[dns-operations] Who Ignores TTLs ?

Livingood, Jason Jason_Livingood at cable.comcast.com
Tue Feb 22 01:13:40 UTC 2011

>2) Incredible bursts
>We very often see a massive amount of request from a single address, for
>a single domain name. Sometimes 200-300 queries within a few hundred
>milliseconds (with an average delta of 3 milliseconds between queries).
>The load vaporizes as soon as the resolver receives the first response we
>send. This is not a DDoS, and normally, this will be hidden in the noise
>and thunder of the regular load.

Wow...  It'd be interesting to determine what resolver software is in use
when you see this. 


More information about the dns-operations mailing list