Clients of DNS Root Servers

Under construction

Data were collected starting Wednesday 2002-08-29 16:10 UTC for a little over 4 days at 10 minute intervals from {a,e,f,i,k,m}-root servers using dnsstat. The collectors at {a,e,i,k,m}-root were each run on a host that was connected to a link that carried the root server traffic (either directly or mirrored). At f-root, there are 4 hosts sharing the root server load; on each of them, tcpdump was used to forward data to a nearby host where dnsstat was run.

Click on any graph to see a larger version.

These graphs show the number of unique clients seen by each individual server and by all servers combined, accumulated over the course of the 7 day collection period. Notice that the curves do not level off as we expected.

These graphs show the number of unique clients seen in each 10 minute interval by each server and by all servers combined. Notice the clear diurnal pattern (08-31 and 09-01 was a weekend).

These graphs show the number of new unique clients seen in each 10 minute interval by each server and by all servers combined; that is, clients that had not been seen in any previous interval.

These graphs show the number of queries seen by individual servers. Note that some clients byte-swap the 16-bit QDCOUNT field, so the value 1 is incorrectly written as 256. Queries in such messages are counted here even though they should probably be ignored, since the DNS server rejects these messages. At 08-30 08:30, there was a spike at k; 6.5 hours later, at 15:00, there was a spike at e, i and m. I haven't had a chance yet to investigate these spikes, but the fact that the second spike was observed at 3 independent monitors simultaneously implies it was real, and not a glitch in data collection.

These graphs show the CDF of the number of request messages sent by clients to each server. With a logarithmic x-axis, we can see that over half the clients sent 8 or fewer messages.

Here is the CCDF of number of messages sent, with log/log axes.

Intersections and unions of client sets of pairs of root servers, with union of all servers for comparison.

Query types seen at all monitored servers (e, f, i, k, m), in full view and zoomed in. "Unknown" contains all non-standard query types; "other" contains all query types that had low counts. The numbers in the legend give the total number of queries of that type seen in the 7 day sample period. New 2002-09-18: Added "A" queries to graphs, which were previously missing due to a 32 bit overflow in the analysis code. Other query types were unaffected.

-- Ken Keys