[dns-operations] ip id from servers

[Colm MacCárthaigh]

Those are pretty busy servers - and with a 16-bit ID, it only takes
about about 300 occurrences before a duplication is more likely than
not (The Birthday problem/ binomial distribution). Does that line up
with the volume? Are these also the busiest sources?

On Wed, Mar 10, 2010 at 6:28 PM, Randy Bush <randy at psg.com> wrote:
>>> we are running a measurement experiment which involves a port tap on a
>>> fiber to one of our routers.  on that tap, we are seeing what we believe
>>> to be unusual behavior from some packet sources (see below).  what we
>>> think we are seeing are a significant number of duplicates of the tuple
>>> (source ip, ip id).
>> And if you throw in the destination ip do you still have lots of duplicates?
>
> (source + ip id) should be unique.  we're not trying to reassemble (at
> this point).  we're just trying to make sure our tap is good.
>
> randy
> _______________________________________________
> dns-operations mailing list
> dns-operations at lists.dns-oarc.net
> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
>



-- 
Colm