<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-CA" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I’m trying to debug an issue and digging deeply into PCAP data on one of my authoritative DNS servers for TLD.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Specifically, I’m looking at TCP, and one of the things I’m measuring is average length of TCP sessions.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For the most part, the output seems to be in the range that one might expect…<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">2019-09-18 15:25:12.534091 - Close connection with 173.252.127.52.45455 - duration: 0.0403399467468262 seconds<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">2019-09-18 15:25:12.548596 - Close connection with 69.171.251.10.37785 - duration: 0.0552659034729004 seconds<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">2019-09-18 15:25:12.633225 - Close connection with 201.249.172.71.34289 - duration: 0.0829939842224121 seconds<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">2019-09-18 15:25:12.633796 - Close connection with 201.249.172.71.55488 - duration: 0.0827949047088623 seconds<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">2019-09-18 15:25:12.708638 - Close connection with 68.29.64.228.56799 - duration: 0.0311019420623779 seconds<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">2019-09-18 15:25:12.708749 - Close connection with 68.29.64.228.58025 - duration: 0.029994010925293 seconds<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">But I occasionally discover outliers where the TCP sessions last much longer…and they’re all (every single one of them over a 3 hour period) owned by Google…<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2019-09-18 15:25:56.142138 - Close connection with 66.249.66.130.50925 - duration: 30.0402970314026 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:25:56.809966 - Close connection with 66.249.66.149.49004 - duration: 30.0410430431366 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:25:57.261133 - Close connection with 66.249.66.87.42293 - duration: 30.0400409698486 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:25:58.926359 - Close connection with 66.249.66.212.40001 - duration: 30.0402669906616 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:25:59.792171 - Close connection with 66.249.66.44.56640 - duration: 30.0407900810242 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:01.443644 - Close connection with 66.249.66.202.49679 - duration: 30.040363073349 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:02.400458 - Close connection with 66.249.66.92.63989 - duration: 30.0400891304016 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:02.607956 - Close connection with 66.249.66.134.56630 - duration: 30.0398778915405 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:02.961079 - Close connection with 66.249.66.86.52236 - duration: 30.0424818992615 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:04.970860 - Close connection with 66.249.66.208.48889 - duration: 30.0415859222412 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:05.815438 - Close connection with 66.249.66.61.36638 - duration: 38.813982963562 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:06.594296 - Close connection with 66.249.66.43.62136 - duration: 33.7078130245209 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:06.927392 - Close connection with 66.249.66.85.35095 - duration: 30.0403559207916 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:07.825000 - Close connection with 66.249.66.199.49335 - duration: 30.0406250953674 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:08.017335 - Close connection with 66.249.66.217.48327 - duration: 30.0403158664703 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:08.721902 - Close connection with 66.249.66.94.55841 - duration: 30.0409507751465 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:10.040823 - Close connection with 66.249.66.45.55152 - duration: 30.0403800010681 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal">2019-09-18 15:26:16.919386 - Close connection with 66.249.66.60.42043 - duration: 30.0408978462219 seconds *** OVER5<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In any case, I’ve ruled out this being the cause of the issue I was investigating, but it still seems odd that no other software/organizations are behaving in the same way.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So I guess the question for the OARC list would be…do you see this same kind of behaviour from Google? And the question for Google is…what am I missing? What’s the need for this?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks all,<o:p></o:p></p>
<p class="MsoNormal">-Jacob Zack<o:p></o:p></p>
<p class="MsoNormal">DNS Architect – CIRA (.CA TLD)<o:p></o:p></p>
</div>
</body>
</html>