[dns-operations] ip id from servers

Mark Andrews marka at isc.org
Thu Mar 11 02:24:31 UTC 2010

In message <m28w9z1uf2.wl%randy at psg.com>, Randy Bush writes:
> we are running a measurement experiment which involves a port tap on a
> fiber to one of our routers.  on that tap, we are seeing what we believe
> to be unusual behavior from some packet sources (see below).  what we
> think we are seeing are a significant number of duplicates of the tuple
> (source ip, ip id).  

And if you throw in the destination ip do you still have lots of duplicates?

<source ip + destination id + ip id> are required for reassembly.

> we think that this would be due to high retransmits, extremely poor ip
> id randomization, a massive number of packets so that ids are recycled,
> an anycast artifact, or cosmic rays.  i note that these are mostly name
> servers.  so i gotta wonder if there is some commonly used software with
> its own stack or something similar.
> any clues appreciated.
> randy
> ---
>	ns-pri.ripe.net.
> 	figwort.arin.net.
> 	g3.nstld.com.
> 	l.gtld-servers.net.
> 	f3.nstld.com.
> 	dill.arin.net.
> 	7c29477b.i-revonet.jp.
> 	felixx.tsn.or.jp.
> 	c.gtld-servers.net.
> 	m.gtld-servers.net.
> 	g.gtld-servers.net.
> 	h.gtld-servers.net.
> 	f.gtld-servers.net.
> 	a.gtld-servers.net.
> 	d.gtld-servers.net.
> 	sec3.apnic.net.
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at isc.org

More information about the dns-operations mailing list