At Tue, 21 Dec 2010 22:58:14 -0800, Duane Wessels wrote: > You could get most of that with dnscap + dnstop. hard to tell. i did the hacks for a one day collection four days ago and dnstop still has not completed. this is a small server with only a bit above 3k qps. randy