Debugging DNS response times with tshark, (Fri, Jan 2nd)
ID: c50a8eb7-e55b-55d8-a1ba-3c41090a9a23
STIX ID: report--c50a8eb7-e55b-55d8-a1ba-3c41090a9a23
Feed Name: SANS ISC Diary
A homelab DNS performance investigation used tshark to analyze query types and response times, uncovering that excessive PTR reverse lookups from a GPS-synced NTP server (in pool.ntp.org) and sporadic slow responses (up to ~8 seconds) contributed to perceived web slowness; major public resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9, and the ISP DNS) exhibited nearly identical average performance, and the immediate remediation was disabling reverse lookups on the NTP server to reduce timeouts while continuing to monitor for other causes.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.