Regarding query timeout values for UDP versus TCP queries: I have run several queries with "dig" over TCP and UDP and see very little difference in the reported query times between them. Inspecting the packet trace, it is clear that the TCP handshake is NOT included in the reported query time from "dig". If we assume that the timeout is in relation to this same query timer, then there should be no need to differentiate timeout values between TCP and UDP (assuming also that UDP and TCP responses aren't significantly different in size). RSSAC047 does not specify separate timeouts for UDP and TCP queries. It does, however, distinguish between TCP and UDP threshold latencies since it includes the TCP handshake in the latency measurement. Both UDP and TCP thresholds are below the 1 second (Local Perspective) and 4 second (RSSAC047) timeouts. With that said, do we still want to have a separate timeout for UDP and TCP in the Local Perspective tool dig commands? -Ken ==================================================== #!/bin/bash ### ### Use these top 2 loops for a quick comparison and summary of UDP versus TCP timing ### # For each of these 'popular' domains, get their set of NS records, and then # directly query each of them for an SOA record via UDP. Average the time for each # domain, then average those averages. echo "UDP" for DOMAIN in google.com akamai.net facebook.com microsoft.com amazon.com wikipedia.com do for NS in `dig +short NS $DOMAIN` do echo -n $NS dig +notcp @$NS SOA $DOMAIN | grep "Query time" done | awk '{SUM+=$4} END {print SUM/NR;}' done | awk '{sum += $1} END {print sum/NR}' # For each of these 'popular' domains, get their set of NS records, and then # directly query each of them for an SOA record via TCP. Average the time for each # domain, then average those averages. echo "TCP" for DOMAIN in google.com akamai.net facebook.com microsoft.com amazon.com wikipedia.com do for NS in `dig +short NS $DOMAIN` do echo -n $NS dig +tcp @$NS SOA $DOMAIN | grep "Query time" done | awk '{SUM+=$4} END {print SUM/NR;}' done | awk '{sum += $1} END {print sum/NR}' ### ### Use these bottom 2 loops to display each query time for comparison to packet trace ### # For each of these 'popular' domains, get their set of NS records, and then # directly query each of them for an SOA record via UDP. Display the query time result # for each so that they can be compared to a packet dump echo "UDP" for DOMAIN in google.com akamai.net facebook.com microsoft.com amazon.com wikipedia.com do for NS in `dig +short NS $DOMAIN` do echo -n $NS dig +notcp @$NS SOA $DOMAIN | grep "Query time" done done # For each of these 'popular' domains, get their set of NS records, and then # directly query each of them for an SOA record via TCP. Display the query time result # for each so that they can be compared to a packet dump echo "TCP" for DOMAIN in google.com akamai.net facebook.com microsoft.com amazon.com wikipedia.com do for NS in `dig +short NS $DOMAIN` do echo -n $NS dig +tcp @$NS SOA $DOMAIN | grep "Query time" done done