Subject: [DNSOP] DNS-Server distribution statistics

From: "Woodworth, John R" <[email-masked]>
Date: Sat, 11 Feb 2017 21:13:01 +0000

All,

Apologies if this is not the perfect forum for this but I am trying to get an idea of what the breakdown for DNS is on the server side.  I was unable to find anything equivalent to a zeitgeist breakdown for DNS.

My best guess, without intending to offend, would be something like 'bind', 'argon' and some random mixture of water vapor but am looking for something more specific (i.e. vendor/version).

Does anyone have a list they can point me to or at least share real world or anecdotal data?

Thanks in advance,
John

-- THESE ARE THE DROIDS TO WHOM I REFER:

This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

---

From: "Allan Liska" <[email-masked]>
Date: Sat, 11 Feb 2017 17:49:23 -0500

ISC runs a monthly survey of DNS statistics:
https://ftp.isc.org/www/survey/reports/current/fpdns.txt (this is from
January 2017).
Information about the survey is here:
https://ftp.isc.org/www/survey/reports/current/survey.html
Not sure how useful their data is, but they have been doing it for a
long time, so they have great trending analysis.
allan

On 2/11/2017 at 4:13 PM, "John R Woodworth"  wrote:      

	All, 
	Apologies if this is not the perfect forum for this but I am trying
to get an idea of what the breakdown for DNS is on the server side.  I
was unable to find anything equivalent to a zeitgeist breakdown for
DNS. 
	My best guess, without intending to offend, would be something like
‘bind’, ‘argon’ and some random mixture of water vapor but am
looking for something more specific (i.e. vendor/version). 
	Does anyone have a list they can point me to or at least share real
world or anecdotal data? 
	Thanks in advance, 

	John

---

From: "Woodworth, John R" <[email-masked]>
Date: Sun, 12 Feb 2017 05:21:29 +0000

Allan,

Many thanks for the links.  This is great info and right on point!

Thanks again,
John

From: Allan Liska [mailto:[email-masked]]
Sent: Saturday, February 11, 2017 5:49 PM
To: Woodworth, John R; dnsop
Cc: Ballew, Dean
Subject: Re: [DNSOP] DNS-Server distribution statistics

https://ftp.isc.org/www/survey/reports/current/fpdns.txt (this is from January 2017).

Not sure how useful their data is, but they have been doing it for a long time, so they have great trending analysis.

allan

On 2/11/2017 at 4:13 PM, "John R Woodworth" <[email-masked]> wrote:
All,

My best guess, without intending to offend, would be something like ‘bind’, ‘argon’ and some random mixture of water vapor but am looking for something more specific (i.e. vendor/version).

Thanks in advance,
John

---

From: "Paul Hoffman" <[email-masked]>
Date: Sun, 12 Feb 2017 09:40:21 -0500

> long time, so they have great trending analysis.

Do note, however, that fingerprinting DNS servers has gotten much harder 
over time, so take the results with a very large grain of salt. For 
example, the software that runs that survey seems to think that there 
are no versions of BIND 9 since 9.4.0a0.

--Paul Hoffman

---

From: "Woodworth, John R" <[email-masked]>
Date: Sun, 12 Feb 2017 19:55:42 +0000

-----Original Message-----
From: DNSOP [mailto:[email-masked]] On Behalf Of Paul Hoffman
> are no versions of BIND 9 since 9.4.0a0.

Thanks Paul!

I was wondering about that.  Figured there would be more people at least
near the bleeding-edge.

Thanks,
John

> --Paul Hoffman
>
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: George Michaelson <[email-masked]>
Date: Mon, 13 Feb 2017 00:44:43 +0200

I have never entirely got with the people who think obscuring version
information is necessary and correct. Designing for the bad actors
presupposes they will somehow magically not attack you, simply because
you obscured the version info.

Root ops (I may misremember) stand out in my mind as a group who have
from time to time said "we don't feel we need, or should tell you
that"

So on the whole, I think we should explore this "what version are you"
question more, and possibly do better at flagging it.

Having said which: people lie all the time. Either by intent, or
because they reply with information which was correct when they set
it, but has aged out. So even with the best of intentions,
version-flagging needs to be taken with a grain of salt.

-G

---

From: Warren Kumari <[email-masked]>
Date: Sun, 12 Feb 2017 17:56:56 -0500

On Sun, Feb 12, 2017 at 5:44 PM, George Michaelson <[email-masked]> wrote:
> it, but has aged out.

https://puck.nether.net/~jared/version.bind.results.20160402.txt

What?!!!! You don't believe that there is at least one person running
version 3.14159? How 'bout "19,800yen"?
Surely you don't doubt that "An Italian is COMBING his hair in
suburban DES MOINES!"

Still, nice to know that someone is keeping the love with a "C=64 with
Final Cartridge II and 1541 discdrive"

W

> So even with the best of intentions,

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: william manning <[email-masked]>
Date: Sun, 12 Feb 2017 16:25:28 -0800

which is why, Warren, that modern fingerprinting does not rely on what the
server lies about.

/W

On Sun, Feb 12, 2017 at 2:56 PM, Warren Kumari <[email-masked]> wrote:

> >> This communication is the property of CenturyLink and may contain
> confidential or privileged information. Unauthorized use of this
> communication is strictly prohibited and may be unlawful. If you have
> received this communication in error, please immediately notify the sender
> by reply e-mail and destroy all copies of the communication and any
> attachments.
> >>