The system is getting A LOT of DNS queries for “ au.pool.ntp.org ”. The numbered zones are getting very reasonable numbers each (dozens per second), but the unnumbered zone is getting about 3,000 queries per second. Do those of you who operate servers in the au zone see a significant number of NTP qu…

Oddly, I’ve actually seen a drop in traffic over the past couple of days to my Australian server. This is the traffic over the past 7 days, the green line is a 24hr average bandwidth, going from ~2.6mb/sec down to ~1.2mb/sec. [Screenshot%20from%202018-06-01%2013-52-54] Server is in Sidney, with @…

Unfortunately, I can’t comment on the source of much of the traffic I received, but this is what my ISP’s Internet usage chart looked like yesterday afternoon. [adslstats] I’m expecting a pelican to fly into my email inbox when Internode send me the next invoice.

[57] The excess usage totals, for what it’s worth. My usual bill is about AU$60. I’m told they cap excess usage to $300, I shall find out.

After what I’ve seen on the networks I administrate, there are some TP-Link devices that are doing excessive NTP and DNS queries (to the local resolver). I can’t tell at the moment, if they are asking for au.pool.ntp.org - I could find out in the next few days. From what I’ve seen I can tell, they…

I’ve only recently started using grafana so I don’t have much historical data. [dynamic-dashboard] Forgot to mention that the server is also a DNS resolver so the data might be skewed. The server is rented from Vultr in Sydney. I’m using chrony with the default rate limiting enabled .

That figures, someone should show these goons what libpcap does… then they won’t have to burn through peoples’ Internet quotas to see if the Internet is working.

Btw: Is it intended, that the AU zone has a lower TTL (55 seconds) than the other zones (150 seconds)? Maybe the by 3 times lower TTL is the reason for that many DNS queries?

Indeed! I can’t believe I forgot about that. Brazil and Australia both had an override; Australia’s was related to the Snapchat traffic spike. I’ll reset it to normal so we can get better numbers.

Ok, that did decrease the DNS queries for the au zone, but it’s still upside down from the other zones. Most zones have more queries from users in that country than queries to the “ cc.pool.ntp.org ” zones. I made a snapshot of AU, BR (which also had a shorter TTL) and CA (just for comparison): Quer…

Excessive traffic to Australian servers?

Server operators

ask June 6, 2018, 6:03am 6

Ugh, that seems likely. At Amazon Route53 pricing their ~3000 qps (about 8 billion requests per month) would be $40k/year.

Topic		Replies	Views
General statistics questions Server operators	18	327	October 19, 2025
Excessive DNS queries Server operators dns	21	4724	December 9, 2022
South African NTP server hammered by Chinese IPs GeoDNS Server	6	1318	December 8, 2018
Current Pool Capacity? Pool Development	19	2681	May 21, 2025
Steady traffic increase BE since around midnight CET yesterday Server operators	52	764	December 24, 2025

Excessive traffic to Australian servers?

Related topics