On 31.08 14:47, Brian E Carpenter wrote:
That is about 1/3 of the total. It doesn't surprise me at all that
so many bogus queries arrive - everybody who mistypes a TLD or
misconfigures a default domain generates bogus queries, and this isn't
going to change. The question is whether .local is a *significant*
part of this load. The limited data I have suggest not, but I'd like
to see publicly available data: what fraction of those NXDOMAINs are
due to .local?
I believe CAIDA has published something but I cannot find it.
I have had a quick look myself:
Cursory observation of a random sampple from 2004 which I have used for
other purporses shows that about 15% of the NXDOMAIN answers excluiding
'.arpa.' are for questions ending in .local. A further 3% are for
'localhost' and about 20% are for an IP address in dotted-quad format.
The .local queries have a high incidence of labels beginning with
an underscore and often conain the string "Default-First-Site" in
various languages such as illustrated by the following examples:
SOA? _kerberos._tcp.Default-First-Site-Name._sites.capital.local
SRV? _ldap._tcp.dc._msdcs.bsztorgau.local
SOA? _kpasswd._tcp.AppliedEngineeringServices.local
SRV? _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.semaia.local
SRV?
_ldap._tcp.a9c93f95-51af-4f5d-8280-1171e79176c4.domains._msdcs.Netcare.local
SOA?
_ldap._tcp.Standardname-des-ersten-Standorts._sites.gc._msdcs.VESTERBERG.local
SOA? _kerberos._tcp.Nombre-predeterminado-primer-sitio._sites.d1asib03.local
SRV? _ldap._tcp.Premier-Site-par-defaut._sites.dc._msdcs.production.local
SOA? _kerberos._udp.Christ.local
SRV? _ldap._tcp.dc._msdcs.production.local
SRV?
_ldap._tcp.3b6c4c19-2d29-4ed0-9915-b7b43f3488e3.domains._msdcs.datalog.local
SOA? _kpasswd._udp.tae.local
SOA? _ldap._tcp.Default-First-Site._sites.gc._msdcs.ufficio-tecnico.local
Preventing an increase of this nonsense from getting worse or even reducing
it is a worthy cause because root servers can use all the headroom they can
get.
Note that this is only an random sample and as such is just an indication
of what is happening. It should be considered not more than anecdotal evidence.
Note also that I do not read the ietf list.
Daniel
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/ietf