Subject: [Add] measuring the size of the canary

From: Wes Hardaker <[email-masked]>
Date: Wed, 20 Nov 2019 00:24:32 -0800

A short while after the announcement of Mozilla's canary domain, I was
curious how the bird would grow over time.  I finally collected the data
and graphed it yesterday.  The results are here:

https://www.isi.edu/~hardaker/news/20191120-canary-domain-measuring.html

-- 
Wes Hardaker                                     
USC/ISI

---

From: Andy Grover <[email-masked]>
Date: Wed, 20 Nov 2019 16:45:49 +0800

> https://www.isi.edu/~hardaker/news/20191120-canary-domain-measuring.html

Very interesting, thanks for doing this.

By the way, while NXDOMAIN certainly is treated as a positive canary
response, it has been expanded to include all error responses as well as
successful results that don't include A or AAAA records, so it might
actually be a bit higher.

-- Andy

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 20 Nov 2019 01:26:49 -0800

> actually be a bit higher.

I'll look into a better measurement...  most of the errors, though, were
timeouts.  But I'll check for real errors as well.

-- 
Wes Hardaker
USC/ISI

---

From: Tommy Pauly <[email-masked]>
Date: Wed, 20 Nov 2019 17:33:47 +0800

Thanks indeed for sharing this!

Not sure if the data can show this, but I'd be curious to know if we see patterns in the kinds of networks that are using the canary: School Wi-Fi, home Wi-Fi, enterprise, etc.

I also wonder what we think the overall marking rate will be. The fact that the percentage is already 7% is pretty high, considering that the use of the canary is still quite nascent.

Best,
Tommy

> On Nov 20, 2019, at 5:26 PM, Wes Hardaker <[email-masked]> wrote:
> 
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 20 Nov 2019 01:40:50 -0800

Andy Grover <[email-masked]> writes:

> response,

Unfortunately, RIPE Atlas doesn't make it easy to determine what the
rcode was.  I can find other errors in it, but I think you'll agree that
these other errors aren't sufficient in the analysis to be included:

   count               error as reported by atlas
   -----               --------------------------
      2                "nameserver" : "no local resolvers found"
     14                "socket" : "connect failed Invalid argument"
      8                "socket" : "connect failed Network is unreachable"
      4                "socket" : "connect failed Permission denied"
     94                "timeout" : 5000

-- 
Wes Hardaker
USC/ISI

---

From: Michael Richardson <[email-masked]>
Date: Thu, 21 Nov 2019 08:49:43 +0800

Tommy Pauly <tpauly=[email-masked]> wrote:
    > Not sure if the data can show this, but I'd be curious to know if we
    > see patterns in the kinds of networks that are using the canary: School
    > Wi-Fi, home Wi-Fi, enterprise, etc.

I believe that we will get self-selection bias because few of those places
will have Atlas probes.

    > I also wonder what we think the overall marking rate will be. The fact
    > that the percentage is already 7% is pretty high, considering that the
    > use of the canary is still quite nascent.

I was also surprised, and sent Wes a clarification question, and now realize
that he said most of that was timeouts, not intentional configuration of the
canary domain.  i.e. the local DNS was maybe just broken :-)

If only 7/1000 recursive DNS servers are broken, that's a pretty good DNS story :-)

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-