[dns-operations] OpenResolver Statistics Updated
Jared Mauch
jared at puck.nether.net
Mon Sep 16 16:26:36 UTC 2013
I've reprocessed some data on the OpenResovlerProject and wanted to share some results.
1) I stopped filtering on if the #answers was >0 on the query to determine the "alternate ip" in the data.
This filter was originally in-place because I thought DNS implementations were "sane/good". They are not ;)
OLD RESULTS:
data_date | alternate
------------+-----------
2013-03-24 | 654122
2013-03-31 | 655030
2013-04-07 | 731040
2013-04-14 | 914175
2013-04-21 | 812921
2013-04-28 | 795565
2013-05-05 | 1188210
2013-05-12 | 811517
2013-05-19 | 781274
2013-05-26 | 778730
2013-06-02 | 797657
2013-06-09 | 890517
2013-06-16 | 776594
2013-06-23 | 804478
2013-06-30 | 798410
2013-07-07 | 808724
2013-07-14 | 819078
2013-07-21 | 919887
2013-07-28 | 908050
2013-08-04 | 988527
2013-08-11 | 835917
2013-08-18 | 823313
2013-08-25 | 785411
2013-09-01 | 920041
2013-09-08 | 833074
2013-09-15 | 1026649
(26 rows)
New Results:
data_date | alternate
------------+-----------
2013-03-24 | 787771
2013-03-31 | 792139
2013-04-07 | 862110
2013-04-14 | 1055201
2013-04-21 | 960058
2013-04-28 | 967275
2013-05-05 | 1345394
2013-05-12 | 996038
2013-05-19 | 959157
2013-05-26 | 970176
2013-06-02 | 1000718
2013-06-09 | 1111776
2013-06-16 | 980098
2013-06-23 | 1006528
2013-06-30 | 1012998
2013-07-07 | 1020873
2013-07-14 | 1044292
2013-07-21 | 1161634
2013-07-28 | 1136955
2013-08-04 | 1224921
2013-08-11 | 1085401
2013-08-18 | 1094469
2013-08-25 | 1035215
2013-09-01 | 1159322
2013-09-08 | 1116035
2013-09-15 | 1026649
(26 rows)
2) I also reprocessed looking for TC=1 in responses and found interesting clusters of IP ranges that always respond with TC=1 but never provide UDP. Some others just force TCP for everything.
3) I started collecting the TTL responses to packets this past week. Not sure who else is collecting this type of data, but any ideas of graphs, etc.. you want related to this, let me know. I could create a weekly graph showing the distriubtion of all responses.
- Jared
More information about the dns-operations
mailing list