Bind bind high recv-q

[Tony Finch]

Søren Andersen <SOAN at stofa.dk> wrote:
>
> I'm experiencing some strange problems with my bind installation. - I
> notice my bind recv-q is quite high sometimes.. therefore my DNS clients
> can experience DNS lookup to take 1-4 secs. My bind is running on a 4
> core vm I VMware with 8Gb ram. - At peak I receive app. 700-800 QPS. -
> The load is 20-40% on each CPU core. - I've also configured 2 RPZ zones.

Is your server an open resolver being used as part of a DDoS attack?

Do you have compromised client machines running malware that hammers your
server?

Find out where the queries are coming from using netflow or tcpdump or
query logging.

Tony.
-- 
f.anthony.n.finch  <dot at dotat.at>  http://dotat.at/
Southeast Iceland: Southeasterly 6 to gale 8, becoming cyclonic 7 to severe
gale 9, then veering westerly gale 8 to storm 10, perhaps violent storm 11
later. High or very high later. Wintry showers. Moderate or poor, occasionally
very poor.