> What do the queries look like? Any patterns you can seine out? waiting for the daily dnscap/dnstop cyclic report spent a bit of time looking for a simple query log analysis tool. maybe i needed more coffee. pointers appreciated. > If it's running BIND, try turning on RRL. did that a couple of years ago. pushed it at some of the nogs. randy