SV: Bind bind high recv-q

Søren Andersen SOAN at
Sun Dec 6 19:58:38 UTC 2015

Hi Tony,

Nope, my server is not an open resolver, but a lot of clients are using it :) - Actually one of my customers had a broken netgear device that was making 1000 qps for Probably some kind of software bug.

I can recommend dnstop to find "bad dns clients" - But dnstop also showed me I'm getting 5-7K qps, and not 700-800 as collectd showed me. 

Do you think this is too much for a VM? - My VM is only loaded 50% on each core.


-----Oprindelig meddelelse-----
Fra: Tony Finch [mailto:fanf2 at] På vegne af Tony Finch
Sendt: 4. december 2015 13:34
Til: Søren Andersen <SOAN at>
Cc: bind-users at
Emne: Re: Bind bind high recv-q

Søren Andersen <SOAN at> wrote:
> I'm experiencing some strange problems with my bind installation. - I 
> notice my bind recv-q is quite high sometimes.. therefore my DNS 
> clients can experience DNS lookup to take 1-4 secs. My bind is running 
> on a 4 core vm I VMware with 8Gb ram. - At peak I receive app. 700-800 
> QPS. - The load is 20-40% on each CPU core. - I've also configured 2 RPZ zones.

Is your server an open resolver being used as part of a DDoS attack?

Do you have compromised client machines running malware that hammers your server?

Find out where the queries are coming from using netflow or tcpdump or query logging.

f.anthony.n.finch  <dot at> Southeast Iceland: Southeasterly 6 to gale 8, becoming cyclonic 7 to severe gale 9, then veering westerly gale 8 to storm 10, perhaps violent storm 11 later. High or very high later. Wintry showers. Moderate or poor, occasionally very poor.

More information about the bind-users mailing list