Hi Heather, <span id="result_box" class="" lang="en"><span class="hps">these</span> <span class="hps">queries</span> <span class="hps">reach our</span> <span class="hps">resolvers</span> <span class="hps">all day</span> <span class="hps">for at</span> <span class="hps">least more</span> <span class="hps">than 1 year</span> <span class="hps">and have been</span> <span class="hps">increasing over</span> <span class="hps">time.</span> <span class="hps">Not all customers</span> <span class="hps">consult</span> <span class="hps">every 2</span> <span class="hps">seconds,</span> <span class="hps">some do it</span> <span class="hps">less frequently</span> <span class="hps">but</span> <span class="hps">steadily.</span></span><br>
<br><div class="gmail_quote">On Thu, Mar 1, 2012 at 3:04 PM, Schiller, Heather A <span dir="ltr"><<a href="mailto:heather.schiller@verizon.com">heather.schiller@verizon.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Warm up for later this month?  Is it every 2 seconds continuously or intermittently?  When did it start?<br>
<span class="HOEnZb"><font color="#888888"><br>
--Heather<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
-----Original Message-----<br>
From: Dario Aguilar [mailto:<a href="mailto:dariojaguilar@gmail.com">dariojaguilar@gmail.com</a>]<br>
Sent: Friday, January 13, 2012 4:34 PM<br>
To: <a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>
Subject: Many dns queries to <a href="http://a.root-servers.net" target="_blank">a.root-servers.net</a><span onmouseout="cancel = false; window.setTimeout(WRCHideContent, 1000); clearTimeout(showTimer);" onmouseover=" var self = this; showTimer = window.setTimeout(function(){WRCShowContent({'rating':{'value':-1,'weight':-1},'flags':{},'single':false,'ttl':7200,'expireTime':'20120301055608'}, self.className)},600);" class="wrc0" style="padding-right:16px;width:16px;height:16px"></span><br>

<br>
Hi, I'm seeing quite a lot of queries for "<a href="http://a.root-servers.net" target="_blank">a.root-servers.net</a><span onmouseout="cancel = false; window.setTimeout(WRCHideContent, 1000); clearTimeout(showTimer);" onmouseover=" var self = this; showTimer = window.setTimeout(function(){WRCShowContent({'rating':{'value':-1,'weight':-1},'flags':{},'single':false,'ttl':7200,'expireTime':'20120301055608'}, self.className)},600);" class="wrc0" style="padding-right:16px;width:16px;height:16px"></span> IN A" in the logs of my caching servers. They seem to be coming from home normal DSL customers (IPs who would be expected to be using the name servers) with each sending one query every 2 seconds.<br>

They all together represents more than de 10% of the total queries. I am guessing it is probably some sort of spyware/malware/virus/router/O.S.<br>
version but I was wondering if anyone knows offhand?<br>
</div></div></blockquote></div><br>