Microsoft Windows Performance Monitor, DNS, and "Unmatched Responses Received"
Posted on 2013-06-27
We've just replaced our aging, self-hosted, BIND DNS, public-facing physical name servers with Windows Server 2012 DNS virtual servers. They're operating quite well.
Using Windows Performance Monitor, we're tracking the "UDP Queries Received/sec" and "UDP Response Sent/sec" which look good, peaking in the 300-400/sec range.
We also took a look a the "Unmatched Responses Received" statistic, currently at 427 after 10 days of uptime. In comparison, this number is negligible compared to the successful response rate, but the interesting thing is that I've been unable to find any information to determine what an "Unmatched Response" is when related to DNS.
My searches to try to explain or define it have only found one or two mentions in passing, in discussions of DNS DDOS attacks, and in logging. Can anyone fully define this for us, and explain what a sudden increase in "Unmatched Responses" might indicate? Any URLs to plain, detailed information are certainly appreciated.