Bug in WMI namespace for MicrosoftDNS Statistics class?

I'm trying to query DNS statistics from Windows Server 2012 via WMI.

If I run the following command in Powershell:

Get-WmiObject -Namespace root\MicrosoftDNS -Class MicrosoftDNS_Statistic | ?{ $_.Name.Contains("UDP messages allocated") } | ft Name,Value

I get the following:

Name                           Value
----                           -----
UDP messages allocated         20550
UDP messages allocated         2596235

Two statistics with the same name? And totally different values? What? So I start investigating the underlying class and I see that the class actually has:

uint32 UdpAlloc;
uint32 TcpAlloc;

Which seems obvious, and the two values above are most likely those two. But - which one is which?

It would seem like an obvious assumption that the larger number is UDP and the smaller number is TCP. But this is further complicated by the fact that there are several duplicated stats, not just this one, and some of them have lowish values that could be either TCP or UDP.

Has anyone else seen this before and worked around it?

Solution 1:

Not a great answer to this, but the behaviour I was seeing was consistent between all versions of Windows Server that had this counter, including 2016.

In the end I just consolidated the duplicate counters (I found a lot more during the course of this project) into a single counter and decided not to worry if they were TCP or UDP requests/responses.