I suspect legit qdcount > 0 queries on the global internet are nonexistent, since the answers are alway wrong. :)
On Thu, 23 Feb 2023 at 17:53, Jim Reid <[email protected]> wrote: > > > > On 23 Feb 2023, at 22:36, Ted Lemon <[email protected]> wrote: > > > > How much DNS traffic is even still inspectable these days? > > Depends on the definition of DNS traffic Ted. DNS-OARC has many TB of > pcaps and query logs from the DITL project. Whether that data could be good > enough to meaningfully measure the incidence of QDCOUNT>1 in the real world > is anyone’s guess. I suppose it’ll be difficult (and very subjective) to > distinguish between “real” QDCOUNT>1 queries and the ones from junk > implementations that are just part of the DNS’s background noise. > >
_______________________________________________ DNSOP mailing list [email protected] https://www.ietf.org/mailman/listinfo/dnsop
