DNS traffic tracking

[Fred Morris]

On Mon, 9 May 2022, Alex K wrote:
> [...]
> The problem now is that I see sometime 700MB of DNS traffic for 2GB of
> Internet browsing within one month.

That's an eyebrow raiser. Tunneling, antivirus (or some other database 
using DNS as a key+value store), CDN? IoT fleet? Then comes the inevitable 
"...or traffic you don't want".

Not clear on where the expensive link sits (between the caching resolver 
and clients, or between the caching resolver and the rest of the 
internet). Not sure what you're able to do politically or where things 
like privacy or "net neutrality" come into play, but it does seem to me 
that not burning precious bandwidth for ads might be a value-added 
service... if they're really watching cat videos.

I second the comment that Dnstap might be your best friend.

There are technical considerations, but I think generally this is veering 
into the realm of what's possible (which is seldom actually technical); 
this includes your means and ability to analyze the DNS traffic. If you 
want to discuss further feel free to email me.

--

Fred Morris, internet plumber