<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=GB2312" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
BODY {
LINE-HEIGHT: 1.5; FONT-FAMILY: ΢ÈíÑźÚ; COLOR: #000080; FONT-SIZE: 10.5pt
}
</STYLE>
<META name=GENERATOR content="MSHTML 8.00.6001.19393"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>seemly you have something perfect to share. Would you like to share your
achievement?</DIV>
<DIV> </DIV>
<HR style="WIDTH: 210px; HEIGHT: 1px" align=left color=#b5c4df SIZE=1>
<DIV><SPAN>Liu Mingxing</SPAN></DIV>
<DIV> </DIV>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0cm; PADDING-LEFT: 0cm; PADDING-RIGHT: 0cm; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<DIV
style="PADDING-BOTTOM: 8px; PADDING-LEFT: 8px; PADDING-RIGHT: 8px; BACKGROUND: #efefef; COLOR: #000000; FONT-SIZE: 12px; PADDING-TOP: 8px">
<DIV><B>From:</B> <A href="mailto:jtk@cymru.com">John Kristoff</A></DIV>
<DIV><B>Date:</B> 2013-01-05 01:05</DIV>
<DIV><B>To:</B> <A href="mailto:matt@conundrum.com">Matthew
Pounsett</A></DIV>
<DIV><B>CC:</B> <A
href="mailto:dns-operations@dns-oarc.net">dns-operations</A></DIV>
<DIV><B>Subject:</B> Re: [dns-operations] Fingerprinting stub
resolvers</DIV></DIV></DIV>
<DIV>
<DIV>On Fri, 4 Jan 2013 11:05:47 -0500</DIV>
<DIV>Matthew Pounsett <matt@conundrum.com> wrote:</DIV>
<DIV> </DIV>
<DIV>> A friend of mine at an ISP asked me recently whether I had any</DIV>
<DIV>> suggestions for fingerprinting stub resolvers. They've got pcaps</DIV>
<DIV>> from the downstream side of their caching servers and are looking at</DIV>
<DIV>> trying to pull more interesting statistics than query counts out of</DIV>
<DIV>> them. I didn't have any good suggestions, but it seems like an</DIV>
<DIV>> interesting question to ask of one's name server. Has anyone else</DIV>
<DIV>> tackled this before? Do tools exist?</DIV>
<DIV> </DIV>
<DIV>I've not tried it in an automated way, but if you have pcaps of stub</DIV>
<DIV>resolvers, that ought to tell you a good deal. Certain operating</DIV>
<DIV>systems for instance may use particular IP TTL values, have differing</DIV>
<DIV>IP ID field generation techniques, utilize a distinct pool of</DIV>
<DIV>source ports, select source ports in an observable way, issue</DIV>
<DIV>particular queries commonly associated to a particular operating system</DIV>
<DIV>or application and generate queries at deterministic intervals and in</DIV>
<DIV>recurring, but identifiable patterns and lastly, but probably not</DIV>
<DIV>exhaustively, select or utilize configured full resolvers in ways</DIV>
<DIV>unique to the stub resolver implementation.</DIV>
<DIV> </DIV>
<DIV>John</DIV>
<DIV>_______________________________________________</DIV>
<DIV>dns-operations mailing list</DIV>
<DIV>dns-operations@lists.dns-oarc.net</DIV>
<DIV>https://lists.dns-oarc.net/mailman/listinfo/dns-operations</DIV>
<DIV>dns-jobs mailing list</DIV>
<DIV>https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</DIV></DIV></BODY></HTML>