[dns-operations] All requests are logged by BIND?

[Mike Hoskins (michoski)]

-----Original Message-----

From: Joe Abley <jabley at hopcount.ca>
Date: Monday, January 28, 2013 11:02 AM
To: Mike Hoskins <michoski at cisco.com>
Cc: "dns-operations at lists.dns-oarc.net" <dns-operations at lists.dns-oarc.net>
Subject: Re: [dns-operations]  All requests are logged by BIND?

>
>On 2013-01-25, at 15:05, Mike Hoskins (michoski) <michoski at cisco.com>
>wrote:
>
>> Well if you believe Google, you're comparing Quincy Public Schools and
>> Portland Public Schools, which have different lunch menus, job openings,
>> etc.
>> 
>> Sorry, needed to lighten up my day a bit...  8^P
>> 
>> Queries Per Second vs Packets Per Second...obviously PPS should be much
>> larger.
>
>Depends what you're counting.
>
>If you're counting requests from a client base that predominately
>supports EDNS0, pps ought to be very close to qps.
>
>If you're counting responses sent to that same client base, then you
>might well see pps > qps if you're counting fragments as separate packets
>(seems probable).
>
>If you're seeing a lot of TCP fallback, then you can expect the resulting
>handshake per q to cause pps > qps.
>
>You never expect qps < pps, but the degree to which pps > qps depends.

Sure...  Also depends what's being stuffed in the RRD.  If you're
monitoring "packets" on a name server's network interface (which is what I
derived from the OP's statement about a router), I'd expect a lot more
bits than DNS...ICMP, SSH, etc.  One reason I mentioned checking the units
on the graph.  :-)

Sorry to turn the horse into a wet spot on the ground.