Results 1 to 5 of 5

Thread: Large rise in DNS queries in December

  1. #1
    Senior Member
    Join Date
    May 2007
    Location
    West Wales
    Posts
    484
    Thanks
    30
    Thanked
    18 times in 16 posts
    • Phil_P's system
      • Motherboard:
      • Gigabyte P35-DS4
      • CPU:
      • Q6600 G0
      • Memory:
      • 4x1GB Crucial
      • Storage:
      • 2 x WD 1TB in RAID1
      • Graphics card(s):
      • Gigabyte 7600GS
      • PSU:
      • Etasis 750W
      • Operating System:
      • RHEL5/RHEL6
      • Monitor(s):
      • Samsung 226BW 22" panel
      • Internet:
      • F2S 8mbit

    Large rise in DNS queries in December

    Hi All,

    I wonder if we have any DNS guru's that might be able to help.

    We have 3 dns servers for our domain, and for months we've been seeing a pretty constant number of dns queries per day. However, as of 1st Dec we started to see a sudden rise in the number of queries, going from a very consistent 20K per server per day to 50-100K per server per day. Two things are striking here - firstly the rise, but also the large variation in daily queries.

    We have no idea what's caused this sudden increase. To note, it's not really an issue as we have no problem coping with the increased load so it's more a curiosity as to the reason.

    We are not seeing any concomitant rise in traffic at the website nor mailing lists, we don't host multiple sub-domains, we are not aware of any high profile news articles linking our site (the /. effect), we didn't reset our TTL to a lower value on 1st Dec.

    Any ideas or suggestions what might have caused this?

  2. #2
    Senior Moment blueball's Avatar
    Join Date
    Aug 2005
    Location
    Edinburgh
    Posts
    2,426
    Thanks
    846
    Thanked
    379 times in 294 posts
    • blueball's system
      • Motherboard:
      • Asus Z390A
      • CPU:
      • i9-9900KS
      • Memory:
      • Kingston 64GB (2x32GB) DDR4 2400MHz
      • Storage:
      • 2TB Samsung 970 EVO Plus NVMe PCIE M.2 plus Samsung 860 EVO 4TB SSD
      • Graphics card(s):
      • ASUS TUF RTX 3080 Ti GAMING OC
      • PSU:
      • Corsair HX850 850 W Full Modular 80 Plus Platinum
      • Case:
      • Corsair Carbide 330R Ultra Silent Midi Tower
      • Operating System:
      • Win 10 Pro x64
      • Monitor(s):
      • IIYAMA 3461WQ IPS 34" 3440x1440 plus BenQ GW2765HT IPS 27" 2560x1440
      • Internet:
      • Plusnet 28Mb

    Re: Large rise in DNS queries in December

    Internal or external requests?
    Rgds,

    BB
    Hexus Trust here and here

  3. #3
    Senior Member
    Join Date
    May 2007
    Location
    West Wales
    Posts
    484
    Thanks
    30
    Thanked
    18 times in 16 posts
    • Phil_P's system
      • Motherboard:
      • Gigabyte P35-DS4
      • CPU:
      • Q6600 G0
      • Memory:
      • 4x1GB Crucial
      • Storage:
      • 2 x WD 1TB in RAID1
      • Graphics card(s):
      • Gigabyte 7600GS
      • PSU:
      • Etasis 750W
      • Operating System:
      • RHEL5/RHEL6
      • Monitor(s):
      • Samsung 226BW 22" panel
      • Internet:
      • F2S 8mbit

    Re: Large rise in DNS queries in December

    External, as counted at the firewall.

  4. #4
    Senior Moment blueball's Avatar
    Join Date
    Aug 2005
    Location
    Edinburgh
    Posts
    2,426
    Thanks
    846
    Thanked
    379 times in 294 posts
    • blueball's system
      • Motherboard:
      • Asus Z390A
      • CPU:
      • i9-9900KS
      • Memory:
      • Kingston 64GB (2x32GB) DDR4 2400MHz
      • Storage:
      • 2TB Samsung 970 EVO Plus NVMe PCIE M.2 plus Samsung 860 EVO 4TB SSD
      • Graphics card(s):
      • ASUS TUF RTX 3080 Ti GAMING OC
      • PSU:
      • Corsair HX850 850 W Full Modular 80 Plus Platinum
      • Case:
      • Corsair Carbide 330R Ultra Silent Midi Tower
      • Operating System:
      • Win 10 Pro x64
      • Monitor(s):
      • IIYAMA 3461WQ IPS 34" 3440x1440 plus BenQ GW2765HT IPS 27" 2560x1440
      • Internet:
      • Plusnet 28Mb

    Re: Large rise in DNS queries in December

    Are the requests for the same address or for different ones? Just wondering if someone has posted something somewhere and is driving traffic your way?
    Rgds,

    BB
    Hexus Trust here and here

  5. #5
    Senior Member
    Join Date
    May 2007
    Location
    West Wales
    Posts
    484
    Thanks
    30
    Thanked
    18 times in 16 posts
    • Phil_P's system
      • Motherboard:
      • Gigabyte P35-DS4
      • CPU:
      • Q6600 G0
      • Memory:
      • 4x1GB Crucial
      • Storage:
      • 2 x WD 1TB in RAID1
      • Graphics card(s):
      • Gigabyte 7600GS
      • PSU:
      • Etasis 750W
      • Operating System:
      • RHEL5/RHEL6
      • Monitor(s):
      • Samsung 226BW 22" panel
      • Internet:
      • F2S 8mbit

    Re: Large rise in DNS queries in December

    Quote Originally Posted by blueball View Post
    Are the requests for the same address or for different ones? Just wondering if someone has posted something somewhere and is driving traffic your way?
    We have no way of telling - almost all queries are to resolve the primary domain (example.org), a few are to resolve lists.example.org which is our mailing list server but the logs only show the querying dns server.

    We are pretty sure it's not anything posted as that would also cause a rise in hits against the web site and traffic there is still fairly static (i.e, we're not suddenly seeing a 2-5 fold increase). So we are seeing large rises in DNS queries but no concomitant rise in hits/traffic at the website.

    We did wonder if it might be related to link prefetching but we couldn't find any evidence to support that coinciding with the date it began (1st Dec). I did note that MS only introduced DNS link prefetching in IE9 but believe IE9 was released around March this year so again I don't see a link there. For example, I don't see anything relating to MS suddenly pushing IE9 out as a mandatory update on Windows Update on 1st Dec, but I'm not a MS expert.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •