Wow, That's a Lot of Packets

Duane Wessels and Marina Fomenkov
Cooperative Association for Internet Data Analysis - CAIDA
San Diego Supercomputer Center,
University of California, San Diego

In this paper we characterize DNS clients that send large numbers of queries to root DNS servers. Analysis of trace data from the two F root servers shows a number of interesting characteristics. Many root server clients send an excessive number of packets. We describe a few of the busiest sources in detail. After classifying each query from the trace, we find that a very small percentage of the total traffic is legitimate.