Traffic Analysis on a Domain Name System Server. SMTP Access Generates Many Name-Resolving Packets to a Greater Extent than Does POP3 Access

Abstract

A traffic analysis on the domain name system (DNS) server of Kumamoto University was carried out with the multivariate statistical analysis. It is found that the total number of DNS packets, D_q , are generated from an electronic mail (E-mail) server, as represented: D_q = m_SMTP N_SMTP + m_POP3 N_POP3 , where N_SMTP and N_POP3 represent the number of the simple mail transfer protocol (SMTP) access and that of the post office protocol version 3 (POP3) access, respectively. The linear coefficients m_SMTP and m_POP3 are calculated to be 8.6 and 1.0. From these results, it is clearly concluded that the DNS access from the E-mail server is mainly driven by the SMTP access to a greater extent than the POP3 access. Also, it is found that m_SMTP is represented, as follows: m_SMTP = 2+4n(1-q), where q is a mail-receiving rate and n is a number of different domain hosts.