singleapnic

ZombiesGeoffHustonAPNICLabsWhatwedid:RunanonlineadvertisementwithanembeddedmeasurementscriptThescriptcausedthebrowsertofetchanumberof1x1'blots'ToensurethatwehadaclearviewoftheactionsoftheuserandtheDNSresolverstheyuse,weuseduniqueURLlabels.
AdImpressionsperDayWearecurrentlyservingsome8MAdimpressionsperdayURLLoadWearegeneratingsome24millionDNSqueriesfor"unique"DNSnamesperdayAndsimilarlyperformingsome24millionHTTPblotfetchesfor"unique"URLsperday"Unique"Whatismeantby"unique"TheDNSnameisqueriedbyasingleendpointonceandonlyonce(*)–neveragain!
(Andthenameincludesasubfieldofthetimeitwascreated)TheTTLoftherecordis1secondTheURLfetchisperformedbyasingleendpointonceandonlyonce–andneveragain!
Whichmeansthatweshouldseeonequeryforthenameattheauthoritativenameserver*Wellnotquite,25%ofthetimeitsqueriedtwice,andsometimesmore,butitsalltriggeredbyasingleresolutionactioninitiatedbytheendpoint–allthesequeriesareclusteredtogetherintimeWhatdowesee1450151673.
887[x]15-Dec-2015query:z.
t10000.
u953a6ea5.
s1448087430.
i5112.
vxxxx.
06ca0.
z.
dotnxdomain.
netA1450151673.
887[x]15-Dec-2015query:z.
t10000.
uc86fd1d9.
s1447672979.
i5112.
vxxxx.
3b460.
z.
dotnxdomain.
netA1450151673.
887[x]15-Dec-2015query:z.
t10000.
ub46e3821.
s1447703026.
i5112.
vxxxx.
0c914.
z.
dotnxdomain.
netA1450151674.
013[x]15-Dec-2015query:z.
t10000.
u953a6ea5.
s1448087430.
i5112.
vxxxx.
06ca0.
z.
dotnxdomain.
netA1450151674.
015[x]15-Dec-2015query:z.
t10000.
ub46e3821.
s1447703026.
i5112.
vxxxx.
0c914.
z.
dotnxdomain.
netA1450151674.
017[x]15-Dec-2015query:z.
t10000.
uc86fd1d9.
s1447672979.
i5112.
vxxxx.
3b460.
z.
dotnxdomain.
netA1450151674.
753[x]15-Dec-2015query:z.
t10000.
u953a6ea5.
s1448087430.
i5112.
vxxxx.
06ca0.
z.
dotnxdomain.
netA1450151674.
755[x]15-Dec-2015query:z.
t10000.
uc86fd1d9.
s1447672979.
i5112.
vxxxx.
3b460.
z.
dotnxdomain.
netA1450151674.
756[x]15-Dec-2015query:z.
t10000.
u953a6ea5.
s1448087430.
i5112.
vxxxx.
06ca0.
z.
dotnxdomain.
netA1450151674.
757[x]15-Dec-2015query:z.
t10000.
ub46e3821.
s1447703026.
i5112.
vxxxx.
0c914.
z.
dotnxdomain.
netAWhatdowesee1450151673.
887[x]15-Dec-2015query:z.
t10000.
u953a6ea5.
s1448087430.
i5112.
vxxxx.
06ca0.
z.
dotnxdomain.
netA1450151673.
887[x]15-Dec-2015query:z.
t10000.
uc86fd1d9.
s1447672979.
i5112.
vxxxx.
3b460.
z.
dotnxdomain.
netA1450151673.
887[x]15-Dec-2015query:z.
t10000.
ub46e3821.
s1447703026.
i5112.
vxxxx.
0c914.
z.
dotnxdomain.
netA1450151674.
013[x]15-Dec-2015query:z.
t10000.
u953a6ea5.
s1448087430.
i5112.
vxxxx.
06ca0.
z.
dotnxdomain.
netA1450151674.
015[x]15-Dec-2015query:z.
t10000.
ub46e3821.
s1447703026.
i5112.
vxxxx.
0c914.
z.
dotnxdomain.
netA1450151674.
017[x]15-Dec-2015query:z.
t10000.
uc86fd1d9.
s1447672979.
i5112.
vxxxx.
3b460.
z.
dotnxdomain.
netA1450151674.
753[x]15-Dec-2015query:z.
t10000.
u953a6ea5.
s1448087430.
i5112.
vxxxx.
06ca0.
z.
dotnxdomain.
netA1450151674.
755[x]15-Dec-2015query:z.
t10000.
uc86fd1d9.
s1447672979.
i5112.
vxxxx.
3b460.
z.
dotnxdomain.
netA1450151674.
756[x]15-Dec-2015query:z.
t10000.
u953a6ea5.
s1448087430.
i5112.
vxxxx.
06ca0.
z.
dotnxdomain.
netA1450151674.
757[x]15-Dec-2015query:z.
t10000.
ub46e3821.
s1447703026.
i5112.
vxxxx.
0c914.
z.
dotnxdomain.
netAThetimethattheadwascreated!
2015-11-2106:30:302015-11-1611:22:592015-11-1619:43:462015-11-2106:30:302015-11-1619:43:462015-11-1611:22:592015-11-2106:30:302015-11-1611:22:592015-11-2106:30:302015-11-1619:43:462015-12-1503:54:33querytimeWhatdowesee1450151673.
887[x]15-Dec-2015query:z.
t10000.
u953a6ea5.
s1448087430.
i5112.
vxxxx.
06ca0.
z.
dotnxdomain.
netA1450151673.
887[x]15-Dec-2015query:z.
t10000.
uc86fd1d9.
s1447672979.
i5112.
vxxxx.
3b460.
z.
dotnxdomain.
netA1450151673.
887[x]15-Dec-2015query:z.
t10000.
ub46e3821.
s1447703026.
i5112.
vxxxx.
0c914.
z.
dotnxdomain.
netA1450151674.
013[x]15-Dec-2015query:z.
t10000.
u953a6ea5.
s1448087430.
i5112.
vxxxx.
06ca0.
z.
dotnxdomain.
netA1450151674.
015[x]15-Dec-2015query:z.
t10000.
ub46e3821.
s1447703026.
i5112.
vxxxx.
0c914.
z.
dotnxdomain.
netA1450151674.
017[x]15-Dec-2015query:z.
t10000.
uc86fd1d9.
s1447672979.
i5112.
vxxxx.
3b460.
z.
dotnxdomain.
netA1450151674.
753[x]15-Dec-2015query:z.
t10000.
u953a6ea5.
s1448087430.
i5112.
vxxxx.
06ca0.
z.
dotnxdomain.
netA1450151674.
755[x]15-Dec-2015query:z.
t10000.
uc86fd1d9.
s1447672979.
i5112.
vxxxx.
3b460.
z.
dotnxdomain.
netA1450151674.
756[x]15-Dec-2015query:z.
t10000.
u953a6ea5.
s1448087430.
i5112.
vxxxx.
06ca0.
z.
dotnxdomain.
netA1450151674.
757[x]15-Dec-2015query:z.
t10000.
ub46e3821.
s1447703026.
i5112.
vxxxx.
0c914.
z.
dotnxdomain.
netAQueryTimeCreationTimeDiff==ZombieTime!
OneDay,OneDNSServerOneDay,OneDNSServer60Days,AllDNSServers60Days,AllDNSServers50%ofallzombiequeriesaremorethan6monthsold!
ZombieRepeatsperdayZombieRepeatsperday1queryevery3seconds!
ZombieRepeatsperdayZombieRepeatsperday2/3ofallqueriesoccuronceperdayDoZombieshavea32"hours"perdayWhatiscausingthisIsthistheresultofacollectionofderangedDNSrecursiveresolverswithanobsessionaboutneverforgettingathingOrwebproxiesthatjusthavetoomuchtime(andspace)ontheirhandsandwanttofillallthatspacewithavastcollectionofidentical1x1pixelgifsLet'slookatwebzombies…ZombieURLAgeDistributionZombieURLAgeDistribution50%ofallzombieURLsarelessthan4daysoldZombieURLRepeatsDNSvsURLsDNSzombiesarelivingtheirownzombiehalflife!
TheyarenotthehellspawnofzombieURLS!
ZombiesItseemsthatontheInternetverylittleisallowedtobeforgottenWecanusethis…DNSasstorageWrite(index,data)query="data.
index.
storage"foreachi(0.
.
100){digINAquery;}DNSasstorageWrite(index,data)query="data.
index.
storage"foreachi(0.
.
100){digINAquery;}Read(index)wait(query,"index.
storage")returndataDNSasstorageWrite(index,data)query="data.
index.
storage"foreachi(0.
.
100){digINAquery;}Read(index)wait(query,"index.
storage")returndataDelete(index)print("I'msorryDave,Ican'tdothat")Thanks!