Wow, That's a Lot of Packets
To appear in the Proceedings of Passive & Active Measurement Workshop (PAM) in 2003

Duane Wessels and Marina Fomenkov
Cooperative Association for Internet Data Analysis - CAIDA
San Diego Supercomputer Center,
University of California, San Diego

In this paper we characterize DNS clients that send large numbers of queries to root DNS servers. Analysis of trace data from the two F root servers shows a number of interesting characteristics. Many root server clients send an excessive number of packets. We describe a few of the busiest sources in detail. After classifying each query from the trace, we find that a very small percentage of the total traffic is legitimate.