zxlin
commented
8 years ago - Rule 1 - Invalid class
- Rule 2 - Invalid top level domain in query (ignore root zone queries)
- Rule 3 - Invalid top level domain in query
- Rule 4 - Domain name contains non-printable characters
- Rule 5 - Domain name contains underscore '_' character
- Rule 6 - PTR query for IP address from private address space (RFC 1918)
TODO: Rules 7, 8, 9
Analysis - Traffic Validity
Determining the amount of valid/invalid traffic for the both the new and old IP address, before and after the old server started announcing the new IP address. In addition, for any invalid traffic breaking the TLD rule (3), we keep track of the number of infractions for each unique TLD.
I am basing the rules on valid/invalid traffic from the papers "A Day at the Root of the Internet" (SIGCOMM 08) and "Wow, That's a Lot of Packets" (PAM 03). The rules are in sorted order of priority in the structure below, meaning that we attribute only 1 invalidation reason to each query.