The following figures shows the rate of UDP DNS queries and responses of a traffic passing a router. DNS query is a DNS packet with
query/response flag set to
0 in header and DNS response the one with the flag set to
- Why is there a constant imbalance between them?
- What are those jumps of about 30 minutes interval in responses?
Fig. 1: The graph over the period of 4 days:
Fig. 2: The graph over the period of 12 days:
I read about DNS tunneling, but that is about the difference between the bandwidth of the queries and responses.