[dns-operations] ip id from servers

Randy Bush randy at psg.com
Thu Mar 11 02:28:41 UTC 2010

>> we are running a measurement experiment which involves a port tap on a
>> fiber to one of our routers.  on that tap, we are seeing what we believe
>> to be unusual behavior from some packet sources (see below).  what we
>> think we are seeing are a significant number of duplicates of the tuple
>> (source ip, ip id).  
> And if you throw in the destination ip do you still have lots of duplicates?

(source + ip id) should be unique.  we're not trying to reassemble (at
this point).  we're just trying to make sure our tap is good.


More information about the dns-operations mailing list