[rssac-caucus] [Non-DoD Source] FOR REVIEW: DRAFT RSSAC002 Version 2

[Jaap Akkerhuis]

 Steve Sheng writes:

 > Among other things
 
 
 > Attached please find the latest document incorporating these changes.
 > The deadline to review is still close of business Monday 23 November. 

Triggered by questions from some people i had good look at the
examples given. These seem to be made up and it shows. Example 4.3
"The `traffic volume' Metric" shows that there a total of 42447
requests while there where 148013 responses. That seems odd to me.
Especially since the example 4.6 "The `unique sources' Metric" says
that the responses should come from 2086124 ipv4 and 42941 ipv6
adresses. That seems very odd to me. Maybe we should change the
examples to some actual (public available) data?

BTW, the questions I got was whether there was any idea how accurate
the RSSAC 002 numbers are. QUite often one sees that there are less
responses then requests. This can of course come from dropped requests
(rate limiting stuff etc.) but the reverse, more responses then
request have also been seen. For UDP at a.root:
<http://a.root-servers.org/rssac-metrics/raw/2015/11/traffic-volume/a-root-20151101-traffic-volume.yaml>
(and days after that). For TCP, see
<https://www-static.ripe.net/dynamic/rssac002-metrics/2015/04/traffic-volume/k-root-20150401-traffic-volume.yaml>.
One wonders how this can happen. Any idea? A suggestion was made that
the actual answer/response packets where counted instead of DNS
query/responses and fragmentation happened but that seems odd to me.

Anyway, I woud still advice that for the new version of the dpocument
some real data for the examples will be used. And of course, some
answer to the questions asked will be appreciated.

Regards,

	jaap