Network traffice and DNS server's resource consumption

The MailUtl3 runs the DNS queries. The queries increase in amount of the network traffic and DNS server's resource consumption. The authoer estimated the increase in amount of the network traffice and DNS server's reasouce consumption as shown in below because the author was anxious about them.

It is assumed that the host name corresponding to the IP address 192.168.0.1 is USER-001.ADSL.EXAMPLE.COM, in this document. Let's consider the traffic of the reverse lookup query from 192.168.0.1 to USER-001.ADSL.EXAMPLE.COM and the forward lookup query from USER-001.ADSL.EXAMPLE.COM to 192.168.0.1.

The Fully Qualified Domain Name (FQDN) expression of the 192.168.0.1 is 1.0.168.192.IN-ADDR.ARPA as shown in Figure 1.

[FQDN]

The sequence of the reverse lookup query is shown in Figure 2.

[Reverse lookup sequence]

The size of the header section in the DNS message is 12 octets. It is a fixed value. The question section of the DNS message in the sequence 1 and it meaning is in below.

01 31 01 30 03 31 36 38 03 31 39 32 07 49 4E 2D 41 44 44 52 04 41 52 50 41 00 00 01 00 01

01 31 01 30 03 31 36 38 03 31 39 32 07 49 4E 2D 41 44 44 52 04 41 52 50 41: QNAME=1.0.168.192.IN-ADDR.ARPA
00 01: QTYPE=1, a host address
00 01: QCLASS=1, the Internet

The size of the DNS message in the sequence 1 is 42 octets (12 octets in the Header section and 30 octets in the Question section). The size of the overheads in the Ethernet II packet is 54 octets. Please see the Overhaeds page for the detail of the overheads. There are so many DNS queries from other clients that sequence 2, 3, 4, 5, 6 and 7 are chached by the Resolver's name server and there will be no traffic in the Internet. The size of the DNS message in the sequence 8, 10 and 12 are same as that of sequence 1. The author does not understand clearly but it seems that the Question section and the Answer section in the sequence 9 become the following.

01 31 01 30 03 31 36 38 03 31 39 32 07 49 4E 2D 41 44 44 52 04 41 52 50 41 00 00 01 00 01 03 4E 53 31 CX XX 00 01 00 01 00 04 XX XX XX XX

01 31 01 30 03 31 36 38 03 31 39 32 07 49 4E 2D 41 44 44 52 04 41 52 50 41: QNAME=1.0.168.192.IN-ADDR.ARPA
00 01: QTYPE=1, a host address
00 01: QCLASS=1, the Internet
03 4E 53 31 CX XX: NAME=NS1.192.IN-ADDR.ARPA (XXX is an offset, NS1 is a name server in 192.IN-ADDR.ARPA domain.)
00 01: TYPE=1, a host address
00 01: CLASS=1, the canonical name for an alias
00 04: RDLENGTH=4
XX XX XX XX: IP address

The size above is 46. It is shorter than the dump example at http://www.netfor2.com/dns.htm. It must be more complexed than above. So, the author assumes that the size of the DNS message in the sequence 9, 11, 12 and 14 are 300 octets. These are summarized as shown in Table 1.

Table 1 Octet length for reverse lookup
Sequence number	DNS message size	Overhead size	Ethernet II packet size
1	42	54	96
2	0 (cached)	0 (cached)	0 (cached)
3	0 (cached)	0 (cached)	0 (cached)
4	0 (cached)	0 (cached)	0 (cached)
5	0 (cached)	0 (cached)	0 (cached)
6	0 (cached)	0 (cached)	0 (cached)
7	0 (cached)	0 (cached)	0 (cached)
8	42	54	96
9	300	54	354
10	42	54	96
11	300	54	354
12	42	54	96
13	300	54	354
14	300	54	354

On the oher hand, the sequence of the forward lookup query is shown in Figure 3.

[Reverse lookup sequence]

The question section of the DNS message in the sequence 1 and it meaning is in below.

08 55 53 45 52 2D 30 30 31 04 41 44 53 4C 07 45 58 41 4D 50 45 03 43 4F 4D 00 01 00 01

08 55 53 45 52 2D 30 30 31 04 41 44 53 4C 07 45 58 41 4D 50 45 03 43 4F 4D: QNAME=USER-001.ADSL.EXAMPLE.COM
00 01: QTYPE=1, a host address
00 01: QCLASS=1, the Internet

The size of the DNS message in the sequence 1 is 42 octets. The sequence 2 and 3 are chached by the Resolver's name server and there will be no traffic in the Internet. The size of the DNS message in the sequence 4, 6 and 8 are same as that of sequence 1. The author assumes that the size of the DNS message in the sequence 5,7,9 and 10 are 300 octets. These are summarized as shown in Table 2.

Table 2 Octet length for forward lookup
Sequence number	DNS message size	Overhead size	Ethernet II packet size
1	41	54	95
2	0 (cached)	0 (cached)	0 (cached)
3	0 (cached)	0 (cached)	0 (cached)
4	41	54	95
5	300	54	354
6	41	54	95
7	300	54	354
8	41	54	95
9	300	54	354
10	300	54	354

The MailUtl3 executes both the reverse lookup query and forward lookup query. The packet size caused by those query described above is 3,596 octets. The author guess that this value already has a margine but the author adds a margine moreover. The author assumes that network traffic will be 5,120 octets (5 KBytes) caused when the MailUtl3 processes one e-mail.

In the next step, let's consider the number of the query in the same time. The author assumes the number of the MailUtl3 users becomes 3,000 and users access the POP3 server every 10 minutes. Since the timing of the DNS query will be ruin, the author assumes that the percentage of concurrent access becomes 1% (30 users). The peak network traffice caused by the MailUtl3 is 150KB in several seconds. This value is nonfatal.

How about the DNS server's resource consumption? Only the Resolver's name server is recursive and other name servers are iterative. So, the Resolver's name server takes on the most load. The Resolver's name servers are located in the organizations or ISP's where the user of the MailUtl3 belongs. So, the resource consumption of the DNS servers in the Internet is negligible.

By the description in above, the author concludes that the MailUtl3 does not cause the fatal problem in the Internet.

Index page