Re: [Doh] DoT and DoH at Cambridge

[Tony Finch <[e-mail]>]

Erik Kline <ek=[e-mail]> wrote:
>
> Ben Schwartz can comment further on whether there's an experiment
> ongoing or not.  However, these kind of queries are also used by the
> DoT code in Pie to help validate whether the DoT answering thing
> actually speaks DNS (as opposed to someone's random webserver they
> left running or whatnot). I wouldn't have necessarily expected the
> disparity between dnsotls queries and actual subsequent DoT traffic.
> Hmm...

Yes, I thought at first that they were "tap tap tap is this thing on?"
queries but the lack of followup real queries made me think otherwise.

I'm looking again now and there's a lot more real traffic, so it must have
been just the time of day (early evening) when I was examining the traffic
yesterday so there was a misleadingly low volume of traffic.

I should not be so quick to make inferences from too little data :-)

At the moment there's a roughy 1:10 ratio of probe queries to real
queries, typical TLS session is 30-40 milliseconds.

Thanks for prompting me to look again!

(X-proxied-for support would make this a bit easier...)

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
democracy, participation, and the co-operative principle