Submitted by admin on Thu, 06/04/2009 - 17:49

Collection Period

DITL 2009 took place from March 30 — April 1. We collected for 72 hours this year, whereas in previous years it has been for 48 hours. Initially we planned to collect data only on March 31 and April 1. When we learned that the Conficker worm was scheduled to "wake up" on April 1, we decided to start the collection a day early to get a 24 hour period without Conficker activity. The call for participants is here.

Data Contributors

Contributor Data
Afilias .SE, .ORG, .INFO, AS112
APNIC in-addr.arpa
ARIN in-addr.arpa
ARL H-root
Gigafeed.net AS112
Cogent C-root
CZ.NIC .CZ
ICANN L-root
IIS .SE
ISC F-root, ns-ext.isc.org
LACNIC in-addr.arpa
NaMeX AS112
NASA E-root
Nethelp.no .NO, recursive
NIC Chile .CL
nix.cz AS112
Nominet .UK
Packet Pushers recursive
Registro.BR .BR
RIPE K-root
Switch .CH, .LI, .AR, .PY, .LU, .CAT, .AERO
tix.or.tz AS112
UNINETT .NO
VeriSign A-root
WIDE M-root, AS112

Coverage Maps

Raw Data

Cleaned Data

Data Quality Problems

There is some lost data for A-root on March 30. The ARIN data does not start until 12:00 Noon on April 1. The C-root FRA1B node experienced an outage, but its load was automatically shifted over to the FRA1A node. The F-root PAO1 node collected only DNS responses. Afilias lost some data between 04:00 and 11:40 on March 31, which they replaced from another source. However, this led to the discovery that the data collected with dnscap was at a lower than expected rate. After additional investigation, we concluded that when dnscap was configured to collect from multiple network interfaces, it would sometimes lose packets. Nethelp, SWITCH, and Gigafeed.net also noted that they configured dnscap to collect from multiple interfaces and therefore may have lost some packets.

Access To Data

DNS-OARC members can acess DITL data on the OARC analysis server. Please contact the OARC Admin for more information.