The referral, including a referral to root can be quite large. Even larger than answering a normal query. I have broken the data out for the purpose of letting people identify the IPs that provide that. Jared Mauch On Apr 8, 2013, at 3:08 AM, Tom Laermans <tom.laermans at phyxia.net> wrote: > As far as I know, responding either NOERROR or REFUSED produces packets of the same size.