Subject: [DNSOP] AS112 for TLDs

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 27 Nov 2007 15:18:48 +0100

I cannot find another report about the TLDs most often queried at a
root name server. Other reports I've seen aggregated data, while this
small glimpse, however partial, at least *names* the TLDs.

All the non-existing TLDs queried are local domains (such as Apple's
".local"), leaking through a configuration error. This looks like a
job for AS112.

http://blog.icann.org/?p=240

_______________________________________________
DNSOP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dnsop

---

From: Phil Regnauld <[email-masked]>
Date: Tue, 27 Nov 2007 16:08:13 +0100

> ".local"), leaking through a configuration error. This looks like a

	.local is most likely broken internal Windows AD domains (MS has
	for a long time recommended using .local for internal domains) --
	Apple's use of .local is multicast only AFAIK.

	Phil

---

From: Phil Regnauld <[email-masked]>
Date: Tue, 27 Nov 2007 16:08:13 +0100

Phil

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 27 Nov 2007 16:17:59 +0100

On Tue, Nov 27, 2007 at 04:08:13PM +0100,
 Phil Regnauld <[email-masked]> wrote 

> 	Apple's use of .local is multicast only AFAIK.

As with all "local-only" domains (wether they are for names or for
addresses), they unavoidably leak. Users see these names, they
copy-and-paste them in emails, in Web browsers and to the root it
goes.

[I assume this is the rationale behind the IETF's lack of enthusiasm
for local-only domains such as ".local" or site-local IP addresses.]

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 27 Nov 2007 16:17:59 +0100

---

From: Joe Baptista <[email-masked]>
Date: Tue, 27 Nov 2007 11:07:59 -0500

>>small glimpse, however partial, at least *names* the TLDs.
I'm posting the comments made to you on the GA/GNSO.  Since I have 
pointed out to you there that this data from L.root is not very 
reflective of network traffic.

> Stephane Bortzmeyer wrote:
>
>> It has been said sometimes that dummy (sorry, Karl, "boutique" TLDs)
>> were present in requests to the root name servers. This is clearly
>> false, all the non-existing TLDs queried are local domains (such as
>> Apple's ".local"), leaking through a configuration error.
>>
> Thanks for that Stephane.  It would look to me like things are getting 
> better.  This root where the data originates seems to get less errors 
> then that reported in 2003 which data mainly came from f.root.
>
> Thats a significant improvement however after careful inspection we 
> begin to see the flaws in this data.  If this were f.root data then I 
> would be very impressed.  Because the data would show a significant 
> decrease in error traffic.  That would be amazing.  In fact the data 
> looks alot like that I have seen for public roots I have setup.  Like 
> the one now used in Turkey.
>
> However this is data from the L.root run by ICANN and i'm not so 
> amazed anymore.  I speculate this is just a little bit of ICANN 
> nonsense designed to once again mislead the public.  Shame.
>
> Now the problem as I see it here is that this data is very limited in 
> scope.  I don't dispute the first chart on popular TLDs.  What i'm 
> interested to see are the popular TLDs that result in errors 
> (NXDOMAIN) as per the original 2003 report methodology.
>
> Next there is nothing in the data that states the number of queries 
> received at the root servers.  Only percentages are used in the 
> metrics.  The articles I wrote
>
> http://www.theregister.co.uk/2003/02/05/dud_queries_swamp_us_internet/
>
> show us that CAIDA conducted an analysis on 152 million messages.  
> This data was obtained from f.root.  f.root is one of the oldest roots 
> on the net while l.root is one of the newest.  In fact if as per the 
> ICANN blog this data was collected on November 26 then it would of 
> come from IP 199.7.83.42 that was implemented on 1 November 2007 and 
> replaced the previous IP address of 198.32.64.12.
>
> http://l.root-servers.org/ip-change-26nov07.htm
>
> The data is unclear if it was collected from 199.7.83.42 or 
> 198.32.64.12.  In any case what is certain is that both versions of 
> the L.root run by ICANN are very new and that means the amount of 
> traffic to them would be very low in comparison to f.root - which in 
> my opinion provides a more accurate reflection of traffic patterns on 
> the net.
>
> So in conclusion is this data in any way reflective of the impact of 
> Karl, "boutique" TLDs?  The answer in this case would be NO.  It is 
> however reflective of the data one would associate with a recently 
> launched root server that few people are yet dependent on.
>
> Hope my comments help you interpret the data.
>
> kindest regards
> joe baptista 

-- 
Joe Baptista                                www.publicroot.org
PublicRoot Consortium
----------------------------------------------------------------
The future of the Internet is Open, Transparent, Inclusive,
Representative & Accountable to the Internet community @large.
----------------------------------------------------------------
  Office: +1 (202) 517-1593
     Fax: +1 (509) 479-0084

---

From: Joe Baptista <[email-masked]>
Date: Tue, 27 Nov 2007 11:07:59 -0500

---

From: John Crain <[email-masked]>
Date: Tue, 27 Nov 2007 09:58:29 -0800

Hi Joe,

It is exactly reflective of traffic as seen at l.root-servers.net and  
measured by DSC.  there is no trickery, plots or evil schemes involved.

Shame that your paranoia gets the better of you;)

Those are percentages not queries indeed. Total queries varies between  
8Kq/s and 10Kq/s on a normal day.
So you can do the math if you really want to see it by q/s.  Also it  
only shows the TOP scores, not all TLDs.

For clarity: The data is from both current and old IPv4 addresses  
(Across all instances of L)

I have already spoken to CAIDA about supplying them with L-root data  
for future projects and we will be taking part in their "day in the  
life of" project
so you should see L-root included in their future analysis.

John L. Crain
Chief Technical Officer
I.C.A.N.N.

On 27 Nov 2007, at 08:07, Joe Baptista wrote:

>> Thanks for that Stephane.  It would look to me like things are  
>> getting better.  This root where the data originates seems to get  
>> less errors then that reported in 2003 which data mainly came from  
>> f.root.
>>
>> begin to see the flaws in this data.  If this were f.root data then  
>> I would be very impressed.  Because the data would show a  
>> significant decrease in error traffic.  That would be amazing.  In  
>> fact the data looks alot like that I have seen for public roots I  
>> have setup.  Like the one now used in Turkey.
>>
>> Now the problem as I see it here is that this data is very limited  
>> in scope.  I don't dispute the first chart on popular TLDs.  What  
>> i'm interested to see are the popular TLDs that result in errors  
>> This data was obtained from f.root.  f.root is one of the oldest  
>> roots on the net while l.root is one of the newest.  In fact if as  
>> per the ICANN blog this data was collected on November 26 then it  
>> would of come from IP 199.7.83.42 that was implemented on 1  
>> November 2007 and replaced the previous IP address of 198.32.64.12.
>>
>> traffic to them would be very low in comparison to f.root - which  
>> in my opinion provides a more accurate reflection of traffic  
>> patterns on the net.
>>
>> So in conclusion is this data in any way reflective of the impact  
>> of Karl, "boutique" TLDs?  The answer in this case would be NO.  It  
>> is however reflective of the data one would associate with a  
>> recently launched root server that few people are yet dependent on.
>>
> <baptista.vcf>_______________________________________________
> DNSOP mailing list
> [email-masked]

---

From: John Crain <[email-masked]>
Date: Tue, 27 Nov 2007 09:58:29 -0800

Hi Joe,

John L. Crain
Chief Technical Officer
I.C.A.N.N.

---

From: Joe Baptista <[email-masked]>
Date: Tue, 27 Nov 2007 17:05:11 -0500

> Shame that your paranoia gets the better of you;)

Your right.  There is no trickery, plots or evil schemes involved.  I 
misspoke in the message to the GA.  The only one misleading us using the 
data was stephane and I doubt that was intentional.  We are having a 
discussion concerning TLDs there and the data was used to make a point, 
which on reflection does not exist due to the particulars made in my reply.

> Those are percentages not queries indeed. Total queries varies 
> between  8Kq/s and 10Kq/s on a normal day.

I know - in both cases recent deployments of a root server.  It would be 
very beneficial to see this data across the other roots for comparison.  
As I have said the L.root is not reflective of the overall traffic 
patterns to all the roots as L is a very new instance of a root, either 
old or new IPv4 address.

Incidentally - just how much traffic is this representative of?  How 
many queries came in during the period the data was captured?

Thanks for the clarification.

regards
joe baptista

regards
joe baptista

>>> http://www.theregister.co.uk/2003/02/05/ dud_queries_swamp_us_internet/
>>>

---

From: Joe Baptista <[email-masked]>
Date: Tue, 27 Nov 2007 17:05:11 -0500

regards
joe baptista

regards
joe baptista

---

From: John Crain <[email-masked]>
Date: Tue, 27 Nov 2007 14:12:06 -0800

Hi Joe.

I didn't do the math, I was using DSC.

I'm sure I could figure it out with some DSC tweaking...

However with beign completely unscientific and measuring rates  
averaging from 8kq/s (low)  to 10kq/s (high) over a 24hr period
it's between 691.2 million and 864 million queries. So a fairly big  
sample.. I would estimate that it is somewhere inbetween at about 750  
million.

I'll leave more in depth analysis to the likes of CAIDA, they're  
better at it than me.

John L. Crain
Chief Technical Officer
I.C.A.N.N.

On 27 Nov 2007, at 14:05, Joe Baptista wrote:

> John Crain wrote:
>
>> Hi Joe,
>>
>> It is exactly reflective of traffic as seen at l.root-servers.net  
>> and  measured by DSC.  there is no trickery, plots or evil schemes  
>> involved.
>>
> Your right.  There is no trickery, plots or evil schemes involved.   
> I misspoke in the message to the GA.  The only one misleading us  
> using the data was stephane and I doubt that was intentional.  We  
> are having a discussion concerning TLDs there and the data was used  
> to make a point, which on reflection does not exist due to the  
> particulars made in my reply.
>
>> So you can do the math if you really want to see it by q/s.  Also  
>> it  only shows the TOP scores, not all TLDs.
>>
> I know - in both cases recent deployments of a root server.  It  
> would be very beneficial to see this data across the other roots for  
> comparison.  As I have said the L.root is not reflective of the  
> overall traffic patterns to all the roots as L is a very new  
> instance of a root, either old or new IPv4 address.
>
>> I have already spoken to CAIDA about supplying them with L-root  
>> data  for future projects and we will be taking part in their "day  
>> in the  life of" project
>>> I'm posting the comments made to you on the GA/GNSO.  Since I  
>>> have  pointed out to you there that this data from L.root is not  
>>> very  reflective of network traffic.
>>>
>>>> getting better.  This root where the data originates seems to  
>>>> get  less errors then that reported in 2003 which data mainly  
>>>> came from  f.root.
>>>>
>>>> Thats a significant improvement however after careful inspection  
>>>> we  begin to see the flaws in this data.  If this were f.root  
>>>> data then  I would be very impressed.  Because the data would  
>>>> show a  significant decrease in error traffic.  That would be  
>>>> amazing.  In  fact the data looks alot like that I have seen for  
>>>> public roots I  have setup.  Like the one now used in Turkey.
>>>>
>>>> Now the problem as I see it here is that this data is very  
>>>> limited  in scope.  I don't dispute the first chart on popular  
>>>> TLDs.  What  i'm interested to see are the popular TLDs that  
>>>> result in errors  (NXDOMAIN) as per the original 2003 report  
>>>> methodology.
>>>>
>>>> Next there is nothing in the data that states the number of  
>>>> queries  received at the root servers.  Only percentages are used  
>>>> in the  metrics.  The articles I wrote
>>>>
>>>> show us that CAIDA conducted an analysis on 152 million  
>>>> messages.   This data was obtained from f.root.  f.root is one of  
>>>> the oldest  roots on the net while l.root is one of the newest.   
>>>> In fact if as  per the ICANN blog this data was collected on  
>>>> November 26 then it  would of come from IP 199.7.83.42 that was  
>>>> implemented on 1  November 2007 and replaced the previous IP  
>>>> address of 198.32.64.12.
>>>>
>>>> 198.32.64.12.  In any case what is certain is that both versions  
>>>> of  the L.root run by ICANN are very new and that means the  
>>>> amount of  traffic to them would be very low in comparison to  
>>>> f.root - which  in my opinion provides a more accurate reflection  
>>>> of traffic  patterns on the net.
>>>>
>>>> So in conclusion is this data in any way reflective of the  
>>>> impact  of Karl, "boutique" TLDs?  The answer in this case would  
>>>> be NO.  It  is however reflective of the data one would associate  
>>>> with a  recently launched root server that few people are yet  
>>>> dependent on.
>>>>
> <baptista.vcf>

---

From: John Crain <[email-masked]>
Date: Tue, 27 Nov 2007 14:12:06 -0800

Hi Joe.

John L. Crain
Chief Technical Officer
I.C.A.N.N.

---

From: Joe Baptista <[email-masked]>
Date: Tue, 27 Nov 2007 17:28:20 -0500

> sample.. I would estimate that it is somewhere inbetween at about 750  

Interesting.  Just doing some more estimating - what percentage of those 
queries, or how are they divided between the old and new IP.

regards
joe baptista

---

From: Joe Baptista <[email-masked]>
Date: Tue, 27 Nov 2007 17:28:20 -0500

regards
joe baptista

---

From: John Crain <[email-masked]>
Date: Tue, 27 Nov 2007 14:35:29 -0800

hi Joe

Not sure if everyone is interested in our back and forth so maybe you  
can post me a list of questions privately and
I'll pull up more stats and graphs if I have them and post them on the  
blog where people can see them...

The more data you have, the more questions it raises...

Currently about 60% New IP to 40% old IP... and rising slowly

So clearly a lot of folks still need to up date their hints files :(

I'll produce some trends (and publish them) once we have more long  
term data on this.

John L. Crain
Chief Technical Officer
I.C.A.N.N.

On 27 Nov 2007, at 14:28, Joe Baptista wrote:

>> it's between 691.2 million and 864 million queries. So a fairly  
>> big  sample.. I would estimate that it is somewhere inbetween at  
>> about 750  million.
>
> Interesting.  Just doing some more estimating - what percentage of  
> those queries, or how are they divided between the old and new IP.
>
> regards
> joe baptista
>
>>
>>
>>>> It is exactly reflective of traffic as seen at l.root- 
>>>> servers.net  and  measured by DSC.  there is no trickery, plots  
>>>> or evil schemes  involved.
>>>>
>>> Your right.  There is no trickery, plots or evil schemes  
>>> involved.   I misspoke in the message to the GA.  The only one  
>>> misleading us  using the data was stephane and I doubt that was  
>>> intentional.  We  are having a discussion concerning TLDs there  
>>> and the data was used  to make a point, which on reflection does  
>>> not exist due to the  particulars made in my reply.
>>>
>>>> So you can do the math if you really want to see it by q/s.   
>>>> Also  it  only shows the TOP scores, not all TLDs.
>>>>
>>>> For clarity: The data is from both current and old IPv4  
>>>> addresses   (Across all instances of L)
>>>
>>>
>>> would be very beneficial to see this data across the other roots  
>>> for  comparison.  As I have said the L.root is not reflective of  
>>> the  overall traffic patterns to all the roots as L is a very new   
>>> Incidentally - just how much traffic is this representative of?   
>>> How  many queries came in during the period the data was captured?
>>>
>>>> data  for future projects and we will be taking part in their  
>>>> "day  in the  life of" project
>>>>> have  pointed out to you there that this data from L.root is  
>>>>> not  very  reflective of network traffic.
>>>>>
>>>>>> Thanks for that Stephane.  It would look to me like things  
>>>>>> are   getting better.  This root where the data originates  
>>>>>> seems to  get  less errors then that reported in 2003 which  
>>>>>> data mainly  came from  f.root.
>>>>>>
>>>>>> Thats a significant improvement however after careful  
>>>>>> inspection  we  begin to see the flaws in this data.  If this  
>>>>>> were f.root  data then  I would be very impressed.  Because the  
>>>>>> data would  show a  significant decrease in error traffic.   
>>>>>> That would be  amazing.  In  fact the data looks alot like that  
>>>>>> I have seen for  public roots I  have setup.  Like the one now  
>>>>>> used in Turkey.
>>>>>>
>>>>>> However this is data from the L.root run by ICANN and i'm not  
>>>>>> so   amazed anymore.  I speculate this is just a little bit of  
>>>>>> ICANN   nonsense designed to once again mislead the public.   
>>>>>> Shame.
>>>>>>
>>>>>> queries  received at the root servers.  Only percentages are  
>>>>>> used  in the  metrics.  The articles I wrote
>>>>>>
>>>>>> messages.   This data was obtained from f.root.  f.root is one  
>>>>>> of  the oldest  roots on the net while l.root is one of the  
>>>>>> newest.   In fact if as  per the ICANN blog this data was  
>>>>>> collected on  November 26 then it  would of come from IP  
>>>>>> 199.7.83.42 that was  implemented on 1  November 2007 and  
>>>>>> 198.32.64.12.  In any case what is certain is that both  
>>>>>> versions  of  the L.root run by ICANN are very new and that  
>>>>>> means the  amount of  traffic to them would be very low in  
>>>>>> comparison to  f.root - which  in my opinion provides a more  
>>>>>> accurate reflection  of traffic  patterns on the net.
>>>>>>
>>>>>> impact  of Karl, "boutique" TLDs?  The answer in this case  
>>>>>> would  be NO.  It  is however reflective of the data one would  
>>>>>> associate  with a  recently launched root server that few  
>>>>>> people are yet  dependent on.
>>>>>>

---

From: John Crain <[email-masked]>
Date: Tue, 27 Nov 2007 14:35:29 -0800

hi Joe

John L. Crain
Chief Technical Officer
I.C.A.N.N.

---

From: Peter Koch <[email-masked]>
Date: Wed, 28 Nov 2007 10:55:44 +0100

> So clearly a lot of folks still need to up date their hints files :(

part of that traffic will be due to old hints files, but priming was
actually supposed to accelerate the migration.  40% of total L traffic
seems a bit much for 1/13 of the priming traffic?

-Peter

---

From: Peter Koch <[email-masked]>
Date: Wed, 28 Nov 2007 10:55:44 +0100

-Peter

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 28 Nov 2007 11:12:02 +0100

On Wed, Nov 28, 2007 at 10:55:44AM +0100,
 Peter Koch <[email-masked]> wrote 
 a message of 16 lines which said:

> actually supposed to accelerate the migration.

Do all resolvers actually perform priming? BIND does but the others?

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 28 Nov 2007 11:12:02 +0100

---

From: bert hubert <[email-masked]>
Date: Wed, 28 Nov 2007 12:19:08 +0100

> seems a bit much for 1/13 of the priming traffic?

There is a bug in all current PowerDNS recursor versions where it neglects
to erradicate the contents of the hints file from its cache.

This means that both the old and the new IP address of l.root-servers.net
will continue to be used, until the hints file expires from the cache, which
is sadly only after 40 days of uptime.

I apologise for this bug, and promise that a fixed PowerDNS recursor will be
released swiftly.

However, I don't think 40% of the world is running the PowerDNS Recursor, so
there must be something else to blame, as well.

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

---

From: bert hubert <[email-masked]>
Date: Wed, 28 Nov 2007 12:19:08 +0100

Bert

---

From: Ralf Weber <[email-masked]>
Date: Wed, 28 Nov 2007 12:41:40 +0100

Moin!

> Do all resolvers actually perform priming? BIND does but the others?
According to http://www.icann.org/committees/security/sac017.htm most  
do.
But isn't priming only done at startup? And how often do people start
there nameservers? This could be the cause.

So long
-Ralf
---
[email-masked]

---

From: Ralf Weber <[email-masked]>
Date: Wed, 28 Nov 2007 12:41:40 +0100

Moin!

So long
-Ralf
---
[email-masked]

---

From: Matt Larson <[email-masked]>
Date: Wed, 28 Nov 2007 10:58:17 -0500

> seems a bit much for 1/13 of the priming traffic?

Why old root server IP addresses recieve so much traffic is a great
mystery and has been for several years.  We addressed this in 2004 in
the "Life and Times of J-root" presentation for NANOG 32:

  http://www.nanog.org/mtg-0410/pdf/kosters.pdf

Note that at the time, I fingerprinted the responsive queriers and
many were late-model BIND, all of which are known to prime.

As I write this, J root's old IP address is receiving 1000 queries per
second and that's over five years after we changed its address.
Perhaps this is some sort of DNS equivlanet to cosmic background
radiation, dating back the beginning of the Internet?

Matt

---

From: Matt Larson <[email-masked]>
Date: Wed, 28 Nov 2007 10:58:17 -0500

Matt

---

From: [email-masked]
Date: Wed, 28 Nov 2007 16:07:59 +0000

> radiation, dating back the beginning of the Internet?

	and perhaps more interesting, the old address for "B"
	showed a tapering off of traffic and then an INCREASE
	last year.   Old L and J got their numbers less than a
	decade ago.  ...  so i would not go back as far as the
	begining of the Internet.  Old B has been around for quite
	a while longer.

--bill

---

From: [email-masked]
Date: Wed, 28 Nov 2007 16:07:59 +0000

--bill

---

From: bert hubert <[email-masked]>
Date: Wed, 28 Nov 2007 17:15:59 +0100

> 	begining of the Internet.  Old B has been around for quite

The most likely explanation appears to be a bug like that found in PowerDNS,
where the hint-IP address is not removed in favour of more current data.

The increase in traffic might easily be due to more favourable connectivity
to 'B', which would lead many resolver implementations to shift more queries
to it.

	Bert

---

From: bert hubert <[email-masked]>
Date: Wed, 28 Nov 2007 17:15:59 +0100

Bert

---

From: [email-masked]
Date: Wed, 28 Nov 2007 16:22:41 +0000

> to 'B', which would lead many resolver implementations to shift more queries

	old "B" topolgy didnt change... :)

--bill

---

From: [email-masked]
Date: Wed, 28 Nov 2007 16:22:41 +0000

--bill

---

From: bert hubert <[email-masked]>
Date: Wed, 28 Nov 2007 17:28:47 +0100

> 	old "B" topolgy didnt change... :)

Admittedly, you have a far better view of the internet than I do :-) - But
I'm not ruling out changes *other* people made to their networks.

Also, perhaps the other roots just became less attractive.

	Bert

---

From: bert hubert <[email-masked]>
Date: Wed, 28 Nov 2007 17:28:47 +0100

Bert

---

From: [email-masked]
Date: Wed, 28 Nov 2007 16:34:45 +0000

> Also, perhaps the other roots just became less attractive.

	the increase in queries occured after we stopped running
	a nameserver on the address and more than a year after 
	the public announcement and change in the hints files.

	not saying other topology change didn't have the effects
	you describe, it just seems odd.

--bill

---

From: [email-masked]
Date: Wed, 28 Nov 2007 16:34:45 +0000

--bill

---

From: Joe Baptista <[email-masked]>
Date: Wed, 28 Nov 2007 13:45:58 -0500

>	old "B" topolgy didnt change... :)
hmm.  very demure, and i mean that in a coyly decorous sober sort of way.

i've have an ip range that had roots running on it since the days of the 
ORSC.  those roots to this day get traffic.  Lots of DNS traffic across 
all the range numbers used for root service.  And I have taken extreme 
steps to drop this traffic - including interception, I basically sent 
all traffic to one box, and even that did not stop the traffic.  Alot of 
programs out in the wild running on automation without any human 
supervision whatsoever.

what is really strange is that icann and the community have not learned 
from this and continue to replace root IP numbers in what is a static 
root system.

indeed very demure mr manning.

cheers
joe baptista

---

From: Joe Baptista <[email-masked]>
Date: Wed, 28 Nov 2007 13:45:58 -0500

cheers
joe baptista

---

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Wed, 28 Nov 2007 10:50:52 -0800

At Wed, 28 Nov 2007 10:55:44 +0100,

> seems a bit much for 1/13 of the priming traffic?

BIND9 also uses the root hint when it finds necessary glue is
missing.  For example, consider the following delegation:

child.foo.example.  NS 86400 ns.child.foo.example.
ns.child.foo.example. A 3600 192.0.2.1

When the (recursive) resolver first visits the child.foo.example zone,
it caches both the NS and A records.  The glue (A) record will expire
in 1 hour.  When the resolver tries to visit the zone after that while
still keeping the NS record, it tries to fetch the missing glue from
the root using the hint file, regardless of whether it has the root NS
and the root server addresses in its cache.

This would be another reason for the queries to the old L-root
address, though I don't think it makes the 40% of total traffic unless
the vast majority of hint files aren't updated.

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]

---

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Wed, 28 Nov 2007 10:50:52 -0800

JINMEI, Tatuya

---

From: Joe Baptista <[email-masked]>
Date: Wed, 28 Nov 2007 14:02:25 -0500

Yes - many questions and few answer and very little data available for 
the community to figure out those answers. John Crain should publish 
stats more often. Why indeed does root behave so strangely. That little 
40 percentage thingy indeed does raise alotof questions. John can you 
speculate for us? Whats going on.

Another very interesting thing is the incredible power behind one IP 
number when it has experienced root activity. It only takes one rogue 
root to highjack the entire root system. Its been done twice now in 
internet history. How is that possible?

regards
joe baptista

---

From: Joe Baptista <[email-masked]>
Date: Wed, 28 Nov 2007 14:02:25 -0500

regards
joe baptista

---

From: John Crain <[email-masked]>
Date: Wed, 28 Nov 2007 11:44:55 -0800

Speculation is all it is and I probably have no better ideas than many  
folks here. Be better to try and figure out what is really happening...

I think this is just a knock on effect from the fact that many folks  
don't keep their systems up to date, especially smaller networks.
Typically they turn something on and just leave it until it stops  
working. Just like they don't update any other software if it isn't  
done for them automatically.

That shouldn't come as a surprise to anyone.

It's nice to think that resolvers will automatically fix themselves  
when priming but I think the stats show this not to be solving the  
issue.

It's too early from the L-root perspective to really see what is  
happening. Less than a month since renumbering, long term trends will  
be more interesting.
We'll start to analyze some of the big hitters on the old address.  
Once we have some long term data I will publish something.

Luckily the folks who gave us DSC made it easy for me to do just that.

Big thanks to Duane and co!!!

John L. Crain
Chief Technical Officer
I.C.A.N.N.

On 28 Nov 2007, at 11:02, Joe Baptista wrote:

> Yes - many questions and few answer and very little data available  
> for the community to figure out those answers. John Crain should  
> publish stats more often. Why indeed does root behave so strangely.  
> That little 40 percentage thingy indeed does raise alotof questions.  
> John can you speculate for us? Whats going on.
>
> number when it has experienced root activity. It only takes one  
> rogue root to highjack the entire root system. Its been done twice  
> now in internet history. How is that possible?
>
> regards
> joe baptista
>

---

From: John Crain <[email-masked]>
Date: Wed, 28 Nov 2007 11:44:55 -0800

John L. Crain
Chief Technical Officer
I.C.A.N.N.

---

From: Joe Baptista <[email-masked]>
Date: Wed, 28 Nov 2007 15:22:27 -0500

John Crain wrote:

>
> Speculation is all it is and I probably have no better ideas than 
> many  folks here. Be better to try and figure out what is really 
> happening...
>

No it does not.  That in fact is a big problem.  I used to do scans of 
DNS servers over the years.  And one interesting thing I have found is 
there are still servers out there using the very old legacy roots.  When 
they had five root servers.

I think because of the fact that what you say above is so true - people 
install dns and then forget it - then maybe it is time for ICANN to 
consider a root policy that goes something like this - to have a stable 
internet you don't go around changing your roots ip numbers.

I look forward to more reports and data sharing from L root.  But to be 
frank it would be alot of fun to see that same data compared to data 
from f.root.  f.root is a true legacy root system.  I think it's been 
around from the beginning and may be an excellent comparison to the 
progress of the L root fragmentation.

cheers
joe baptista

---

From: Joe Baptista <[email-masked]>
Date: Wed, 28 Nov 2007 15:22:27 -0500

cheers
joe baptista