[Collisions] Collision data output

Kevin White kwhite at jasadvisors.com
Mon Nov 4 20:27:32 UTC 2013

The web page referred to below:


describes what is being made available here.

Basically, this is a "next step" run to the data runs that Roy put together
for the initial Collisions research.  I started with his code and added some
new fields to the output (full source/destination IP and port, protocol,
source file, query string length).  I have classified the "root" that the
data belongs to based on the destination IP address, not the PCAP file
source. I have filtered out rows that weren't headed to known root IP
addresses.  I added some more logic and a "character encoding" process to
properly display all possible octets in the query string.

The hope is that this data set will be useful for anyone who wishes to do
research on the data.  As such, it was decided to store it in the oarc-pool
storage space, so that it would be available for everyone.

The results of all eight years are available.  The file format is described
in the web page.  The code used to generate the files is available in a
GitHub repository, also described in the web page.

Kevin White
JAS Global Advisors

-----Original Message-----
From: collisions-bounces at lists.dns-oarc.net
[mailto:collisions-bounces at lists.dns-oarc.net] On Behalf Of William F
Sent: Monday, November 04, 2013 12:05 PM
To: collisions at lists.dns-oarc.net
Subject: [Collisions] Collision data output

 	Subject to Kevin's verification, this collection described here:


Is now available on a central file repository.  The mount and path via the
an*.dns-oarc.net machines is:


Happy hunting!

Collisions mailing list
Collisions at lists.dns-oarc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4869 bytes
Desc: not available
URL: <http://lists.dns-oarc.net/pipermail/collisions/attachments/20131104/b9680ef1/attachment.bin>

More information about the Collisions mailing list