Dave Crooke wrote:
> The fact that the delays are clustered at (3 + 0.2 n) seconds, rather
> than a distributed range, strongly indicates a timeout and not
> (directly) a resource issue.
>
> 3 seconds is too fast for a timeout on almost any DNS operation, unless
> it has been modified, so I'd suspect it's the TCP layer, e.g. perhaps
> the SYN packet goes awol and it has to retry.
>
> I'd second the vote for investigation with a packet sniffing tool
> (Wireshark, tcpdump, etc)
If you have a PC (Windows), pingplotter is a remarkable and simple tool to use that quickly identifies problems, and
givesresults that are convincing when you show them to your network admin. Wireshark and tcpdump have a pretty steep
learningcurve and are overkill if your problem is simple.
Craig
