Universität Bielefeld - Technische Fakultät - Rechnerbetriebsgruppe - DNS-Survey

Seeing DNS AXFR Requests from 129.70.132.4?


Have you ever wondered why you're constantly seeing DNS AXFR, (that is: zone transfer) requests from the IP address 129.70.132.4 at the beginning or end of the month? Depending on the software version you use and its configuration the log entries will look similar to these:

named[1234]: denied AXFR from [129.70.132.4].54321

named[1234]: approved AXFR from [129.70.132.4].55443

We are responsible for operating a machine with that IP address 129.70.132.4. Once every month we traverse the DNS tree starting at the German top level domain DE. The zone is examined and all delegated zones are also transferred and inspected and so forth recursively until a zone does not have any descendants (which is true for the majority of 2nd level domains already).

The main purpose of the hostcount is to do just that: answer the question How many hosts are there? Due to some limiting factors the number isn't too accurate but still shows the net growth.

Then, the collected data is also searched for common configuration habits or even mistakes. Occasionally the zone administrators will be informed about errors we've found. Some of the results have served as a basis for operational recommendations (RIPE 203, Recommendations for DNS SOA Values). Finally, they can be used to follow the deployment of certain DNS resource record types.

The collected data is used for research purposes only and not made public. It is handed over to the RIPE NCC in Amsterdam for archival purposes and further research. Check their (non-)disclosure policy for details.

If you would like to contribute to the further success you are invited to open AXFR on your nameserver(s) for the IP address already mentioned: 129.70.132.4. This address has been in use for a couple of years now and will most likely be stable in the near future. We would appreciate your support.

For further information please see the FAQ list or contact hostmaster at TechFak.Uni-Bielefeld.DE.


Peter Koch, 2002-04-15