[dns-operations] maybe a small tcp flood

[Stefan Ubbink]

On Tue, 22 Jun 2021 15:56:16 -0700
Randy Bush <randy at psg.com> wrote:

> >> tcp query flood for cctlds and sec.cctlds, could be others
> >> being sent via popular open servers: goog, neustar, ...
> >> O(100)qps or higher  
> > 
> > - What was the duration of the event (UTC time start and end)?  
> 
> after a short break, it is ongoing
> 
> > - Any stats on the mix of qnames?
> >     * Repeated or distinct?
> >     * Extant, NODATA or NXDOMAIN?  
> 
> i am just running dnstop from cli.

Does your dnstop support TCP? The man page on my machine has the
following mentioned under BUGS:

Does not support TCP at this time.


-- 
Stefan Ubbink
DNS & Systems Engineer
Present: Mon, Tue, Wed, Fri
SIDN | Meander 501 | 6825 MD | ARNHEM | The Netherlands
T +31 (0)26 352 55 00
https://www.sidn.nl
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20210623/7b7f8a67/attachment.sig>