[Collisions] Datasets to use for older years
dwessels at verisign.com
Thu Sep 26 19:02:00 UTC 2013
You should be able to find CLEAN data for every year, if you prefer that.
FYI the clean data differs from the raw data in the following ways:
- files begin and end on consistent time boundaries.
- pcap files have the same datalink type.
- Any non-root traffic is removed.
If you prefer to work with the RAW data make sure you pay attention to the
server's IP address during the analysis. In some cases non-root-trafic
has been known to "leak" into the DITL data. Also there were times where
J-root data was uploaded as A-root, and perhaps vice-versa.
On Sep 26, 2013, at 11:30 AM, Kevin White <kwhite at jasadvisors.com> wrote:
> I’m doing some work that may involve going back in time farther than we did originally. So, I’m trying to make a map of which files to use from the start. Here is what I have:
> my %years = (
> '2013' => '/mnt/oarc-pool2/DITL-20130528/RAW',
> '2012' => '/mnt/oarc-pool4/DITL-20120417/RAW',
> '2011' => '/mnt/oarc-pool4/DITL-20110412/RAW',
> '2010' => '/mnt/oarc-pool4/DITL-20100413/RAW',
> '2009' => '/mnt/oarc-pool4/DITL-200903/CLEAN-ROOTS',
> '2008' => '/mnt/oarc-pool4/DITL-200803/CLEAN',
> '2007' => '/mnt/oarc-pool3/DITL-200701/CLEAN',
> '2006' => '/mnt/oarc-pool3/DITL-200601/CLEAN',
> The first 4 are good: each of those has, in the “RAW” folder, folders for each root that participated, as well as folders for other participants.
> The final 4 seem to have the RAW files grouped by organization. I had to move into the folders listed there to actually find folders grouped by root.
> Is that right? Is it safe to use those CLEAN (and CLEAN-ROOTS) folders to get the same kinds of data we used for 2013 and 2012, queries just to the roots?
> Collisions mailing list
> Collisions at lists.dns-oarc.net
More information about the Collisions