Hacker News new | ask | show | jobs
by cthalupa 3111 days ago
Yet I don't think the author has a real takeaway: It's not 138KB.

Looking at DNS requests to those domains, I'm averaging about 30 bytes for the request and 70 bytes for the response.

Significantly larger and more complicated DNS requests returning a ton of DNSSEC records are coming around 4KB with eight separate UDP packets required for the response.

There is no way that 6 DNS queries for simple records and 1 NTP query comes in at 138 KB.

Edit: A dig on the 6 domains listed + a NTP query to one of them, for me, is sitting at less than 1KB total. Where are these numbers coming from?

Take a look at the response sizes in this CloudFlare post - https://blog.cloudflare.com/a-deep-dive-into-dns-packet-size... - they are talking about how they get DNSSEC responses under the 512 byte limit. The "unoptimized" ones are 4KB in response size. Even assuming that these domains turned on an unoptimized DNSSEC setup, that's still 24KB for those and less than 1KB for the NTP portion. The 138KB seems to be completely fabricated.

Edit2: Assuming the author meant 138 bytes as ktta pointed out, 86,400/5 = 17,280 sets of requests per day. That's 2,384,640 bytes, or ~2.3 megabytes a day. On a 31 day month, we're at ~71 megabytes. 1/10th of the amount the author is claiming.

Edit3: Though, 138 bytes seems low to me for 6 DNS queries and 1 NTP. Going by the numbers I get from a dig to the addresses it's closer to 600 bytes, which puts it at around ~309 megabytes per month. Without seeing what types of queries the repeaters are making it's hard for me to have any idea what the real numbers are, but it doesn't seem like the article's numbers add up regardless.

1 comments

Seems to me like 715 MB is about right, at least it's not off by a factor of 10.

There's no way you could fit six DNS queries and a couple of NTP queries into 138 bytes.

As pointed out by jlgaddis, based on the numbers in the article given for the size of DNS & NTP requests and responses, seems like the author meant 1380 bytes.

That gets you about 715 MB (or about 682 MiB).

My third edit included a bit more on this - I'm closer to 600 bytes total than 1380. A few of them are sitting at closer to 80 bytes for a request+response for DNS, etc. With a quick while loop and tcpdump, I'm seeing the number as being off by about 2x from my testing.

My DNS numbers are all basically half his - all of my requests are sub 40 bytes, responses are all sub 80, some are sub 60. My NTP query and response packets are pretty close, though - sitting around 80 bytes for request and response.

Your DNS numbers are off because you aren't counting IP and UDP headers

See my edit - https://news.ycombinator.com/item?id=15912467

Even using -e and looking at length I'm still significantly under 1380 bytes.

dig/ntpq on osx.

Can you take a look at the edit and comment on where your numbers differ exactly? I tried to be as accurate as possible. I used the busybox_NTPD from https://busybox.net/downloads/binaries/