[dns-operations] OpenResolver Statistics Updated

Jared Mauch jared at puck.nether.net
Mon Sep 16 16:26:36 UTC 2013


I've reprocessed some data on the OpenResovlerProject and wanted to share some results.

1) I stopped filtering on if the #answers was >0 on the query to determine the "alternate ip" in the data.

This filter was originally in-place because I thought DNS implementations were "sane/good".  They are not ;)

OLD RESULTS:

 data_date  | alternate 
------------+-----------
 2013-03-24 |    654122
 2013-03-31 |    655030
 2013-04-07 |    731040
 2013-04-14 |    914175
 2013-04-21 |    812921
 2013-04-28 |    795565
 2013-05-05 |   1188210
 2013-05-12 |    811517
 2013-05-19 |    781274
 2013-05-26 |    778730
 2013-06-02 |    797657
 2013-06-09 |    890517
 2013-06-16 |    776594
 2013-06-23 |    804478
 2013-06-30 |    798410
 2013-07-07 |    808724
 2013-07-14 |    819078
 2013-07-21 |    919887
 2013-07-28 |    908050
 2013-08-04 |    988527
 2013-08-11 |    835917
 2013-08-18 |    823313
 2013-08-25 |    785411
 2013-09-01 |    920041
 2013-09-08 |    833074
 2013-09-15 |   1026649
(26 rows)

New Results:

 data_date  | alternate 
------------+-----------
 2013-03-24 |    787771
 2013-03-31 |    792139
 2013-04-07 |    862110
 2013-04-14 |   1055201
 2013-04-21 |    960058
 2013-04-28 |    967275
 2013-05-05 |   1345394
 2013-05-12 |    996038
 2013-05-19 |    959157
 2013-05-26 |    970176
 2013-06-02 |   1000718
 2013-06-09 |   1111776
 2013-06-16 |    980098
 2013-06-23 |   1006528
 2013-06-30 |   1012998
 2013-07-07 |   1020873
 2013-07-14 |   1044292
 2013-07-21 |   1161634
 2013-07-28 |   1136955
 2013-08-04 |   1224921
 2013-08-11 |   1085401
 2013-08-18 |   1094469
 2013-08-25 |   1035215
 2013-09-01 |   1159322
 2013-09-08 |   1116035
 2013-09-15 |   1026649
(26 rows)

2) I also reprocessed looking for TC=1 in responses and found interesting clusters of IP ranges that always respond with TC=1 but never provide UDP.  Some others just force TCP for everything.

3) I started collecting the TTL responses to packets this past week.  Not sure who else is collecting this type of data, but any ideas of graphs, etc.. you want related to this, let me know.  I could create a weekly graph showing the distriubtion of all responses.

- Jared


More information about the dns-operations mailing list