strange TYPE queries

Kevin Darcy kcd at daimlerchrysler.com
Thu Sep 29 22:01:16 UTC 2005


Mariano Cunietti wrote:

>Hi list,
>on my daily log summary I found this:
>
>Top 30 Query Types
>Count   Type
>2428678 A
>577206  PTR
>304951  MX
>193680  AAAA
>179764  TXT
>60322   A6
>30976   SOA
>26088   SRV
>13799   ANY
>4168    NS
>754     CNAME
>11      TYPE48
>10      X25
>7       TYPE17224
>4       TYPE64024
>4       TYPE39016
>3       TYPE64040
>3       TYPE57176
>3       TYPE16840
>3       TYPE57160
>3       TYPE15576
>2       TYPE63896
>2       TYPE120
>2       TYPE10732
>2       TYPE37448
>2       TYPE42
>2       TYPE11416
>2       TYPE10716
>1       TYPE15080
>1       TYPE45736
>
>Can anybody explain what the TYPE* queries are? 
>
The QTYPE field is numeric, with the various "A", "PTR", "MX", etc. just 
being mnemonics to represent those numeric values. When a QTYPE doesn't 
match any known mnemonic, BIND just writes it to the log as TYPExxxxx, 
where xxxxx represents the actual numeric value, in decimal. Such bogus 
queries can be the consequence of misbehaving software, mangled packets 
or any number of other possible causes.

>Should I be concerned
>about? 
>
As long as it's a fairly small percentage, I wouldn't worry about it.

                                                                         
                        - Kevin





More information about the bind-users mailing list