root server trafifc

[Kevin Darcy]

Duane Powers wrote:

> Hi all,
>
> Got a question about something I don't quite get. I've got some pretty
> heavily laden resolvers, as well as some busy authoritative nameservers.
> We're seeing a lot of traffic on the caching resolvers from the
> different root servers, and I'm wondering why that might be. Why would
> the root servers query us? or is it the other way around - are we
> querying the root nameservers... ??? We are running on a solaris
> platform and if I run an iplog, and view udp packets - I see the packets
> there. How can I determine if these are replies or requests, and is
> there a reason for the root servers to query my caching resolver?

These are almost certainly responses to your queries.

Unless you have locked your query-source port to 53, you can distinguish
queries from responses by destination port number. Otherwise, you'll have
to look inside the packets for the QR (Query Response) bit.


- Kevin