name-collision-02aug13-en

However this argument overlooks what is practical. Firstly, it is unlikely that all of the
participating root server operators could contribute one week or one month of pcap data to
OARC. Some would not. So the data for a longer data gathering interval would probably come
from a smaller number of RSOs, raising further concerns about the “completeness” of the data
set. Even if all of the RSOs were able to supply data over a longer interval, it could take weeks or
even months to get those pcaps to DNS-OARC. There would also be the obvious capacity
problems for DNS-OARC in storing hundreds of terabytes, perhaps petabytes, of what would
then become a Month in the Life of the Internet exercise. Finally, it would take many CPUmonths
to process so much data and this would require a very substantial investment in tooling
and hardware.
There was also a short discussion about the data-gathering interval between members of the
study team and the participating root server operators. There was a consensus that the 2–3 day
DITL interval was a reasonable compromise given there was a broadly representative set of
participating RSOs and this gave every edge device or resolving server a fair opportunity of
appearing in the root server traffic. It was also noted that a longer data gathering interval could
skew the results because traffic patterns could get counted twice (or more) as devices moved
around the Internet: for example, a smartphone that issues the same set of queries each time it
connects and disconnects or changes networks.
4.3.6 Geographical limitation
Another reasonable criticism would be that there has been no geolocation analysis of the
observed traffic. The objective of gathering source address prefix information for each new
gTLD was to assess how widely spread the sources were, not their actual geographic location.
The goal was to find out if traffic for .whatever was localized or spread across the Internet.
To that extent, the specific physical locations from which the traffic originated did not matter
much. If traffic for a new gTLD was found to be coming mostly from a small number of
prefixes, that would have been worthy of deeper analysis. However very few of the proposed
TLD strings found in the root server traffic match that criterion. None of the most heavily used
strings does.
In addition, the impact of resolving servers and their caches makes it very difficult to draw
meaningful conclusions about where traffic actually originates. For instance, a device on a
corporate network at a site in Asia might be making DNS lookups via the company firewall in
Australia. Similarly, a device in Africa might be using a global resolver provider and it is a node
in that provider’s network in Europe, which queries a root server instance in North America.
This might be a topic for further study.
Name Collision Study Report Page 44
Version 1.5 2013.08.02