Re: [DNSOP] AS112 for TLDs

On Tue, Apr 01, 2008 at 01:51:54PM -0400, Edward Lewis wrote:
> At 10:35 -0700 4/1/08, Sebastian Castro Avila wrote:
> 
> >Sorry for the late response. About this matter, using the data collected
> >at the root server instances participating in DITL 2007, we found 24.73%
> >of the queries seen at the roots were for invalid TLD's.
> >
> >Doing an analysis per root, the numbers vary
> >
> >C-root		19.15%
> >F-root		46.79%
> >K-root		10.01%
> >M-root		20.96%
> 
> Wow, what a dispersion.  I'm not calling into question the effort, 
> etc., but seeing these numbers makes me wonder about the value of the 
> results.  The reasons for my suspicion are:
> 
> 1) That there such wide variation

We investigated that situation on request and found some F-root
instances were receiving very high volume of queries for invalid TLD.

> 2) from sampling just a minority of the root ('s 13) "nodes"

That's true, is want we can answer with the data avaFrom dnsop-bounces@ietf.org  Tue Apr  1 11:23:35 2008
Return-Path: <dnsop-bounces@ietf.org>
X-Original-To: dnsop-archive@lists.ietf.org
Delivered-To: ietfarch-dnsop-archive@core3.amsl.com
Received: from core3.amsl.com (localhost [127.0.0.1])
	by core3.amsl.com (Postfix) with ESMTP id 4A05A3A68D1;
	Tue,  1 Apr 2008 11:23:35 -0700 (PDT)
X-Original-To: dnsop@core3.amsl.com
Delivered-To: dnsop@core3.amsl.com
Received: from localhost (localhost [127.0.0.1])
	by core3.amsl.com (Postfix) with ESMTP id 22C6D3A68D1
	for <dnsop@core3.amsl.com>; Tue,  1 Apr 2008 11:23:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.392
X-Spam-Level: 
X-Spam-Status: No, score=-1.392 tagged_above=-999 required=5 tests=[AWL=1.207, 
	BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32])
	by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id qxegeZ1RsY8z for <dnsop@core3.amsl.com>;
	Tue,  1 Apr 2008 11:23:31 -0700 (PDT)
Received: from mail.nic.cl (mail.nic.cl [200.1.123.8])
	by core3.amsl.com (Postfix) with ESMTP id 695C43A6882
	for <dnsop@ietf.org>; Tue,  1 Apr 2008 11:23:31 -0700 (PDT)
Received: from mail.nic.cl (mailn [127.0.0.1])
	by mail.nic.cl (Postfix) with ESMTP id B03EDCCB87A;
	Tue,  1 Apr 2008 14:23:29 -0400 (CLT)
Received: from nicolette.nic.cl (nicolette.nic.cl [200.1.123.5])
	by mail.nic.cl (Postfix) with ESMTP id A4156CCB878;
	Tue,  1 Apr 2008 14:23:29 -0400 (CLT)
Received: from nicolette.nic.cl (nicolette [127.0.0.1])
	by nicolette.nic.cl (8.13.1/8.13.1) with ESMTP id m31INT6a017035;
	Tue, 1 Apr 2008 14:23:29 -0400
Received: (from secastro@localhost)
	by nicolette.nic.cl (8.13.1/8.13.1/Submit) id m31INJwc017025;
	Tue, 1 Apr 2008 14:23:19 -0400
Date: Tue, 1 Apr 2008 14:23:19 -0400
From: Sebastian Castro <secastro@nic.cl>
To: Edward Lewis <Ed.Lewis@neustar.biz>
Message-ID: <20080401182319.GA16269@nicolette.nic.cl>
References: <20071127141848.GA16571@nic.fr>
	<Pine.LNX.4.64.0712031339450.13550@ryouko.imsb.nrc.ca>
	<47546DB3.1040907@ca.afilias.info>
	<a0624080cc37ba1875cf0@[130.129.67.81]>
	<47F2726E.6060906@nic.cl> <a06240801c41825409ca1@[10.31.68.58]>
Mime-Version: 1.0
Content-Disposition: inline
In-Reply-To: <a06240801c41825409ca1@[10.31.68.58]>
User-Agent: Mutt/1.4.1i
X-Virus-Scanned: ClamAV version 0.88,
	clamav-milter version 0.87 on nicolette.nic.cl
X-Virus-Status: Clean
X-Virus-Scanned: ClamAV using ClamSMTP on Tue Apr 1 14:23:29 2008 -0400 (CLT)
Cc: dnsop@ietf.org
Subject: Re: [DNSOP] AS112 for TLDs
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsop>,
	<mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/pipermail/dnsop>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>,
	<mailto:dnsop-request@ietf.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: dnsop-bounces@ietf.org
Errors-To: dnsop-bounces@ietf.org

On Tue, Apr 01, 2008 at 01:51:54PM -0400, Edward Lewis wrote:
> At 10:35 -0700 4/1/08, Sebastian Castro Avila wrote:
> 
> >Sorry for the late response. About this matter, using the data collected
> >at the root server instances participating in DITL 2007, we found 24.73%
> >of the queries seen at the roots were for invalid TLD's.
> >
> >Doing an analysis per root, the numbers vary
> >
> >C-root		19.15%
> >F-root		46.79%
> >K-root		10.01%
> >M-root		20.96%
> 
> Wow, what a dispersion.  I'm not calling into question the effort, 
> etc., but seeing these numbers makes me wonder about the value of the 
> results.  The reasons for my suspicion are:
> 
> 1) That there such wide variation

We investigated that situation on request and found some F-root
instances were receiving very high volume of queries for invalid TLD.

> 2) from sampling just a minority of the root ('s 13) "nodes"

That's true, is want we can answer with the data availilable. However, the
data sample is not small: 61 root instances, 24 hours of data.

> 3) considering that the topology/architecture of each sampled node is 
> vastly different
> 

> (I should ask - for, say, F, are the samples across all nodes of the 
> [F] any cast cloud or just sampling at a few of the node's any cast 
> members?)
> 

For that study we use the following data:

24 hour traces collected between 01-09-2007 12:00 and 01-10-2007 12:00,
on 61 root server anycast nodes

C-root, all 4 instances
F-root, 36 out of 40
K-root, 15 out of 17
M-root, all 6 instances

So the data seems to be useful (but not complete). Once we got all the
data for DITL 2008 we could try to run the same test and look for
trends.

Regards
Sebastian

> -- 
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> Edward Lewis                                                +1-571-434-5468
> NeuStar
> 
> Never confuse activity with progress.  Activity pays more.
> 

-- 
Sebastian E. Castro Avila             sebastian@nic.cl
Enviado Especial (a.k.a. New Elf)     secastro@caida.org
_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop

able. However, the
data sample is not small: 61 root instances, 24 hours of data.

> 3) considering that the topology/architecture of each sampled node is 
> vastly different
> 

> (I should ask - for, say, F, are the samples across all nodes of the 
> [F] any cast cloud or just sampling at a few of the node's any cast 
> members?)
> 

For that study we use the following data:

24 hour traces collected between 01-09-2007 12:00 and 01-10-2007 12:00,
on 61 root server anycast nodes

C-root, all 4 instances
F-root, 36 out of 40
K-root, 15 out of 17
M-root, all 6 instances

So the data seems to be useful (but not complete). Once we got all the
data for DITL 2008 we could try to run the same test and look for
trends.

Regards
Sebastian

> -- 
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> Edward Lewis                                                +1-571-434-5468
> NeuStar
> 
> Never confuse activity with progress.  Activity pays more.
> 

-- 
Sebastian E. Castro Avila             sebastian@nic.cl
Enviado Especial (a.k.a. New Elf)     secastro@caida.org
_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop