On Jan 28, 2014, at 2:16 PM, Jared Mauch <ja...@puck.nether.net> wrote:
> > On Jan 28, 2014, at 1:50 PM, valdis.kletni...@vt.edu wrote: > >> On Tue, 28 Jan 2014 08:06:31 -0500, Jared Mauch said: >> >>> 52731 ASN7922 >> >>> It includes IP address where you send a DNS packet to it and another IP >>> address responds to the query, e.g.: >> >>> The data only includes those where the “source-ASN” and “dest-asn” of these >>> packets don’t match. >> >> Hang on Jared, I'm trying to wrap my head around this. You're saying that >> AS7922 has over 50K IP addresses which, if you send a DNS query to that IP, >> you get an answer back from *an entirely different ASN*? How the heck does >> *that* happen? > > Yup. > >> Hmm.. Comcast. Anybody over there have an explanation what's going on there? So I owe an apology to Comcast for a few things here.. Thanks to a few people (Tony Tauber, Aaron Hopkins) I found an error in one of the scripts that decodes the “encoded” dns query name. It was misprocessing some data and it resulted in the 73.73.73.73 IP address occurring when it should not have. This IP maps to Comcast and resulted in wrong data here. This also means I need to go back and reprocess all the old data to correct for this constraint problem. (that should take awhile …) Once again, sorry to Comcast for this. Their numbers should be much lower. - Jared
