The DNS requests take milliseconds and are repeated again a few seconds later (depending on the TTL setting). I can indeed view network requests and source apps both from ProcEx as well as open network connections from the Resource Monitor, but this does not solve the problem. You should be able to see a legible version here - Opens a new window Did not realize the resolution would get permanently changed, and assumed clicking on it would show full size. Now to figure out why a single host is generating so many DNS requests. Maybe this can be overridden? Of course there are negative consequences with too long a local cache when online services are built on the fact that you obtain new IP addresses often for load balancing purposes but it might be a temporary stop-gap measure to bring relief to the router. Cache seems to be working as expected and I think a lot of obtained records have very low TTLs that are honoured by Windows DNS server as expected and cause the same types of queries to repeat. We looked at DNS cache for a bit as well. By way of forwarders and/or root hints those end up on the Internet and as they pass through his LAN router, it brings the router to its knees after a while.

This combined with other hosts on his network are generating a sum total of over 1,000 requests a minute to his DNS servers when we took a sample a few days ago. The primary workstation he's looking at is generation DNS requests at a rate of about 320 requests per minute or 5 per second, without a break. Looks like the purpose of this new discussion is more along the lines of how to troubleshoot a single workstation and why it was so 'chatty'. That part is figured out in this discussion here: We've covered how to get debug logs, how to analyze them, get reports, etc. We had a lengthy discussion a few days ago with the OP regarding DNS debugging. Speaking on behalf of the OP as responses now start to go back full circle to a discussion from the other day.

Tcpview windows 10