[Collisions] Weird dest IP addr

[Wessels, Duane]

Kevin,

your message reminded me that you asked about my script before and I failed
to respond then.  I'm attaching here the script that I used to create
the CLEAN dataset.

DW



On Oct 7, 2013, at 9:11 AM, Kevin White <kwhite at jasadvisors.com> wrote:

> The problem is, there is "bad" data in these captures.  One of the roots in
> particular seems to leak a whole bunch of stuff in.
>
> At some point, the RAW was turned into CLEAN, following a procedure somewhat
> like this.  I'm just trying to duplicate that with a code base that can be
> shared with anyone who cares.
>
> If anyone has any tips/suggestions, I'm all ears.
>
> Thanks,
>
> Kevin
>
> -----Original Message-----
> From: Jim Reid [mailto:jim at rfc1035.com]
> Sent: Monday, October 07, 2013 12:07 PM
> To: Kevin White
> Cc: Warren Kumari; 'collisions at lists.dns-oarc.net'
> Subject: Re: [Collisions] Weird dest IP addr
>
> On 7 Oct 2013, at 16:49, Kevin White <kwhite at jasadvisors.com> wrote:
>
>> I should have an a-root entry too?
>
> Probably. But it would be for j-root since that's what used to occupy
> 198.41.0.10.
>
> Hopefully someone at IANA can give you chapter and verse on which IP
> addresses have been used by which root servers since DNS was first deployed.
> And when these changed.
>
> I'd be wary of strict checking of destination addresses or coupling these to
> specific root servers. It's possible the pcaps have traffic which goes to
> the "real" IP address of an anycast instance, say for monitoring/alerting
> purposes. [ie Is the box at anycast location foo working OK?] Those
> addresses may well be information that an RSO is less than keen to share.
> And they may also change from time to time too. :-)
>
> _______________________________________________
> Collisions mailing list
> Collisions at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/collisions

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.dns-oarc.net/pipermail/collisions/attachments/20131007/e2c68a69/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: clean.sh
Type: application/octet-stream
Size: 2909 bytes
Desc: clean.sh
URL: <http://lists.dns-oarc.net/pipermail/collisions/attachments/20131007/e2c68a69/attachment.obj>