[Collisions] Weird dest IP addr

Wessels, Duane dwessels at verisign.com
Mon Oct 7 16:26:38 UTC 2013


your message reminded me that you asked about my script before and I failed
to respond then.  I'm attaching here the script that I used to create
the CLEAN dataset.


On Oct 7, 2013, at 9:11 AM, Kevin White <kwhite at jasadvisors.com> wrote:

> The problem is, there is "bad" data in these captures.  One of the roots in
> particular seems to leak a whole bunch of stuff in.
> At some point, the RAW was turned into CLEAN, following a procedure somewhat
> like this.  I'm just trying to duplicate that with a code base that can be
> shared with anyone who cares.
> If anyone has any tips/suggestions, I'm all ears.
> Thanks,
> Kevin
> -----Original Message-----
> From: Jim Reid [mailto:jim at rfc1035.com]
> Sent: Monday, October 07, 2013 12:07 PM
> To: Kevin White
> Cc: Warren Kumari; 'collisions at lists.dns-oarc.net'
> Subject: Re: [Collisions] Weird dest IP addr
> On 7 Oct 2013, at 16:49, Kevin White <kwhite at jasadvisors.com> wrote:
>> I should have an a-root entry too?
> Probably. But it would be for j-root since that's what used to occupy
> Hopefully someone at IANA can give you chapter and verse on which IP
> addresses have been used by which root servers since DNS was first deployed.
> And when these changed.
> I'd be wary of strict checking of destination addresses or coupling these to
> specific root servers. It's possible the pcaps have traffic which goes to
> the "real" IP address of an anycast instance, say for monitoring/alerting
> purposes. [ie Is the box at anycast location foo working OK?] Those
> addresses may well be information that an RSO is less than keen to share.
> And they may also change from time to time too. :-)
> _______________________________________________
> Collisions mailing list
> Collisions at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/collisions

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.dns-oarc.net/pipermail/collisions/attachments/20131007/e2c68a69/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: clean.sh
Type: application/octet-stream
Size: 2909 bytes
Desc: clean.sh
URL: <http://lists.dns-oarc.net/pipermail/collisions/attachments/20131007/e2c68a69/attachment.obj>

More information about the Collisions mailing list