[dns-operations] ip id from servers

[Randy Bush]

> Those are pretty busy servers - and with a 16-bit ID, it only takes
> about about 300 occurrences before a duplication is more likely than
> not (The Birthday problem/ binomial distribution). Does that line up
> with the volume?

not really, but i could be wrong.

> Are these also the busiest sources?

not really, pretty certainly not the magnitude of the dupes.  but i
could be wrong.

take packet rate from source, use fragging fudge of say 2x, throw in
another 2x because the moon is in klutz, and these still stick out.
but i could be wrong.

we're doing a bit more counting.

randy