Re: [DNSOP] Open Aggregated Datasets and stats on DNS (.NL ccTLD)

["Giovane C. M. Moura" <[e-mail]>]

> I'd be curious to know what you're seeing for the dominant "_<port>"
>> number in the observed TLSA queries, and whether any particular
>> resolvers are responsible for the bulk of the "_25" queries.

In the previous e-mail I sent the client's source ports counts, in
addition to the counts per IP.

Now I see you meant  something else, the port number listed in the
qname: E.g: the "25"  part in _25._tcp.mail.example2.nl.

So for that, I parsed the query as follows, in SQL/Impala syntax:

select regexp_extract(qname, "^(_[0-9]*)\.",0) as label, count(1) as
total from  dns.queries where qtype=52 and year='2015' group by label
order by total desc;

The results, for the top 20, are:

Port,TotalQueries
25,93592
443,36536
NA,4011
587,885
465,878
8443,98
2222,70
4040,66
8888,38
2223,35
5222,25
48443,24
5001,23
1443,20
448,20
2087,16
4443,15
14443,15
2443,14


So it's more "popular" on e-mail than web. Just let me know if you need
the entire csv.

/giovane