Seeing each of these oversized packets receive counters slowly increment and wonder if it's causing problems for customer DNS queries.

Wondering how concerned we should be about this output on our CGNAT router:

> show services alg statistics application-protocol dns

Interface name: vms-4/0/0

DNS ALG statistics:

Invalid packets received : 0

Reply packets received : 92339563

Oversized packets received : 93355

Interface name: vms-4/1/0

DNS ALG statistics:

Invalid packets received : 0

Reply packets received : 100060678

Oversized packets received : 169451

Interface name: vms-5/0/0

DNS ALG statistics:

Invalid packets received : 0

Reply packets received : 224873645

Oversized packets received : 451691

Interface name: vms-5/1/0

DNS ALG statistics:

Invalid packets received : 0

Reply packets received : 223835290

Oversized packets received : 51117

DNS packets > 512 bytes (by default) are flagged using that counter...it is NOT a DROP counter. They are accounted for, and they do not get dropped.

It is a configurable value using the command below:

lab@mx480-re0# set security alg dns maximum-message-length ?

Possible completions:

<maximum-message-length> Set maximum message length (512..8192 bytes)

There is no need to be concerned.