Clients of DNS Root Servers
Under constructionData were collected starting Wednesday 2002-08-29 16:10 UTC for a little over 4 days at 10 minute intervals from {a,e,f,i,k,m}-root servers using dnsstat. The collectors at {a,e,i,k,m}-root were each run on a host that was connected to a link that carried the root server traffic (either directly or mirrored). At f-root, there are 4 hosts sharing the root server load; on each of them, tcpdump was used to forward data to a nearby host where dnsstat was run.
Click on any graph to see a larger version.
These graphs show the number of unique clients seen by each individual server and by all servers combined, accumulated over the course of the 7 day collection period. Notice that the curves do not level off as we expected.
![]() | ![]() | ![]() |
These graphs show the number of unique clients seen in each 10 minute interval by each server and by all servers combined. Notice the clear diurnal pattern (08-31 and 09-01 was a weekend).
![]() | ![]() | ![]() |
These graphs show the number of new unique clients seen in each 10 minute interval by each server and by all servers combined; that is, clients that had not been seen in any previous interval.
![]() | ![]() | ![]() |
These graphs show the number of queries seen by individual servers. Note that some clients byte-swap the 16-bit QDCOUNT field, so the value 1 is incorrectly written as 256. Queries in such messages are counted here even though they should probably be ignored, since the DNS server rejects these messages. At 08-30 08:30, there was a spike at k; 6.5 hours later, at 15:00, there was a spike at e, i and m. I haven't had a chance yet to investigate these spikes, but the fact that the second spike was observed at 3 independent monitors simultaneously implies it was real, and not a glitch in data collection.
![]() | ![]() | ![]() |
These graphs show the CDF of the number of request messages sent by clients to each server. With a logarithmic x-axis, we can see that over half the clients sent 8 or fewer messages.
![]() | ![]() |
Here is the CCDF of number of messages sent, with log/log axes.
Intersections and unions of client sets of pairs of root servers, with union of all servers for comparison.
![]() | ![]() |
Query types seen at all monitored servers (e, f, i, k, m), in full view and zoomed in. "Unknown" contains all non-standard query types; "other" contains all query types that had low counts. The numbers in the legend give the total number of queries of that type seen in the 7 day sample period. New 2002-09-18: Added "A" queries to graphs, which were previously missing due to a 32 bit overflow in the analysis code. Other query types were unaffected.
![]() | ![]() |
-- Ken Keys