Moin! On 23 Feb 2023, at 23:53, Jim Reid wrote: >> On 23 Feb 2023, at 22:36, Ted Lemon <mel...@fugue.com> wrote: >> How much DNS traffic is even still inspectable these days? > > Depends on the definition of DNS traffic Ted. DNS-OARC has many TB of pcaps > and query logs from the DITL project. Whether that data could be good enough > to meaningfully measure the incidence of QDCOUNT>1 in the real world is > anyone’s guess. I suppose it’ll be difficult (and very subjective) to > distinguish between “real” QDCOUNT>1 queries and the ones from junk > implementations that are just part of the DNS’s background noise.
These DITL data is useless for that question as no resolver worths its name would send qdcount>1 and that is most of what you see in DITL. If at all we would see it on the client/stub resolver side, but I assume it is 0 there too, and IMHO it should be 0 going forward. So long -Ralf --- Ralf Weber _______________________________________________ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop
