<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Hello again BIND-users,</div><div class=""><br class=""></div><div class="">Sorry for asking for help twice in one day.</div><div class=""><br class=""></div><div class="">We are setting up a new resolver performance test bed, one that we hope will be a better simulation of real-world deployment. Once we have this working, we should be able to profile BIND performance using DoH and DoT as well as Do53. We are using the DNS Shotgun tool for this purpose. (<a href="https://dns-shotgun.readthedocs.io/en/stable/" class="">https://dns-shotgun.readthedocs.io/en/stable/</a>)</div><div class=""><br class=""></div><div class="">Anyway, we need to feed this test bed with some PCAPS. We have only a few samples right now, and if we could get a few more, our test bed would be more representative of the actual Internet.</div><div class=""><br class=""></div><div class="">We don’t want to publish how to upload files to us, because that will immediately be filled with spam, so if you are willing to submit some of your resolver packet captures, please email me and I will give you instructions on where to put your file so that we can retrieve it. I have included some instructions on capturing the packets below so you can see what is involved.</div><div class=""><br class=""></div><div class="">Thank you for considering this.</div><div class=""><br class=""></div><div class="">Vicky</div><div class="">---------</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">If you are able to share some pcaps, here are some generic instructions. </span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">dnscap \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-z 192.0.2.1 \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-z 2001:db8::1 \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-i any \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-p \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-s i \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-w /output/pcap \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-C 1073741824 \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-k 'xz -9' \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-B '2021-01-08 11:40:00' \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-E '2021-01-08 21:40:00' \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-S \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-6 \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-P /usr/lib/dnscap/anonaes128.so \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-4 \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-K /dev/urandom \</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-I /dev/urandom</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">Explanation:</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">dnscap - </span><span class="clickylink" style="font-family: arial, helvetica, sans-serif; font-size: 13px;"><a target="_blank" href="https://www.dns-oarc.net/tools/dnscap" style="color: rgb(102, 102, 102); text-decoration: none;" class="">https://www.dns-oarc.net/tools/dnscap</a></span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-z # IP address of the DNS resolver uses to receive client queries, duplicate -z if it has more IP addresses - this is crucial to filter queries from BIND itself to the Internet</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-i any # network interface name receiving client queries ("any" should be fine so they do not need to bother with explicit names)</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-p # ask for interface not be put into promiscuous mode, it's not needed as we capture only the traffic directed to this server</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-s i # capture only queries but not answers (thus</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">making the output file smaller) - has to be combined with -z above</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-w # output file name base</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-C # maximum individual file size in bytes, 1 GB recommended</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-k 'xz -9' # compression command, feel free to change</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-B -E # starts/stops capture times, please do not forget to modify</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-S # print statistics, optional</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-6 # enable IPv6 support, omit for dnscap version 2.0.0 and newer</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-P -4 ... # anonymizing IPv6 and also IPv4 addresses using random AES key, i.e. key is forgotten when process exits</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">A good sample size is 10 hours but shorter samples can be also useful, we can eventually combine samples from multiple submitters.</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">Bonus points if we can get the command running in parallel on multiple servers, e.g. on 10 servers for 1 hour, or 5 servers for 2 hours, etc.</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">If running on multiple servers please replace</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-K /dev/urandom -I /dev/urandom</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">with</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-k putrandomkeyhere -i putrandomkeyhere</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">and use the same 16-character string on all servers.</span><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><br style="font-family: arial, helvetica, sans-serif; font-size: 13px;" class=""><span style="font-family: arial, helvetica, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">-k -i specify explicit anonymization keys so the same clients are anonymized in the same way across all servers. They should not tell us what values they were using during capture otherwise we could partially deanonymize the data.</span></div></body></html>