strange TYPE queries
Kevin Darcy
kcd at daimlerchrysler.com
Thu Sep 29 22:01:16 UTC 2005
Mariano Cunietti wrote:
>Hi list,
>on my daily log summary I found this:
>
>Top 30 Query Types
>Count Type
>2428678 A
>577206 PTR
>304951 MX
>193680 AAAA
>179764 TXT
>60322 A6
>30976 SOA
>26088 SRV
>13799 ANY
>4168 NS
>754 CNAME
>11 TYPE48
>10 X25
>7 TYPE17224
>4 TYPE64024
>4 TYPE39016
>3 TYPE64040
>3 TYPE57176
>3 TYPE16840
>3 TYPE57160
>3 TYPE15576
>2 TYPE63896
>2 TYPE120
>2 TYPE10732
>2 TYPE37448
>2 TYPE42
>2 TYPE11416
>2 TYPE10716
>1 TYPE15080
>1 TYPE45736
>
>Can anybody explain what the TYPE* queries are?
>
The QTYPE field is numeric, with the various "A", "PTR", "MX", etc. just
being mnemonics to represent those numeric values. When a QTYPE doesn't
match any known mnemonic, BIND just writes it to the log as TYPExxxxx,
where xxxxx represents the actual numeric value, in decimal. Such bogus
queries can be the consequence of misbehaving software, mangled packets
or any number of other possible causes.
>Should I be concerned
>about?
>
As long as it's a fairly small percentage, I wouldn't worry about it.
- Kevin
More information about the bind-users
mailing list