DNS Flow Analyser (DFA): A DNS-Based Correlation System to Classify CDN Domains and OTT-Applications

Understanding how traffic from the applications is delivered to end-users has been a daunting task of network players for decades. Historically, only DPI (Deep Packet Inspection) has been the dominant technology to provide such insight, but this faces growing challenges with encryption and scaling. In this demonstration, we present an implementation of a DNS-based correlation framework, called DNS Flow Analyser (DFA), to annotate and classify the traffic flows with information about OTT-Applications (e.g., TikTok, Disney+, AmazonPrime, DAZN) and CDN domains (e.g., fastly.net, akamai.net, cloudfront.net). This novel solution allows network providers to expand their traditional network-oriented view with an application-oriented view.