SilentKnight IP Alarm System Resiliency on Disaster Recovery and ISP changes - Manual (Page 6)

5
Why DNS-based solutions are not a good idea?
The DNS approach implies a deeper coordination with the CMS IT administrators, since they will be
responsible of maintaining the new DNS domain and the new DNS hostname assigned to each receiver.
The DNS approach hence forces the IP Alarm System to rely on an external DNS service, adding another
point of failure in the system that is not 100% controlled by the Alarm Monitoring Service responsible. As
the reader have learned in the previous sections of this document, the FireLite IP Alarm System offers high
resilience capabilities without the need for DNS.
The DNS lookup is the procedure used by the IP Communicators to learn the contact IP address of their
CMSs in a DNS-based solution. This procedure can slow down communication if DNS servers are slow to
respond, or even block the IP communication if the DNS is not working (problems in the subscriber’s DNS
service, problems on the public DNS Service or even problems on the DNS Service in the CMS). In
FireLite’s approach, these problems will never arise.
When the CMS contact IP address is changed in a DNS-based solution, the IP Communicator will try to
communicate with a bad IP address before it looks up the new IP address. If a dealer changes to a new
CMS the IP Communicator will never change to the new IP address if the old CMS is still answering on the
old IP address. As the reader can derive, on changing to another CMS, the Alarm System runs into a
transition period (i.e. communicators pointing to the old CMS) for an uncertain time. The FireLite system
does not suffer from this problem.
On the other hand, the DNS Denial of Service attacks are very popular (i.e. the response to an IP
Communicator DNS lookup comes with a faked IP address for the CMS) and will cause the system to
malfunction. In fact, if the public DNS service is down, not only the IP alarm service will be inoperative
(even when the IP link is working fine), but also the time uncertainty on the DNS system recovery in these
circumstances may be unaffordable.