Wolfgang Nagele

Increased Query Load on Root Name Servers

0 You have liked this article 0 times.

We experience an increased query load on K-root, the root server operated by the RIPE NCC. See below some analysis and graphs showing the traffic on K-root and other root servers.

Since 28 June at approximately 17:00 (UTC), we observe an increased number of queries on K-root and other root servers. In Figure 1 below, you can see the number of queries per second seen at all K-root global nodes.

Increased queries on k-root - global nodes

Figure 1: Number of queries per second seen at all K-root global nodes since yesterday

We see around 40,000 - 50,000 queries per second more than usual which is about four times the normal traffic load on the system.

You can see traffic shifting from AMS-IX (Amsterdam) to LINX (London) shortly before 20:00 hours UTC. We intiated this shift in order to gather data about the traffic source.

We are not yet sure what causes this increased query load, but we are in contact with ISPs that are carrying this traffic in order to investigate further. The root name server operators are coordinating observations and keeping a close eye on the developments. We update once we have more information.

Below you can see a series of DNSMON graphs that show how this incident affected the responsiveness of each of the root name servers. 

root from 61 Probes (AVERAGE) Figure 2: IPv4 unanswered queries for domain 'root' from 60 probes (Average)


  • Yellow = less than 66% of queries on average do not receive a response
  • Orange = more than 66% and less than 90% of all queries do not receive a response 
  • Red = more than 90% of the queries do not receive a response
The following graph shows the individual measurements for K-root during the same period.
You will notice that only a few test clients were affected because not all anycast instances of K-root were subject to the increase in traffic. Also not that we successfully mitigated the effect of the increased load even further around 06:30 UTC:

k-root 29 June 2011 Figure 3: K-root server


  • Horizontal = only single measurement nodes saw a problem
  • Vertical = most of the measurement nodes saw a problem
This  overview of current DNSMON measurements for the root name servers is publicly available. For more explanation of the DNSMON service, please refer to http://dnsmon.ripe.net

It is important to note that these measurements show that the root zone is fully available even though some root name servers show degraded performance. We expect no noticeable degradation of any Internet services caused by this.


0 You have liked this article 0 times.

About the author

Comments 9