Nick Danger wrote: > the average connections in a 1 minute period are about 25,000 (tcpdump > -i eth0 | wc -l) > maybe you should try (tcpdump -i eth0 port 53 | wc -l) it will filter out all the "noise" to just include DNS requests.