The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with
query/response flag set to
0 in header and DNS response the one with the flag set to
- Are the jumps in responses with the width of about 30 minutes resemble some kind of attack?
- What about jumps in queries?
- Why is there a large and constant difference between the queries and responses for long period of time?
EDIT: Above graph shows DNS over UDP. Here is the SYNs/sec graph:
EDIT: This is a part of traffic passing a country and internet.