[Collisions] Datasets to use for older years

Kevin White kwhite at jasadvisors.com
Fri Sep 27 17:46:05 UTC 2013


Do you have the scripts/process that was used to turn RAW into CLEAN?

Thank you,

Kevin White


-----Original Message-----
From: collisions-bounces at lists.dns-oarc.net
[mailto:collisions-bounces at lists.dns-oarc.net] On Behalf Of Wessels, Duane
Sent: Thursday, September 26, 2013 3:02 PM
To: collisions at lists.dns-oarc.net
Subject: Re: [Collisions] Datasets to use for older years

You should be able to find CLEAN data for every year, if you prefer that.
FYI the clean data differs from the raw data in the following ways:

   - files begin and end on consistent time boundaries.
   - pcap files have the same datalink type.
   - Any non-root traffic is removed.

If you prefer to work with the RAW data make sure you pay attention to the
server's IP address during the analysis.  In some cases non-root-trafic has
been known to "leak" into the DITL data.  Also there were times where J-root
data was uploaded as A-root, and perhaps vice-versa.

DW


On Sep 26, 2013, at 11:30 AM, Kevin White <kwhite at jasadvisors.com> wrote:

> I'm doing some work that may involve going back in time farther than we
did originally.  So, I'm trying to make a map of which files to use from the
start.  Here is what I have:
>  
> my %years = (
>     '2013' => '/mnt/oarc-pool2/DITL-20130528/RAW',
>     '2012' => '/mnt/oarc-pool4/DITL-20120417/RAW',
>     '2011' => '/mnt/oarc-pool4/DITL-20110412/RAW',
>     '2010' => '/mnt/oarc-pool4/DITL-20100413/RAW',
>     '2009' => '/mnt/oarc-pool4/DITL-200903/CLEAN-ROOTS',
>     '2008' => '/mnt/oarc-pool4/DITL-200803/CLEAN',
>     '2007' => '/mnt/oarc-pool3/DITL-200701/CLEAN',
>     '2006' => '/mnt/oarc-pool3/DITL-200601/CLEAN',
>     );
>  
> The first 4 are good: each of those has, in the "RAW" folder, folders for
each root that participated, as well as folders for other participants.
>  
> The final 4 seem to have the RAW files grouped by organization.  I had to
move into the folders listed there to actually find folders grouped by root.
>  
> Is that right?  Is it safe to use those CLEAN (and CLEAN-ROOTS) folders to
get the same kinds of data we used for 2013 and 2012, queries just to the
roots?
>  
> Thanks,
>  
> Kevin
>  
> _______________________________________________
> Collisions mailing list
> Collisions at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/collisions

_______________________________________________
Collisions mailing list
Collisions at lists.dns-oarc.net
https://lists.dns-oarc.net/mailman/listinfo/collisions
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4869 bytes
Desc: not available
URL: <http://lists.dns-oarc.net/pipermail/collisions/attachments/20130927/553779d5/attachment.bin>


More information about the Collisions mailing list