Slow DNS resolution in NAT environment

[jmny]

We have slow DNS resolution on client machines. Disables almost everything but problem persists. Disabled Policies and DNS filtering.

Please help. It happens from time to time only.

J_FG_Sofia # diag sniffer packet any 'port 53' and 'host destination-ip-address' 4
interfaces=[any]
filters=[port 53]
0.319559 10.10.1.3.37916 -> 185.228.168.10.53: udp 36
0.319606 31.13.217.38.37916 -> 185.228.168.10.53: udp 36
0.431941 185.228.168.10.53 -> 31.13.217.38.37916: udp 292
0.431994 185.228.168.10.53 -> 10.10.1.3.37916: udp 292
1.012498 10.10.1.3.54763 -> 185.228.168.10.53: udp 35
1.012537 31.13.217.38.54763 -> 185.228.168.10.53: udp 35
1.147913 185.228.168.10.53 -> 31.13.217.38.54763: udp 109
1.147960 185.228.168.10.53 -> 10.10.1.3.54763: udp 109
2.184699 10.10.1.3.43578 -> 185.228.168.10.53: udp 37
2.184724 31.13.217.38.43578 -> 185.228.168.10.53: udp 37
2.359038 10.10.1.3.43270 -> 185.228.168.10.53: syn 3232741629
2.359060 31.13.217.38.43270 -> 185.228.168.10.53: syn 3232741629
2.892386 10.10.1.3.53997 -> 185.228.168.10.53: udp 33
2.892448 10.10.1.3.34421 -> 185.228.168.10.53: udp 33
2.892459 31.13.217.38.53997 -> 185.228.168.10.53: udp 33
2.892489 31.13.217.38.34421 -> 185.228.168.10.53: udp 33
2.918159 10.10.1.3.42331 -> 185.228.168.10.53: udp 36
2.918196 31.13.217.38.42331 -> 185.228.168.10.53: udp 36
2.918229 10.10.1.3.56745 -> 185.228.168.10.53: udp 36
2.918264 31.13.217.38.56745 -> 185.228.168.10.53: udp 36
3.217876 10.10.1.3.43578 -> 185.228.168.10.53: udp 37
3.217897 31.13.217.38.43578 -> 185.228.168.10.53: udp 37
4.304926 10.10.1.3.43798 -> 185.228.168.10.53: udp 43
4.304978 31.13.217.38.43798 -> 185.228.168.10.53: udp 43
4.304996 10.10.1.3.35846 -> 185.228.168.10.53: udp 43
4.305041 31.13.217.38.35846 -> 185.228.168.10.53: udp 43
4.386688 10.10.1.3.42331 -> 185.228.168.10.53: udp 36
4.386708 31.13.217.38.42331 -> 185.228.168.10.53: udp 36
4.417971 185.228.168.10.53 -> 31.13.217.38.43798: udp 59
4.418016 185.228.168.10.53 -> 10.10.1.3.43798: udp 59
4.909003 10.10.1.3.43342 -> 185.228.168.10.53: syn 4223342628
4.909023 31.13.217.38.43342 -> 185.228.168.10.53: syn 4223342628
5.124205 10.10.1.3.56437 -> 185.228.168.10.53: udp 32
5.124296 31.13.217.38.56437 -> 185.228.168.10.53: udp 32
5.124303 10.10.1.3.50715 -> 185.228.168.10.53: udp 32
5.124337 31.13.217.38.50715 -> 185.228.168.10.53: udp 32
5.174387 10.10.1.3.39651 -> 185.228.168.10.53: udp 41
5.174424 31.13.217.38.39651 -> 185.228.168.10.53: udp 41
5.174460 10.10.1.3.37242 -> 185.228.168.10.53: udp 41
5.174494 31.13.217.38.37242 -> 185.228.168.10.53: udp 41
5.303137 10.10.1.3.58830 -> 185.228.168.10.53: udp 32
5.303199 31.13.217.38.58830 -> 185.228.168.10.53: udp 32
5.315585 10.10.1.3.43578 -> 185.228.168.10.53: udp 37
5.315609 31.13.217.38.43578 -> 185.228.168.10.53: udp 37
5.382068 185.228.168.10.53 -> 31.13.217.38.50715: udp 57
5.382092 185.228.168.10.53 -> 10.10.1.3.50715: udp 57
5.418272 10.10.1.3.42331 -> 185.228.168.10.53: udp 36
5.418291 31.13.217.38.42331 -> 185.228.168.10.53: udp 36
5.688779 185.228.168.10.53 -> 31.13.217.38.43578: udp 77
5.688883 185.228.168.10.53 -> 10.10.1.3.43578: udp 77
5.690639 185.228.168.10.53 -> 31.13.217.38.56437: udp 48
5.690725 185.228.168.10.53 -> 10.10.1.3.56437: udp 48
5.725201 185.228.168.10.53 -> 31.13.217.38.58830: udp 64
5.725250 185.228.168.10.53 -> 10.10.1.3.58830: udp 64
5.752885 10.10.1.3.53997 -> 185.228.168.10.53: udp 33
5.752912 31.13.217.38.53997 -> 185.228.168.10.53: udp 33
6.128477 185.228.168.10.53 -> 31.13.217.38.53997: udp 49
6.128535 185.228.168.10.53 -> 10.10.1.3.53997: udp 49
6.449067 31.13.217.38.3435 -> 212.73.138.38.53: udp 35
6.547578 212.73.138.38.53 -> 31.13.217.38.3435: udp 144
6.623287 10.10.1.3.52512 -> 185.228.168.10.53: udp 32
6.623333 31.13.217.38.52512 -> 185.228.168.10.53: udp 32
6.869064 31.13.217.38.3435 -> 212.73.140.66.53: udp 32
6.869588 212.73.140.66.53 -> 31.13.217.38.3435: udp 48
7.482449 10.10.1.3.42331 -> 185.228.168.10.53: udp 36
7.482482 31.13.217.38.42331 -> 185.228.168.10.53: udp 36
7.760146 10.10.1.3.54457 -> 1.1.1.1.53: udp 24
7.760198 31.13.217.38.54457 -> 1.1.1.1.53: udp 24
7.760873 1.1.1.1.53 -> 31.13.217.38.54457: udp 88
7.760919 1.1.1.1.53 -> 10.10.1.3.54457: udp 88
8.097373 10.10.1.3.32919 -> 185.228.168.10.53: udp 37
8.097439 31.13.217.38.32919 -> 185.228.168.10.53: udp 37
8.099313 10.10.1.3.51893 -> 185.228.168.10.53: udp 37
8.099378 31.13.217.38.51893 -> 185.228.168.10.53: udp 37
8.225271 185.228.168.10.53 -> 31.13.217.38.51893: udp 53
8.225321 185.228.168.10.53 -> 10.10.1.3.51893: udp 53
8.249510 185.228.168.10.53 -> 31.13.217.38.32919: udp 87

[AEK]

What do you mean by slow?

According to your logs we can see that DNS-UDP responses from public DNS take about  0.12s, which is very acceptable speed.

[jmny]

During the day when client machines access DNS we see wait times. Some clients can't load a single page for minutes. Then it works. Browser shows Resolving.. 

If I open nslookup and make a lookup it take ages to complete and sometimes doesn't give a resolved response.

And then magically the in a few hours everything works fine.

ISP DNS are fast to resolve so it must be the forti.

[saneeshpv_FTNT]

Please capture logs from the PC, FTNT Firewall and other devices if possible simultaneously while you the face issues. I could see that you aren't using FortiGuard DNS and also the sniffer output looks fine. 

[sw2090]

we found that the default Fortinet DNS that are in FortiOS are rather slow. 

So is SDNS if you use DNS filtering since it only uses US servers per default.

Setting system dns to e,g, Cloudflare or our ISPs DNS srvers together with setting the interface-select-method to sdwan and also setting this for fortiguard and have fortiguard anycast enabled and use aws as source improved that a lot.

[jmny]

Our setup is ISP - FortiGate - UDM Pro

FortiGate runs 2000 sessions (is that a lot?)

CPU and Memory looks normal.

Started to disable stuff. Stopped all firewall policies, stopped social filters, stopped DNS filtering. Yet the issue keeps surfacing once or twice a week.

[AEK]

• Do you have DoS policy for UDP? If so then disable it and try again
• Do you have traffic shaping policy?
• Please share another diag sniffer output when the problem occurs. The one you shared show no issue.

[jmny]

What should I look for in this logs?

Can't seem to attach more than 20k chars here?

I thought this is paid support...

[jmny]

Seriously. We are not going with this setup in our next office.

25.014077 10.10.1.3.51112 -> 185.228.168.10.53: udp 33
25.014084 10.10.1.3.45083 -> 185.228.168.10.53: udp 33
25.014095 31.13.217.38.37333 -> 185.228.168.10.53: udp 40
25.014100 10.10.1.3.51550 -> 185.228.168.10.53: udp 36
25.014111 31.13.217.38.51112 -> 185.228.168.10.53: udp 33
25.014118 31.13.217.38.51550 -> 185.228.168.10.53: udp 36
25.014124 10.10.1.3.50370 -> 185.228.168.10.53: udp 34
25.014126 31.13.217.38.45083 -> 185.228.168.10.53: udp 33
25.014157 31.13.217.38.50370 -> 185.228.168.10.53: udp 34
25.014169 10.10.1.3.55169 -> 185.228.168.10.53: udp 31
25.014201 31.13.217.38.55169 -> 185.228.168.10.53: udp 31
25.014233 10.10.1.3.44682 -> 185.228.168.10.53: udp 42
25.014267 31.13.217.38.44682 -> 185.228.168.10.53: udp 42
25.014296 10.10.1.3.38549 -> 185.228.168.10.53: udp 39
25.014335 31.13.217.38.38549 -> 185.228.168.10.53: udp 39
26.171857 31.13.217.38.1109 -> 212.73.138.38.53: udp 32
26.172229 212.73.138.38.53 -> 31.13.217.38.1109: udp 48
26.444080 10.10.1.3.58575 -> 185.228.168.10.53: udp 33
26.444161 31.13.217.38.58575 -> 185.228.168.10.53: udp 33
27.098610 10.10.1.3.35873 -> 185.228.168.10.53: udp 34
27.098635 31.13.217.38.35873 -> 185.228.168.10.53: udp 34
27.108004 10.10.1.3.50940 -> 185.228.168.10.53: udp 34
27.108026 31.13.217.38.50940 -> 185.228.168.10.53: udp 34
27.317494 10.10.1.3.57474 -> 1.1.1.1.53: udp 24
27.317586 31.13.217.38.57474 -> 1.1.1.1.53: udp 24
27.318791 1.1.1.1.53 -> 31.13.217.38.57474: udp 88
27.318835 1.1.1.1.53 -> 10.10.1.3.57474: udp 88
27.518710 10.10.1.3.54264 -> 185.228.168.10.53: udp 46
27.518729 31.13.217.38.54264 -> 185.228.168.10.53: udp 46
27.519458 10.10.1.3.51550 -> 185.228.168.10.53: udp 36
27.519480 31.13.217.38.51550 -> 185.228.168.10.53: udp 36
27.519514 10.10.1.3.48230 -> 185.228.168.10.53: udp 43
27.519536 31.13.217.38.48230 -> 185.228.168.10.53: udp 43
27.519553 10.10.1.3.58730 -> 185.228.168.10.53: udp 39
27.519571 31.13.217.38.58730 -> 185.228.168.10.53: udp 39
27.519596 10.10.1.3.50487 -> 185.228.168.10.53: udp 51
27.519614 31.13.217.38.50487 -> 185.228.168.10.53: udp 51
27.519637 10.10.1.3.33810 -> 185.228.168.10.53: udp 43
27.519655 31.13.217.38.33810 -> 185.228.168.10.53: udp 43
27.519677 10.10.1.3.41396 -> 185.228.168.10.53: udp 43
27.519694 31.13.217.38.41396 -> 185.228.168.10.53: udp 43
27.519716 10.10.1.3.37101 -> 185.228.168.10.53: udp 39
27.519733 31.13.217.38.37101 -> 185.228.168.10.53: udp 39
27.519759 10.10.1.3.33949 -> 185.228.168.10.53: udp 53
27.519778 31.13.217.38.33949 -> 185.228.168.10.53: udp 53
27.524102 10.10.1.3.52091 -> 185.228.168.10.53: udp 47
27.524162 31.13.217.38.52091 -> 185.228.168.10.53: udp 47
27.524792 10.10.1.3.47230 -> 185.228.168.10.53: udp 34
27.524833 31.13.217.38.47230 -> 185.228.168.10.53: udp 34
27.526070 10.10.1.3.42652 -> 185.228.168.10.53: udp 34
27.526108 31.13.217.38.42652 -> 185.228.168.10.53: udp 34
27.526134 10.10.1.3.59000 -> 185.228.168.10.53: udp 27
27.526169 31.13.217.38.59000 -> 185.228.168.10.53: udp 27
27.526196 10.10.1.3.41997 -> 185.228.168.10.53: udp 32
27.526231 31.13.217.38.41997 -> 185.228.168.10.53: udp 32
27.526253 10.10.1.3.34957 -> 185.228.168.10.53: udp 34
27.526286 31.13.217.38.34957 -> 185.228.168.10.53: udp 34
27.526320 10.10.1.3.55234 -> 185.228.168.10.53: udp 34
27.526359 31.13.217.38.55234 -> 185.228.168.10.53: udp 34
27.526360 10.10.1.3.45083 -> 185.228.168.10.53: udp 33
27.526377 31.13.217.38.45083 -> 185.228.168.10.53: udp 33
27.526417 10.10.1.3.49940 -> 185.228.168.10.53: udp 33
27.526452 31.13.217.38.49940 -> 185.228.168.10.53: udp 33
27.639432 10.10.1.3.55579 -> 185.228.168.10.53: udp 53
27.639469 31.13.217.38.55579 -> 185.228.168.10.53: udp 53
27.639483 10.10.1.3.44335 -> 185.228.168.10.53: udp 53
27.639502 31.13.217.38.44335 -> 185.228.168.10.53: udp 53
27.948708 10.10.1.3.32911 -> 185.228.168.10.53: udp 31
27.948737 31.13.217.38.32911 -> 185.228.168.10.53: udp 31
28.046993 10.10.1.3.58058 -> 185.228.168.10.53: udp 40
28.047079 31.13.217.38.58058 -> 185.228.168.10.53: udp 40
28.436158 10.10.1.3.51511 -> 212.73.140.66.53: udp 33
28.436198 10.10.1.3.51511 -> 212.73.138.38.53: udp 33
28.436223 31.13.217.38.51511 -> 212.73.140.66.53: udp 33
28.436240 31.13.217.38.51511 -> 212.73.138.38.53: udp 33
28.436587 212.73.138.38.53 -> 31.13.217.38.51511: udp 186
28.436631 212.73.138.38.53 -> 10.10.1.3.51511: udp 186
28.436637 10.10.1.3.45946 -> 212.73.140.66.53: udp 32
28.436664 10.10.1.3.45946 -> 212.73.138.38.53: udp 32
28.436675 31.13.217.38.45946 -> 212.73.140.66.53: udp 32
28.436706 31.13.217.38.45946 -> 212.73.138.38.53: udp 32
28.436790 212.73.140.66.53 -> 31.13.217.38.51511: udp 186
28.436821 212.73.140.66.53 -> 10.10.1.3.51511: udp 186
28.436958 10.10.1.3.38543 -> 212.73.140.66.53: udp 33
28.436972 212.73.138.38.53 -> 31.13.217.38.45946: udp 60
28.436983 10.10.1.3.38543 -> 212.73.138.38.53: udp 33
28.436996 31.13.217.38.38543 -> 212.73.140.66.53: udp 33
28.437001 212.73.138.38.53 -> 10.10.1.3.45946: udp 60
28.437025 31.13.217.38.38543 -> 212.73.138.38.53: udp 33
28.437089 10.10.1.3.35392 -> 212.73.140.66.53: udp 32
28.437113 10.10.1.3.35392 -> 212.73.138.38.53: udp 32
28.437128 31.13.217.38.35392 -> 212.73.140.66.53: udp 32
28.437151 31.13.217.38.35392 -> 212.73.138.38.53: udp 32
28.437170 212.73.140.66.53 -> 31.13.217.38.45946: udp 60
28.437196 212.73.140.66.53 -> 10.10.1.3.45946: udp 60
28.437345 10.10.1.3.36234 -> 212.73.140.66.53: udp 28
28.437379 10.10.1.3.36234 -> 212.73.138.38.53: udp 28
28.437381 31.13.217.38.36234 -> 212.73.140.66.53: udp 28
28.437413 31.13.217.38.36234 -> 212.73.138.38.53: udp 28
28.437444 212.73.138.38.53 -> 31.13.217.38.38543: udp 174
28.437471 212.73.138.38.53 -> 10.10.1.3.38543: udp 174
28.437501 212.73.138.38.53 -> 31.13.217.38.35392: udp 48
28.437526 212.73.138.38.53 -> 10.10.1.3.35392: udp 48
28.437571 10.10.1.3.33735 -> 212.73.140.66.53: udp 28
28.437597 10.10.1.3.33735 -> 212.73.138.38.53: udp 28
28.437608 31.13.217.38.33735 -> 212.73.140.66.53: udp 28
28.437629 212.73.140.66.53 -> 31.13.217.38.35392: udp 48
28.437632 31.13.217.38.33735 -> 212.73.138.38.53: udp 28
28.437651 212.73.140.66.53 -> 10.10.1.3.35392: udp 48
28.437740 212.73.138.38.53 -> 31.13.217.38.36234: udp 92
28.437766 212.73.138.38.53 -> 10.10.1.3.36234: udp 92
28.437968 212.73.140.66.53 -> 31.13.217.38.36234: udp 92
28.437995 212.73.140.66.53 -> 10.10.1.3.36234: udp 92
28.438016 212.73.138.38.53 -> 31.13.217.38.33735: udp 252
28.438043 212.73.138.38.53 -> 10.10.1.3.33735: udp 252
28.440120 212.73.140.66.53 -> 31.13.217.38.33735: udp 252
28.440147 212.73.140.66.53 -> 10.10.1.3.33735: udp 252
28.440441 212.73.140.66.53 -> 31.13.217.38.38543: udp 174
28.440469 212.73.140.66.53 -> 10.10.1.3.38543: udp 174
28.497826 10.10.1.3.43570 -> 185.228.168.10.53: udp 39
28.497867 31.13.217.38.43570 -> 185.228.168.10.53: udp 39
28.497905 10.10.1.3.44487 -> 185.228.168.10.53: udp 39
28.497941 31.13.217.38.44487 -> 185.228.168.10.53: udp 39
28.654594 10.10.1.3.44335 -> 185.228.168.10.53: udp 53
28.654613 31.13.217.38.44335 -> 185.228.168.10.53: udp 53
29.212098 10.10.1.3.43309 -> 185.228.168.10.53: udp 49
29.212181 31.13.217.38.43309 -> 185.228.168.10.53: udp 49
29.414125 10.10.1.3.47962 -> 185.228.168.10.53: udp 41
29.414172 31.13.217.38.47962 -> 185.228.168.10.53: udp 41
29.528644 10.10.1.3.38781 -> 185.228.168.10.53: udp 32
29.528683 31.13.217.38.38781 -> 185.228.168.10.53: udp 32
29.542837 10.10.1.3.43570 -> 185.228.168.10.53: udp 39
29.542860 31.13.217.38.43570 -> 185.228.168.10.53: udp 39
29.542921 10.10.1.3.44487 -> 185.228.168.10.53: udp 39
29.542942 31.13.217.38.44487 -> 185.228.168.10.53: udp 39
29.738971 10.10.1.3.45131 -> 185.228.168.10.53: udp 35
29.739013 31.13.217.38.45131 -> 185.228.168.10.53: udp 35
29.809061 10.10.1.3.50977 -> 185.228.168.10.53: udp 47
29.809100 31.13.217.38.50977 -> 185.228.168.10.53: udp 47
30.232157 10.10.1.3.42652 -> 185.228.168.10.53: udp 34
30.232180 31.13.217.38.42652 -> 185.228.168.10.53: udp 34
30.233100 10.10.1.3.47230 -> 185.228.168.10.53: udp 34
30.233120 31.13.217.38.47230 -> 185.228.168.10.53: udp 34
30.675332 10.10.1.3.55256 -> 185.228.168.10.53: udp 38
30.675354 31.13.217.38.55256 -> 185.228.168.10.53: udp 38
31.270807 10.10.1.3.42652 -> 185.228.168.10.53: udp 34
31.270836 31.13.217.38.42652 -> 185.228.168.10.53: udp 34
31.271727 10.10.1.3.47230 -> 185.228.168.10.53: udp 34
31.271758 31.13.217.38.47230 -> 185.228.168.10.53: udp 34
31.509709 10.10.1.3.32882 -> 185.228.168.10.53: udp 37
31.509728 31.13.217.38.32882 -> 185.228.168.10.53: udp 37
31.637093 10.10.1.3.43570 -> 185.228.168.10.53: udp 39
31.637112 31.13.217.38.43570 -> 185.228.168.10.53: udp 39
31.637150 10.10.1.3.44487 -> 185.228.168.10.53: udp 39
31.637170 31.13.217.38.44487 -> 185.228.168.10.53: udp 39
31.808803 10.10.1.3.49598 -> 185.228.168.10.53: udp 34
31.808891 31.13.217.38.49598 -> 185.228.168.10.53: udp 34
31.864490 10.10.1.3.56209 -> 185.228.168.10.53: udp 41
31.864532 31.13.217.38.56209 -> 185.228.168.10.53: udp 41
31.864568 10.10.1.3.54384 -> 185.228.168.10.53: udp 41
31.864609 31.13.217.38.54384 -> 185.228.168.10.53: udp 41
31.869819 10.10.1.3.37743 -> 185.228.168.10.53: udp 39
31.869855 31.13.217.38.37743 -> 185.228.168.10.53: udp 39
31.869908 10.10.1.3.54521 -> 185.228.168.10.53: udp 39
31.869942 31.13.217.38.54521 -> 185.228.168.10.53: udp 39
32.227484 10.10.1.3.44634 -> 185.228.168.10.53: udp 39
32.227535 31.13.217.38.44634 -> 185.228.168.10.53: udp 39
32.227558 10.10.1.3.53792 -> 185.228.168.10.53: udp 39
32.227593 31.13.217.38.53792 -> 185.228.168.10.53: udp 39
32.683289 10.10.1.3.43570 -> 185.228.168.10.53: udp 39
32.683310 31.13.217.38.43570 -> 185.228.168.10.53: udp 39
32.692780 10.10.1.3.44487 -> 185.228.168.10.53: udp 39
32.692799 31.13.217.38.44487 -> 185.228.168.10.53: udp 39
32.987440 10.10.1.3.42652 -> 185.228.168.10.53: udp 34
32.987463 31.13.217.38.42652 -> 185.228.168.10.53: udp 34
32.987517 10.10.1.3.52091 -> 185.228.168.10.53: udp 47
32.987539 31.13.217.38.52091 -> 185.228.168.10.53: udp 47
32.987566 10.10.1.3.45083 -> 185.228.168.10.53: udp 33
32.987584 31.13.217.38.45083 -> 185.228.168.10.53: udp 33
32.987625 10.10.1.3.49940 -> 185.228.168.10.53: udp 33
32.987645 31.13.217.38.49940 -> 185.228.168.10.53: udp 33
32.987690 10.10.1.3.58575 -> 185.228.168.10.53: udp 33
32.987708 31.13.217.38.58575 -> 185.228.168.10.53: udp 33
32.987755 10.10.1.3.47230 -> 185.228.168.10.53: udp 34
32.987773 31.13.217.38.47230 -> 185.228.168.10.53: udp 34
32.987851 10.10.1.3.59000 -> 185.228.168.10.53: udp 27
32.987868 31.13.217.38.59000 -> 185.228.168.10.53: udp 27
32.987905 10.10.1.3.41997 -> 185.228.168.10.53: udp 32
32.987923 31.13.217.38.41997 -> 185.228.168.10.53: udp 32
32.988053 10.10.1.3.36279 -> 185.228.168.10.53: udp 31
32.988100 31.13.217.38.36279 -> 185.228.168.10.53: udp 31
32.988100 10.10.1.3.34957 -> 185.228.168.10.53: udp 34
32.988116 31.13.217.38.34957 -> 185.228.168.10.53: udp 34
32.988159 10.10.1.3.55234 -> 185.228.168.10.53: udp 34
32.988181 31.13.217.38.55234 -> 185.228.168.10.53: udp 34
33.098590 10.10.1.3.44022 -> 185.228.168.10.53: udp 35
33.098629 31.13.217.38.44022 -> 185.228.168.10.53: udp 35
33.098662 10.10.1.3.58359 -> 185.228.168.10.53: udp 35
33.098700 31.13.217.38.58359 -> 185.228.168.10.53: udp 35
33.111974 10.10.1.3.33351 -> 185.228.168.10.53: udp 47
33.112014 31.13.217.38.33351 -> 185.228.168.10.53: udp 47
33.112034 10.10.1.3.42913 -> 185.228.168.10.53: udp 47
33.112068 31.13.217.38.42913 -> 185.228.168.10.53: udp 47
33.348189 10.10.1.3.47230 -> 185.228.168.10.53: udp 34
33.348208 31.13.217.38.47230 -> 185.228.168.10.53: udp 34
33.348254 10.10.1.3.42652 -> 185.228.168.10.53: udp 34
33.348274 31.13.217.38.42652 -> 185.228.168.10.53: udp 34
33.432605 10.10.1.3.40757 -> 185.228.168.10.53: udp 33
33.432646 31.13.217.38.40757 -> 185.228.168.10.53: udp 33
33.725140 10.10.1.3.52901 -> 185.228.168.10.53: udp 38
33.725193 31.13.217.38.52901 -> 185.228.168.10.53: udp 38
33.794067 10.10.1.3.49598 -> 185.228.168.10.53: udp 34
33.794090 31.13.217.38.49598 -> 185.228.168.10.53: udp 34
33.836419 10.10.1.3.46651 -> 185.228.168.10.53: udp 34
33.836465 31.13.217.38.46651 -> 185.228.168.10.53: udp 34
33.836492 10.10.1.3.39568 -> 185.228.168.10.53: udp 34
33.836533 31.13.217.38.39568 -> 185.228.168.10.53: udp 34
33.838971 10.10.1.3.56209 -> 185.228.168.10.53: udp 41
33.838990 31.13.217.38.56209 -> 185.228.168.10.53: udp 41
33.840199 10.10.1.3.37743 -> 185.228.168.10.53: udp 39
33.840217 31.13.217.38.37743 -> 185.228.168.10.53: udp 39
34.024271 10.10.1.3.47230 -> 185.228.168.10.53: udp 34
34.024313 31.13.217.38.47230 -> 185.228.168.10.53: udp 34
34.026940 10.10.1.3.34957 -> 185.228.168.10.53: udp 34
34.026964 31.13.217.38.34957 -> 185.228.168.10.53: udp 34
34.026992 10.10.1.3.55234 -> 185.228.168.10.53: udp 34
34.027014 31.13.217.38.55234 -> 185.228.168.10.53: udp 34
34.027034 10.10.1.3.42652 -> 185.228.168.10.53: udp 34
34.027057 31.13.217.38.42652 -> 185.228.168.10.53: udp 34
34.027082 10.10.1.3.52091 -> 185.228.168.10.53: udp 47
34.027100 31.13.217.38.52091 -> 185.228.168.10.53: udp 47
34.027119 10.10.1.3.59000 -> 185.228.168.10.53: udp 27
34.027139 31.13.217.38.59000 -> 185.228.168.10.53: udp 27
34.027164 10.10.1.3.41997 -> 185.228.168.10.53: udp 32
34.027181 31.13.217.38.41997 -> 185.228.168.10.53: udp 32
34.027244 10.10.1.3.60028 -> 185.228.168.10.53: udp 33
34.027288 10.10.1.3.36279 -> 185.228.168.10.53: udp 31
34.027305 31.13.217.38.36279 -> 185.228.168.10.53: udp 31
34.027321 31.13.217.38.60028 -> 185.228.168.10.53: udp 33
34.027335 10.10.1.3.49940 -> 185.228.168.10.53: udp 33
34.027352 31.13.217.38.49940 -> 185.228.168.10.53: udp 33
34.027394 10.10.1.3.49142 -> 185.228.168.10.53: udp 33
34.027433 31.13.217.38.49142 -> 185.228.168.10.53: udp 33
34.468727 10.10.1.3.40757 -> 185.228.168.10.53: udp 33
34.468758 31.13.217.38.40757 -> 185.228.168.10.53: udp 33
34.511885 31.13.217.38.1109 -> 212.73.140.66.53: udp 32
34.545368 212.73.140.66.53 -> 31.13.217.38.1109: udp 80
34.732570 10.10.1.3.43570 -> 185.228.168.10.53: udp 39
34.732589 31.13.217.38.43570 -> 185.228.168.10.53: udp 39
34.733815 10.10.1.3.44487 -> 185.228.168.10.53: udp 39
34.733835 31.13.217.38.44487 -> 185.228.168.10.53: udp 39
34.768642 10.10.1.3.52901 -> 185.228.168.10.53: udp 38
34.768661 31.13.217.38.52901 -> 185.228.168.10.53: udp 38
34.814267 10.10.1.3.57676 -> 185.228.168.10.53: udp 31
34.814342 10.10.1.3.40492 -> 185.228.168.10.53: udp 31
34.814363 31.13.217.38.57676 -> 185.228.168.10.53: udp 31
34.814383 31.13.217.38.40492 -> 185.228.168.10.53: udp 31
34.820220 10.10.1.3.47927 -> 185.228.168.10.53: udp 32
34.820258 31.13.217.38.47927 -> 185.228.168.10.53: udp 32
34.820289 10.10.1.3.51396 -> 185.228.168.10.53: udp 32
34.820325 31.13.217.38.51396 -> 185.228.168.10.53: udp 32
34.836670 10.10.1.3.49598 -> 185.228.168.10.53: udp 34
34.836690 31.13.217.38.49598 -> 185.228.168.10.53: udp 34
34.882990 10.10.1.3.37743 -> 185.228.168.10.53: udp 39
34.883011 31.13.217.38.37743 -> 185.228.168.10.53: udp 39
34.883038 10.10.1.3.56209 -> 185.228.168.10.53: udp 41
34.883055 31.13.217.38.56209 -> 185.228.168.10.53: udp 41
35.082017 10.10.1.3.44022 -> 185.228.168.10.53: udp 35
35.082041 31.13.217.38.44022 -> 185.228.168.10.53: udp 35
35.098291 10.10.1.3.59859 -> 185.228.168.10.53: udp 33
35.098364 31.13.217.38.59859 -> 185.228.168.10.53: udp 33
35.099993 10.10.1.3.33351 -> 185.228.168.10.53: udp 47
35.100013 31.13.217.38.33351 -> 185.228.168.10.53: udp 47
35.101323 10.10.1.3.40664 -> 185.228.168.10.53: udp 32
35.101362 31.13.217.38.40664 -> 185.228.168.10.53: udp 32
35.101388 10.10.1.3.42829 -> 185.228.168.10.53: udp 32
35.101431 31.13.217.38.42829 -> 185.228.168.10.53: udp 32
35.207502 10.10.1.3.53792 -> 185.228.168.10.53: udp 39
35.207524 31.13.217.38.53792 -> 185.228.168.10.53: udp 39
35.208616 10.10.1.3.44634 -> 185.228.168.10.53: udp 39
35.208634 31.13.217.38.44634 -> 185.228.168.10.53: udp 39
35.762221 10.10.1.3.60028 -> 185.228.168.10.53: udp 33
35.762241 31.13.217.38.60028 -> 185.228.168.10.53: udp 33
35.813685 10.10.1.3.49052 -> 185.228.168.10.53: udp 46
35.813740 31.13.217.38.49052 -> 185.228.168.10.53: udp 46
35.815285 10.10.1.3.57478 -> 185.228.168.10.53: udp 43
35.815320 31.13.217.38.57478 -> 185.228.168.10.53: udp 43
35.815354 10.10.1.3.40907 -> 185.228.168.10.53: udp 43
35.815393 31.13.217.38.40907 -> 185.228.168.10.53: udp 43
35.815416 10.10.1.3.39722 -> 185.228.168.10.53: udp 39
35.815453 31.13.217.38.39722 -> 185.228.168.10.53: udp 39
35.815483 10.10.1.3.56282 -> 185.228.168.10.53: udp 36
35.815504 31.13.217.38.56282 -> 185.228.168.10.53: udp 36
35.815547 10.10.1.3.42470 -> 185.228.168.10.53: udp 43
35.815586 31.13.217.38.42470 -> 185.228.168.10.53: udp 43
35.815604 10.10.1.3.49103 -> 185.228.168.10.53: udp 39
35.815644 31.13.217.38.49103 -> 185.228.168.10.53: udp 39
35.815665 10.10.1.3.58154 -> 185.228.168.10.53: udp 53
35.815699 31.13.217.38.58154 -> 185.228.168.10.53: udp 53
35.815727 10.10.1.3.52935 -> 185.228.168.10.53: udp 51
35.815762 31.13.217.38.52935 -> 185.228.168.10.53: udp 51
35.824170 10.10.1.3.39568 -> 185.228.168.10.53: udp 34
35.824189 31.13.217.38.39568 -> 185.228.168.10.53: udp 34
36.111828 10.10.1.3.57692 -> 185.228.168.10.53: udp 34
36.111855 10.10.1.3.34045 -> 185.228.168.10.53: udp 34
36.111935 31.13.217.38.57692 -> 185.228.168.10.53: udp 34
36.111936 31.13.217.38.34045 -> 185.228.168.10.53: udp 34
36.111943 10.10.1.3.39191 -> 185.228.168.10.53: udp 34
36.111977 31.13.217.38.39191 -> 185.228.168.10.53: udp 34
36.114088 10.10.1.3.42382 -> 185.228.168.10.53: udp 39
36.114123 31.13.217.38.42382 -> 185.228.168.10.53: udp 39
36.114162 10.10.1.3.54968 -> 185.228.168.10.53: udp 34
36.114205 31.13.217.38.54968 -> 185.228.168.10.53: udp 34
36.114226 10.10.1.3.36801 -> 185.228.168.10.53: udp 39
36.114261 31.13.217.38.36801 -> 185.228.168.10.53: udp 39
36.114295 10.10.1.3.58775 -> 185.228.168.10.53: udp 47

[jmny]

https://drive.google.com/file/d/15jfUepBzQzP2Aj1Yds7tP8RCCSLTnS2h/view?usp=sharing

https://drive.google.com/file/d/1nPNw4AMSY98muj9jjZFTzgdVqkovDKPt/view?usp=sharing

https://drive.google.com/file/d/1plWFu1FPSkfN9RuxQC9KPxDekKvVwaEA/view?usp=sharing

https://drive.google.com/file/d/133dBuCARF65h-f7cpUGH4sKIACvcvTzK/view?usp=sharing

https://drive.google.com/file/d/1SMElNLWVEHwmmE0zp5qPbOD8P97LIW40/view?usp=sharing