Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to estimate the amount of traffic 20,000,000 DNS requests a month will generate in terms of bandwidth. I'll include my calculations below but they all hinge on my estimation of the amount of data used to make a simple A request to a DNS server.

From my tests I think that 50 bytes is about right but wondered if anyone knew differently.

My calculations based around 50 bytes per query:

520 bytes for a DNS request
200000000 DNS monthly requests
104000000000 monthly bytes
832000000000 monthly bits
27733333333.33 daily bits
320987.65 bits/s
313.46 kb/s

Thanks for getting this far!

share|improve this question
could you comment on if the answer below changed your numbers? –  svrist Mar 20 '12 at 11:24

1 Answer 1

up vote 4 down vote accepted

I think your data needs some new approximations, since a usual DNS server reply is smaller than 520 bytes (in fact, most of the routers (or networking equipment) can give you headaches when the UDP packet size passes 512kb mark - but we're not talking here about only UDP).

Here it goes - will use two very known linux tools to approximate the size of a typical DNS request. dig linux.org +stats

; <<>> DiG 9.6.1-P1 <<>> linux.org +stats
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7061
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0

;linux.org.                     IN      A

linux.org.              43200   IN      A

linux.org.              43180   IN      NS      ns0.aitcom.net.
linux.org.              43180   IN      NS      ns.invlogic.com.

;; Query time: 239 msec
;; WHEN: Thu Oct 29 11:52:44 2009
;; MSG SIZE  rcvd: 100

As you see, I made a DNS query to the local DNS server, loopback interface (for simplicity and clarness). You should find interesting the last row "MSG SIZE"...

Confirm it with tcpdump (running on loopback interface) :

IP localhost.36855 > localhost.domain: 7061+ A? linux.org. (27)
IP localhost.domain > localhost.36855: 7061 1/2/0 A (100)

What you see in the end of each row it's the actual size (the thing you're looking for).

I advise you to run several test queries and average your DNS request size in your calculations. Keep an eye out for domains that aren't directely served from your DNS servers (that should be an interesting bit).


share|improve this answer
Perfect - thanks very much for this info. I used tcpdump originally to get my estimated data size. –  James C Oct 29 '09 at 11:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.