IPV4 Address Space in DNSDB
Aggregating Cache Miss Counts for the Entire Internet IPv4 Address Space
It is DomainTools mission to “map the Internet to detect and predict emerging threats.” DomainTools previously reported on IPv4 addresses seen at least once in Farsight DNSDB in 2017, but in this White Paper, we update and extend the earlier study to focus on the aggregated cache miss counts associated with each /24 netblock for the entire Internet IPv4 space.
In reviewing the results, we identify some /24 netblocks with unusually large aggregate counts – aggregate cache miss counts in excess of 175 billion. We dig in on some of those “heavy hitters,” reporting on the domains that appear to be most heavily contributing to those huge cache miss counts. At the other end of the cache miss “aggregate count spectrum,” we find that over 75% of all /24 netblocks have aggregate cache miss counts of 100 or less.
Violin plots and individual Hilbert curves are provided for each /8 for those who may wish to dig in more deeply.This report also introduces and demonstrates the value of improvements to query meta-data reporting in the company’s command line client, dnsdbq, when dnsdbq is used for bulk queries.
