Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The following figures shows the rate of UDP DNS queries and responses of a traffic passing a router. DNS query is a DNS packet with query/response flag set to 0 in header and DNS response the one with the flag set to 1.

  1. Why is there a constant imbalance between them?
  2. What are those jumps of about 30 minutes interval in responses?

Fig. 1: The graph over the period of 4 days: Fig. 1: The graph over the period of 4 days.

Fig. 2: The graph over the period of 12 days: Fig. 2: The graph over the period of 12 days.

I read about DNS tunneling, but that is about the difference between the bandwidth of the queries and responses.

share|improve this question
Can you add more details? Are you looking at traffic for DNS servers that you are managing? Are you experiencing any resolving issues? Are you looking at solving a specific issue? – Alex Feb 22 '13 at 16:03
These graphs are for the traffic passing a country and internet. So I don't know whether there is an issue, any attack or else about them. There are clients and DNS servers at either side. – Yas Feb 22 '13 at 16:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.