IETF Logo Mail Archive

Re: [DNSOP] we already have a new version of this problem

"Wessels, Duane" <dwessels@verisign.com> Mon, 09 November 2015 17:43 UTC

Return-Path: <dwessels@verisign.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3155D1A8928 for <dnsop@ietfa.amsl.com>; Mon, 9 Nov 2015 09:43:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vMlaVg07PeRu for <dnsop@ietfa.amsl.com>; Mon, 9 Nov 2015 09:43:06 -0800 (PST)
Received: from mail-oi0-f100.google.com (mail-oi0-f100.google.com [209.85.218.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A4D41A8908 for <dnsop@ietf.org>; Mon, 9 Nov 2015 09:43:06 -0800 (PST)
Received: by oies6 with SMTP id s6so10304799oie.1 for <dnsop@ietf.org>; Mon, 09 Nov 2015 09:43:05 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:thread-topic:thread-index :date:message-id:references:in-reply-to:accept-language :content-language:content-type:content-id:content-transfer-encoding :mime-version; bh=70EzVFmlGSmUcd1vv4NldE9GS6P3pF4OG5IfGNZu0lM=; b=dA3rzh7tOG+WMRklwGfouvLtrAmuSc1PMgWZUErRFZFpfxFODEkH9589ndTR4QgDRi etrkbgZ9spa/Wvgdrn1flBi7HGXNCuRsS0OUIr/BX7Yj/1dypWNs5E10tcWoUAnDBkb9 8BMW0qeDQ/WH42bFdj6IRdctzjKRXqHNCS0JiZG8sHQe32MKWQCJVquhawYmJn+6K1zk Fc+jKU94j9+16QQ9ryD1J9UGotlIbatj0VoBR5I2EDY2l+ckoHAmU+x5dP4q1CXVrW8w dSfUtjgkvnSCEk4tGFlioFEg/aSyeNvEbwz+o4oMKEsjOBTp2mrIt1gnpyfnhlIzYLJv bCbA==
X-Gm-Message-State: ALoCoQl5K6JENj048w5XEKUHr4iEpDREzayLvD5zdQnduW78yoQUXFp0AUqZ0FOZiIR/hW6whWynLTC8pX4SVPYDF22CPBScdg==
X-Received: by 10.55.72.85 with SMTP id v82mr33154655qka.3.1447090985741; Mon, 09 Nov 2015 09:43:05 -0800 (PST)
Received: from brn1lxmailout01.verisign.com (brn1lxmailout01.verisign.com. [72.13.63.41]) by smtp-relay.gmail.com with ESMTPS id y123sm1668111qky.3.2015.11.09.09.43.05 (version=TLSv1 cipher=RC4-SHA bits=128/128); Mon, 09 Nov 2015 09:43:05 -0800 (PST)
X-Relaying-Domain: verisign.com
Received: from brn1wnexcas01.vcorp.ad.vrsn.com (brn1wnexcas01 [10.173.152.205]) by brn1lxmailout01.verisign.com (8.13.8/8.13.8) with ESMTP id tA9Hh5uW013529 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 9 Nov 2015 12:43:05 -0500
Received: from BRN1WNEXMBX01.vcorp.ad.vrsn.com ([::1]) by brn1wnexcas01.vcorp.ad.vrsn.com ([::1]) with mapi id 14.03.0174.001; Mon, 9 Nov 2015 12:43:04 -0500
From: "Wessels, Duane" <dwessels@verisign.com>
To: Joe Abley <jabley@hopcount.ca>
Thread-Topic: [DNSOP] we already have a new version of this problem
Thread-Index: AQHRGMnknSEJwLA48kOddGcsTrYVFJ6PwI+AgASN0wA=
Date: Mon, 09 Nov 2015 17:43:04 +0000
Message-ID: <F09FD6DA-9A89-4E43-AF6D-C0452BC5B7A8@verisign.com>
References: <CAKr6gn0oiK9WKfN95b=muuxG0+0oKv8KDaq=xpabRf-zgCO+gQ@mail.gmail.com> <alpine.LSU.2.00.1511051112440.959@hermes-2.csi.cam.ac.uk> <855E6C9C-79F5-4DE5-B1F8-574A697E9EF0@verisign.com> <CA2FD5F5-E56D-435F-9E89-48EA40619B1D@hopcount.ca>
In-Reply-To: <CA2FD5F5-E56D-435F-9E89-48EA40619B1D@hopcount.ca>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.173.152.4]
Content-Type: text/plain; charset="us-ascii"
Content-ID: <4D03B67E91C3FE40A77A02FE4B265CF3@verisign.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/dnsop/7g4fA_5UztwRbjDpHgcC2L0ZiiM>
Cc: dnsop WG <dnsop@ietf.org>
Subject: Re: [DNSOP] we already have a new version of this problem
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 09 Nov 2015 17:43:08 -0000

> On Nov 6, 2015, at 12:10 PM, Joe Abley <jabley@hopcount.ca> wrote:
> 
> Hi Duane,
> 
> On 6 Nov 2015, at 14:32, Wessels, Duane wrote:
> 
>>> On Nov 5, 2015, at 3:26 AM, Tony Finch <dot@dotat.at> wrote:
>>> 
>>> Has anyone done a survey of where the leaked .home queries come from?
>> 
>> In the spirit of Measurement-Driven Protocol Engineering here are some recent data points from root servers:
>> 
>> Over the past 7 days Verisign observed an average of 200,000,000 ".home" queries per day from 120,000 distinct source addresses (per day).  These are queries sent to A-root and J-root.
>> 
>> Based on Geo-IP data we see queries from essentially every known country, with ~70% of total queries coming from the top 10 countries listed below:
>> 
>> US	14.27%
>> BR	9.69%
>> ES	9.19%
>> GB	7.41%
>> RU	6.60%
>> CN	6.47%
>> NL	5.45%
>> CA	4.85%
>> DE	2.88%
>> TW	2.34%
> 
> It might be interesting to also rank the top ten countries originating any kind of query received at A and J. If that list is the same as the one above, that might help confirm or deny whether this is an effect more prevalent in some places than other, or whether it's just a function of how many people in each country are using the DNS.

Joe,

Here's that data:

US	27.40%
CN	14.86%
BR	6.23%
KR	5.35%
RU	3.61%
TW	3.04%
NL	3.03%
GB	2.50%
DE	2.10%
IT	1.67%


DW

v2.23.0 | Report a Bug | By Email