Comment by dorset

7 years ago

Can anyone explain why ping.ring.com needs to have such a low TTLs?

  =-=-=-=-=
  $ drill ping.ring.com @1.1.1.1
  ;; ->>HEADER<<- opcode: QUERY, rcode: NXDOMAIN, id: 36008
  ;; flags: qr rd ra ; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0
  ;; QUESTION SECTION:
  ;; ping.ring.com. IN A
   
  ;; ANSWER SECTION:
  ping.ring.com. 3 IN CNAME iperf.ring.com.
  iperf.ring.com. 3 IN CNAME ap-southeast-2-iperf.ring.com.
   
  ;; AUTHORITY SECTION:
  ring.com. 573 IN SOA ns-385.awsdns-48.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
  =-=-=-=-=

I've been trying to find out from Ring support for a few days, and while the support layer has been trying to find out, not much information seems to be getting back. To put this in perspective, in my house with two Ring devices (a doorbell and a chime), I am getting 10,000+ DNS un-cached requests a day, which easily is 20x more than the second most requested domain.

3 comments

dorset

Reply
zamadatix  7 years ago

The command output has the answer, it's a CNAME to whatever random AWS instance happens to be up and running. They probably let the instances autoscale to load and don't guarantee they'll be around for any amount of time and rather than configure an additional service for heatbeating they just used DNS.

There are caching nameservers that allow you to override the minimum TTL but be aware the device is likely relying on this being immediately up to date and may not work during a change with an extended TTL set.

Twirrim  7 years ago

That's actually a pretty long TTL by Amazon standards.

Amazon.com:

    ;; ANSWER SECTION:
    amazon.com.             60      IN      A       176.32.103.205
    amazon.com.             60      IN      A       176.32.98.166
    amazon.com.             60      IN      A       205.251.242.103

Or some AWS services

Glacier:

    ;; ANSWER SECTION:
    glacier.us-east-1.amazonaws.com. 60 IN  A       54.239.30.220

S3 has even shorter:

    ;; ANSWER SECTION:
    s3.ap-northeast-1.amazonaws.com. 5 IN   A       52.219.0.8

Or, say, DynamoDB:

    ;; ANSWER SECTION:
    dynamodb.us-east-1.amazonaws.com. 5 IN  A       52.94.2.72

The main reason to do so is to be nimble, it's to be able to react to incidents as fast as you can and change, and to make potential deployment patterns possible.

From time to time, you need to do something with customer facing infrastructure: Remove the DNS entry, watch the traffic drain over the next 5-10 minutes, and then do what you need to do on the device, test, and then add it back in the DNS again, from which you can watch traffic return to normal levels and verify everything is good.

  • 33C57E63  7 years ago

    You're looking at the SOA (573) record for ring.com, but he's asking about the CNAME (3) for ping.ring.com.