m3047 / rear_view_rpz

Turn your recursive DNS (BIND) server into a network investigation enabler with DnsTap and RPZ. Make PTR recs great again!
Apache License 2.0
12 stars 2 forks source link

Slightly more aggressive heuristic #11

Closed m3047 closed 4 months ago

m3047 commented 4 months ago

The default heuristic now attenuates the base heuristic as well as the boost. Essentially this:

<base heuristic> + <boost> / <attenuator>

is changed to this:

(<base heuristic> + <boost>) / <attenuator>

Why? Would anyone in their right mind have CNAME chains seven or eight names deep? Well I can't speak to their state of mind but yes, yes they do. It's not a huge problem but the change should clear out some names which were only seen a handful of times some days ago.

m3047 commented 4 months ago

Change is committed at 6e32b5e