[Collisions] Weird dest IP addr
jschmidt at jasadvisors.com
Mon Oct 7 16:45:13 UTC 2013
Also, Jim, I believe you started with the "raw" dataset as well - would
you be willing to share the scripts/procedures you used to "clean" it?
From: Kevin White <kwhite at jasadvisors.com>
Date: Monday, October 7, 2013 11:11 AM
To: Jim Reid <jim at rfc1035.com>
Cc: "'collisions at lists.dns-oarc.net'" <collisions at lists.dns-oarc.net>
Subject: Re: [Collisions] Weird dest IP addr
>The problem is, there is "bad" data in these captures. One of the roots
>particular seems to leak a whole bunch of stuff in.
>At some point, the RAW was turned into CLEAN, following a procedure
>like this. I'm just trying to duplicate that with a code base that can be
>shared with anyone who cares.
>If anyone has any tips/suggestions, I'm all ears.
>From: Jim Reid [mailto:jim at rfc1035.com]
>Sent: Monday, October 07, 2013 12:07 PM
>To: Kevin White
>Cc: Warren Kumari; 'collisions at lists.dns-oarc.net'
>Subject: Re: [Collisions] Weird dest IP addr
>On 7 Oct 2013, at 16:49, Kevin White <kwhite at jasadvisors.com> wrote:
>> I should have an a-root entry too?
>Probably. But it would be for j-root since that's what used to occupy
>Hopefully someone at IANA can give you chapter and verse on which IP
>addresses have been used by which root servers since DNS was first
>And when these changed.
>I'd be wary of strict checking of destination addresses or coupling these
>specific root servers. It's possible the pcaps have traffic which goes to
>the "real" IP address of an anycast instance, say for monitoring/alerting
>purposes. [ie Is the box at anycast location foo working OK?] Those
>addresses may well be information that an RSO is less than keen to share.
>And they may also change from time to time too. :-)
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 4376 bytes
Desc: not available
More information about the Collisions