> On 23 Feb 2023, at 22:36, Ted Lemon <[email protected]> wrote: > > How much DNS traffic is even still inspectable these days?
Depends on the definition of DNS traffic Ted. DNS-OARC has many TB of pcaps and query logs from the DITL project. Whether that data could be good enough to meaningfully measure the incidence of QDCOUNT>1 in the real world is anyone’s guess. I suppose it’ll be difficult (and very subjective) to distinguish between “real” QDCOUNT>1 queries and the ones from junk implementations that are just part of the DNS’s background noise. _______________________________________________ DNSOP mailing list [email protected] https://www.ietf.org/mailman/listinfo/dnsop
