3 ms·

> what is this patented DNS algorithm It's probably just them running their own resolver over an encrypted channel to avoid ISP rewriting DNS responses.

by zimbatm 11y ago

chris_wot 11y ago
No, they appear to have their own app. According to the patent [1], they are querying all the host systems DNS resolvers concurrently. The second part of the invention is as follows: In accordance with the present method and system, and a first exemplary embodiment of the invention, in order to avoid wasting time when cache entries are expired, the present method and system performs two steps concurrently. First, the present method and system continues operation as if the expired cache entry is still valid and thus continues resolving the DNS request from the cache. In parallel, the present system and method queries the authoritative domain name server that provided the expired answer in the past for obtaining the latest valid entry for this URL. If, following the comparison of the cache entry to the one now received from the authoritative domain name server, the entry in the cache is still valid, the present method and system uses the final answer received from the first process herein. Acting on the assumption that the invalid cache entry was still valid is productive for the process. If the IP address received from the authoritative domain name server is not the same as the expired entry in the cache, the present method and system ignores the result received from the first step and continues normally with the result received from the authoritative domain name server.This modification in the operation of the DNS recursor saves time, since in most cases of an expiration of a cached record, the record is still valid, and thus the serial recursive process would have been slower than the concurrent process of the present method and system. In other cases (i.e., in the cases where the assumption that the expired cache entry was still valid, but following the query to the authoritative domain name server it turned out not to be valid), the time the present method and system takes is the same as the prior art process, meaning that if the cache entry was indeed invalid, then doing the two steps in parallel as described above did not waste time—the end result is returned in the same time it would have taken a ‘normal’ DNS process to return a valid answer. How they implement this, I don't know. Possible they are modifying the client's resolver? Seems like a recipe for disaster though. 1. https://www.google.com/patents/US8671221 https://www.google.com/patents/US8671221
- zimbatm 11y ago
  I can see how this could improve the resolving latency slightly, at the expense of more network traffic. Like you said, it must be tricky to get that integrated properly. It seems like a weird optimization to do and unrelated to VPN. Maybe they have fast-changing DNS entries when nodes are joining and leaving.

> what is this patented DNS algorithm It's probably just them running their own resolver over an encrypted channel to avoid ISP rewriting DNS responses.

by zimbatm 11y ago

> what is this patented DNS algorithm It's probably just them running their own resolver over an encrypted channel to avoid ISP rewriting DNS responses.

chris_wot 11y ago

No, they appear to have their own app. According to the patent [1], they are querying all the host systems DNS resolvers concurrently. The second part of the invention is as follows: In accordance with the present method and system, and a first exemplary embodiment of the invention, in order to avoid wasting time when cache entries are expired, the present method and system performs two steps concurrently. First, the present method and system continues operation as if the expired cache entry is still valid and thus continues resolving the DNS request from the cache. In parallel, the present system and method queries the authoritative domain name server that provided the expired answer in the past for obtaining the latest valid entry for this URL. If, following the comparison of the cache entry to the one now received from the authoritative domain name server, the entry in the cache is still valid, the present method and system uses the final answer received from the first process herein. Acting on the assumption that the invalid cache entry was still valid is productive for the process. If the IP address received from the authoritative domain name server is not the same as the expired entry in the cache, the present method and system ignores the result received from the first step and continues normally with the result received from the authoritative domain name server.This modification in the operation of the DNS recursor saves time, since in most cases of an expiration of a cached record, the record is still valid, and thus the serial recursive process would have been slower than the concurrent process of the present method and system. In other cases (i.e., in the cases where the assumption that the expired cache entry was still valid, but following the query to the authoritative domain name server it turned out not to be valid), the time the present method and system takes is the same as the prior art process, meaning that if the cache entry was indeed invalid, then doing the two steps in parallel as described above did not waste time—the end result is returned in the same time it would have taken a ‘normal’ DNS process to return a valid answer. How they implement this, I don't know. Possible they are modifying the client's resolver? Seems like a recipe for disaster though. 1. https://www.google.com/patents/US8671221 https://www.google.com/patents/US8671221

zimbatm 11y ago
I can see how this could improve the resolving latency slightly, at the expense of more network traffic. Like you said, it must be tricky to get that integrated properly. It seems like a weird optimization to do and unrelated to VPN. Maybe they have fast-changing DNS entries when nodes are joining and leaving.