>From: "Russell P. Sutherland" <[log in to unmask]>
>To: [log in to unmask]

>I have done a very rough sampling of traffic on the backbone IP traffic
>this morning (9:30 am Fri 2 Aug 1996) using our sniffer.  Here are the
>results based on 9036 ethernet frames: 

>	Protocol     # of frames      Percent

>	  dns (udp)	2025		22
>	  dns (tcp)	 431		 5
(snip)

>The DNS zone transfers are performed using tcp. Most other queries are
>udp. (Please note that I assumed that all of the udp traffic
>was dns based. This seemed to be a reasonable assumption
>based on the frames that I looked at.)

How does this sniffer work?  Does it include http accesses?  I am having
trouble believing that DNS is a total of 27% of backbone traffic.  Even
the 5% assigned to DNS from TCP seems way too high.  All the netscape
sessions, or news feeds, running in UofT, downloading text and images,
would seem to be hundreds of times more data than DNS.  (Even more with
all the windows weenies --- I mean office PCs.) I have checked my DNS
files and, though our net is small, I have to believe our netscape and ftp
use alone must be far larger than these files. (Even more with all the
windows weenies --- I mean office PCs.) I can only guess that larger nets
with more hosts and terminals, with larger DNS databases, would have
proportionately more netscape and ftp use. 

I recall that netrek, web phone and desktop video all use UDP, and quite
intensively.  Assuming 100% of UDP is DNS --- at any time of the day ---
seems risky. 

If I am totally out to lunch on this, and DNS is such a large amount of
traffic, I have a suggestion.  Lets all agree to double our time constants
in our SOA records.  I can't recall from my reading whether that will cut
the traffic by a factor of two or not but it will certainly put a dent in
it.  I for one would trade propagation speed for added functionality (i.e.
continued use of .toronto.edu). 

Matt Malone