Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have some problems with my two AD/DNS servers for my hosted Exchange setup, as they suddently began to consume large amounts of bandwidth (~10mbit each), which I think is really strange, as they are not really in use yet.

Heres are some screens from TCPView on the servers:

Server 1 Server 2

As you can see, the DNS process really consumes some bandwidth.

I checked the firewall logs, and it doesn't seem like someone from the outside is trying to make a lot of DNS requests.

How do I troubleshoot from here? Shutting down the DNS service brings the bandwidth usage down, but that is not an optimal solution.


Running wireshark on the two servers gives me a load of DNS queries for type ANY, class IN

I have uploaded two capture files from my servers, each ran for ~20secs.
Server1.pcapng Server2.pcapng
(My servers IP's are and

share|improve this question
I had this happen to me too. I ended up taking the DNS servers and made them inaccessable from the outside. If you google "dns flood" you'll see plenty of "wth? where are all these requests coming from". My suggetion is to limit your exposed area and block the offending IPs if possible. – MikeAWood Aug 7 '12 at 14:25
Problem is just that it is sure a hell lot of different IP's making those requests, and reading on the net, it seems like those are spoofed too. Seems like I might just have to live with it, as blocking access from the outside world is not really a solution, as they are authorative servers for the domain. – Frederik Nielsen Aug 7 '12 at 14:31
Ours were too, I let our registrar take it over so they got nailed as opposed to ours. – MikeAWood Aug 15 '12 at 0:16

1 Answer 1

up vote 0 down vote accepted

Your first step should be determining if you actually have a problem.

I don't see anything there which makes me think you do. 10 million bits is a lot... if you're sending that many a second. Of course, if you have a large network, that might be expected behavior. Also, with most everything these days being a 100 meg or 1 gig link, 10 mbit is at most, 10% of your bandwidth. Is it actually causing you a problem, or are you looking too hard and creating one where nothing's wrong?

If you end up deciding you do have a problem, the first thing you should do is run a packet capture program on the DNS server to track down where all the requests are coming from. There are a lot of possibe reasons you could be seeing abnormally high DNS traffic - anything from an infected client PC trying to contact a C&C server, to a DNS misconfiguration that's bouncing name lookups around in your network in a loop.

share|improve this answer
The servers are running virtualized in a vmware environment, and have 10gig virtual nics, connected to 4 physical 1gig nics. We have a 100mbit WAN connection, so consuming 20mbit (2x10) of it just with these two servers seems like a lot to me. I will try to run some packet capturing and see what it is. – Frederik Nielsen Aug 6 '12 at 14:11
Please see my edit, as it contains new info and capture files. – Frederik Nielsen Aug 6 '12 at 14:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.