;expore after a week
            86400 )       ;TTL of 1 day
; Name servers
0.0.127.in-addr.arpa.          IN NS v240.example.com.
1                            IN PTR localhost

配DNS服务器本彧文件：

v240# vi /var/named/db.example.com
$TTL 5h
example.com. IN SOA example.com. root.example.com. (
            1999062804    ;serial number (yyymmmdd##)
            10800          ;refresh every 3 hours
            3600          ;retry every 1 hours
            604800       ;expore after a week
            86400 )       ;TTL of 1 day
; Name servers
example.com.             IN NS v240.example.com.
; Addresses
localhost                IN A 127.0.0.1
v240.example.com.       IN A 192.168.0.55

v20z                   IN A 192.168.0.50

配DNS服务器反向文件：

v240# vi /var/named/db.0.168.192
$TTL 5h
0.168.192.in-addr.arpa. IN SOA example.com. root.example.com. (
            1999070501    ;serial number (yyymmmdd##)
            10800          ;refresh every 3 hours
            3600          ;retry every 1 hours
            604800       ;expore after a week
            86400 )    ;TTL of 1 day
; Name servers
1.1.10.in-addr.arpa.                IN NS v240.example.com.

55                                  IN PTR v240.example.com.
50

启动DNS服务：

v240# svcs -a |grep dns
disabled    18:11:53 svc:/network/dns/server:default
online       18:12:42 svc:/network/dns/client:default

v240# svcs -a |grep dns
v240# svcadm enable svc:/network/dns/server:default

试验DNS解析:

v240# bslookup

(可用www.sohu.com等）

v240# dig @202.106.0.20

; <<>;>; DiG 9.2.4 <<>;>; @202.106.0.20
;; global options:  printcmd
;; Got answer:
;; ->;>;HEADER<<- opcode: QUERY, status: NOERROR, id: 83
;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 13

;; QUESTION SECTION:
;.                            IN    NS

;; ANSWER SECTION:
.                      86440 IN    NS    B.ROOT-SERVERS.NET.
.                      86440 IN    NS    C.ROOT-SERVERS.NET.
....

3。安装queryperf测试程序：

解queryperf包：

v240# gzcat queryperf-nominum-2.1.tar.gz |tar xvf -
x queryperf-nominum-2.1, 0 bytes, 0磁带块
x queryperf-nominum-2.1/input, 0 bytes, 0磁带块
x queryperf-nominum-2.1/input/sample.0, 101 bytes, 1磁带块
x queryperf-nominum-2.1/input/sample.1, 304 bytes, 1磁带块
...

编译：

v240# ./configure
checking for gcc... gcc
checking for C compiler default output... a.out
checking whether the C compiler works... yes
...

v240# make
gcc  -DPACKAGE_NAME=/"/" -DPACKAGE_TARNAME=/"/" -DPACKAGE_VERSION=/"/" -DPACKAGE_STRING=/"/" -DPACKAGE_BUGREPORT=/"/" -DHAVE_LIBSOCKET=1 -DHAVE_LIBNS
L=1 -DHAVE_GETADDRINFO=1 -DHAVE_GETNAMEINFO=1 -c queryperf.c
gcc  -DPACKAGE_NAME=/"/" -DPACKAGE_TARNAME=/"/" -DPACKAGE_VERSION=/"/" -DPACKAGE_STRING=/"/" -DPACKAGE_BUGREPORT=/"/" -DHAVE_LIBSOCKET=1 -DHAVE_LIBNS
L=1 -DHAVE_GETADDRINFO=1 -DHAVE_GETNAMEINFO=1  queryperf.o  -lnsl -lsocket -lresolv -lm -o queryperf
...

4。测试BIND 9.2.4

编辑包含测试域名的test文件（>; 30000个测试域名）：

v240# vi test
www.sina.com.cn A
www.sohu.com A
www.sun.com    A
...
(more than 30000)

向Sun Fire V240发出带30000测试域名的请求：
v240:/# ./queryperf -d test -s 192.168.0.55

DNS Query Performance Testing Tool

Nominum Version 2.1

Version: $Id: queryperf.c,v 1.20 2005/03/08 19:10:03 gson Exp $

[Status] Processing input data
[Status] Sending queries (beginning with 192.168.0.55)
[Timeout] Query timed out: msg id 1
[Timeout] Query timed out: msg id 3
[...
Warning: Received a response with an unexpected (maybe timed out) id: 28
[Status] Testing complete

Statistics:

  Parse input file:    once
  Ended due to:       reaching end of file

  Queries sent:       33000 queries
  Queries completed: 32980 queries
  Queries lost:       20 queries

  Percentage completed:  99.94%
  Percentage lost:       0.06%

  Started at:          Fri Jul  8 14:48:36 2005
  Finished at:       Fri Jul  8 14:48:53 2005
  Ran for:             17.379295 seconds

  Queries per second: 1897.660406 qps

即Sun Fire V240(1x 1Ghz USIIIi, 512MB内存）,在此测试环境下，处理 DNS请求1897.7个每秒，丢失率0.06%。

5。安装Nominum Foundation CNS DNS软件

修改配置并卸载BIND DNS服务：

v240:/# pkill -9 named

v240:/# svcadm disable svc:/network/dns/server:default

v240:/# vi /etc/resolv.conf
nameserver 192.168.0.20 //本机IP

解Nominum Foundation CNS包：

v240:/# uncompress cns-1.5.3.2e-2-2005.10.01-solaris-10-sparc.tar.Z
v240:/# tar xvf cns-1.5.3.2e-2-2005.10.01-solaris-10-sparc.tar

安装Nominum Foundation CNS：

v240:/# pkgadd -d nomutils-2.0.27.0.1-sol10-sparc
v240:/# pkgadd -d cns-1.5.3.2.2-sol10-sparc
v240:/# pkgadd -d nomnanny-2.0.27.0.1-sol10-sparc
v240:/# pkgadd -d nomsdk-2.0.27.1.1-sol10-sparc
v240:/# pkgadd -d snmpproxy-1.0.3.3.3-sol10-sparc
（回答都是yes)

启动Nominum Foundation CNS DNS服务：

v240:/# /etc/init.d/cns start

6。测试DNS - Nominum Foundation CNS

测试域名同BIND 9.2.4

10 或 100个并发，向Sun Fire V240发大于30000个DNS请求：

v240:/# ./queryperf -d test -s v240 -q 10

DNS Query Performance Testing Tool

Nominum Version 2.1

Version: $Id: queryperf.c,v 1.20 2005/03/08 19:10:03 gson Exp $

[Status] Processing input data
[Status] Sending queries (beginning with 192.168.0.55)
[Status] Testing complete

Statistics:

  Parse input file:    once
  Ended due to:       reaching end of file

  Queries sent:       33000 queries
  Queries completed: 33000 queries
  Queries lost:       0 queries

  Percentage completed: 100.00%
  Percentage lost:       0.00%

  Started at:          Fri Jul  8 15:41:28 2005
  Finished at:       Fri Jul  8 15:41:32 2005
  Ran for:             4.336514 seconds

  Queries per second: 7609.799023 qps

即Sun Fire V240(1x 1Ghz USIIIi, 512MB内存）,在此测试环境下，处理 DNS请求7609.8个每秒，无丢失0.00%。

性能提高：

7609.8个每秒 / 1897.7个每秒 = 4.01 倍
(Sun Fire V20z, 1x 1.6GHz AMD Opteron, 20354 qps)

7。结论

Nominum是 BIND和Nominum Foundation CNS的开发者，真的就在1个CPU，512MB内存的小服务器上， DNS性能能相差4倍的吗？测试数值显示的是这样，但测试方法有何不妥之处呢？我自己有点疑问，请点评。

如真是这样，常见省级DNS处理约4000qps, 岂不1个CPU就搞定啦？但电信常配Sun Fire V890服务器，8x双core，性能能否就说是16x倍呢？