[Collisions] Datasets to use for older years

[Wessels, Duane]

You should be able to find CLEAN data for every year, if you prefer that.
FYI the clean data differs from the raw data in the following ways:

   - files begin and end on consistent time boundaries.
   - pcap files have the same datalink type.
   - Any non-root traffic is removed.

If you prefer to work with the RAW data make sure you pay attention to the
server's IP address during the analysis.  In some cases non-root-trafic
has been known to "leak" into the DITL data.  Also there were times where
J-root data was uploaded as A-root, and perhaps vice-versa.

DW


On Sep 26, 2013, at 11:30 AM, Kevin White <kwhite at jasadvisors.com> wrote:

> I’m doing some work that may involve going back in time farther than we did originally.  So, I’m trying to make a map of which files to use from the start.  Here is what I have:
>  
> my %years = (
>     '2013' => '/mnt/oarc-pool2/DITL-20130528/RAW',
>     '2012' => '/mnt/oarc-pool4/DITL-20120417/RAW',
>     '2011' => '/mnt/oarc-pool4/DITL-20110412/RAW',
>     '2010' => '/mnt/oarc-pool4/DITL-20100413/RAW',
>     '2009' => '/mnt/oarc-pool4/DITL-200903/CLEAN-ROOTS',
>     '2008' => '/mnt/oarc-pool4/DITL-200803/CLEAN',
>     '2007' => '/mnt/oarc-pool3/DITL-200701/CLEAN',
>     '2006' => '/mnt/oarc-pool3/DITL-200601/CLEAN',
>     );
>  
> The first 4 are good: each of those has, in the “RAW” folder, folders for each root that participated, as well as folders for other participants.
>  
> The final 4 seem to have the RAW files grouped by organization.  I had to move into the folders listed there to actually find folders grouped by root.
>  
> Is that right?  Is it safe to use those CLEAN (and CLEAN-ROOTS) folders to get the same kinds of data we used for 2013 and 2012, queries just to the roots?
>  
> Thanks,
>  
> Kevin
>  
> _______________________________________________
> Collisions mailing list
> Collisions at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/collisions