Passive Measurements of Global Internet Topology Changes

or

Monitoring nameservers: what can we learn from ccTLDs?

Nevil Brownlee, CAIDA / The University of Auckland
     / RUS, Rechenzentrum Universität Stuttgart

ISMA, Leiden, October 2002


  1. Overview

    • Earlier (root/gTLD) Work
    • ccTLDs: How do they Differ from root/gTLDs?
    • How can one measure ccTLDs with NeTraMet?
    • Collecting/Analysing ccTLD Data
    • DNS RTT and transactions by country
    • DNS RTT variation during a week
    • RTT variation for Multi-ccTLD servers
    • Summary

  2. Earlier (root/gTLD) work: Meter sites

    • Use NeTraMet meter, with rulesets to match DNS req/response packet pairs
    • SDSC-UCSD, December 2001, showing UCSD meter

    • Setup at SJC, August 2002
      • PC installed at busy POP in SJC, running NeTraMet meter
      • OC48 link being metered, using two Dag4 cards
      • Dual pentium processors, 1.6 GHz
      • Multi-threaded NeTraMet can (just) keep up with about 150 kp/s

  3. Earlier work: root/gTLD Performance web page

    • http://www.caida.org/cgi-bin/dns_perf/main.pl
    • Data from UCSD and SJC, updated each day
    • Traffic mixes different at SJC and UCSD
    • Sample plots: roots 0921-7


    • Sample plots: gTLDs 0921-7



  4. ccTLDs: How do they Differ from root/gTLDs?

    • Roots and gTLDs have fixed IP addresses and known physical locations
    • We use a fixed (hand-coded) ruleset
    •    if DestPeerAddress == A_ROOT
            { store FlowKind :=  1;  store FlowClass := 0; }
         else if DestPeerAddress == B_ROOT
            { store FlowKind :=  2;  store FlowClass := 0; }
         ...
         else if DestPeerAddress == A_GTLD
            { store FlowKind :=  1;  store FlowClass := 1; }
         ...
      
    • ccTLDs have neither. Each ccTLD administrator can choose
      • How many servers
      • Where (ISP, physical) they will be

  5. How can one measure ccTLDs with NeTraMet?

    • Look in the packet headers for cc domain names?
      • Can't. Not enough bytes
    • Do zone ransfer from a root server?
      • Would have to arrange that with server operator
    • Indirect Method, used for this study:
      • Get list of country codes from web
      • Make dig input file to query the country domains
      • Run dig to get cc domain info from a root server
      • ...
        @b.root-servers.net BW
        @b.root-servers.net BV
        @b.root-servers.net BR
        @b.root-servers.net IO
        @b.root-servers.net BN
        ...
        

  6. What do we get from dig?

    • Result for br, Brazil:
    • ; <<>> DiG 8.3 <<>> -t @b.root-servers.net BR 
      ; (1 server found)
      ;; res options: init recurs defnam dnsrch
      ;; got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 151
      ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 5, ADDITIONAL: 5
      ;; QUERY SECTION:
      ;;	BR, type = A, class = IN
      
      ;; AUTHORITY SECTION:
      BR.			2D IN NS	NS.DNS.BR.
      BR.			2D IN NS	NS1.DNS.BR.
      BR.			2D IN NS	NS2.DNS.BR.
      BR.			2D IN NS	NS3.NIC.FR.
      BR.			2D IN NS	NS-EXT.VIX.COM.
      
      ;; ADDITIONAL SECTION:
      NS.DNS.BR.		2D IN A		200.160.0.5
      NS1.DNS.BR.		2D IN A		200.255.253.234
      NS2.DNS.BR.		2D IN A		200.19.119.99
      NS3.NIC.FR.		2D IN A		192.134.0.49
      NS-EXT.VIX.COM.		2D IN A		204.152.184.64
      
      ;; Total query time: 5 msec
      ;; FROM: wallaby.caida.org to SERVER: b.root-servers.net  128.9.0.107
      ;; WHEN: Sat Aug 24 16:58:31 2002
      ;; MSG SIZE  sent: 20  rcvd: 209
      
    • Useful part is the ADDITIONAL SECTION
      • List of the country's ccTLD servers and their addresses
    • Can classify servers into various types:
      • OWN, i.e. in country's own top-level domain
      • OTHER, i.e. in some other TLD, mostly run by a Registry or ISP
    • Wrote perl script to make an SRL ruleset from dig output
    •    else ADDR_TEST 200.255.253.234  # NS1.DNS.BR.
            { SAVE_CC 30;  STORE_N 1;  OWN_CCTLD; }
         else ADDR_TEST 200.19.119.99  # NS2.DNS.BR.
            { SAVE_CC 30;  STORE_N 2;  OWN_CCTLD; }
         ...
         # cc = 1..237 country,  n = 1..N server ix,  OWN or OTHER server
      
    • Problem: SRL compiler said 'duplicate IP addresses'
      • Many countries use the same provider for ccTLD service
      • Added MULTI servers, i.e. 'multi-country' servers
    • Full ruleset has 106 multi-servers
    • NS.RIPE.NET serves 75 country-code domains

  7. Collecting/Analysing ccTLD Data

    • Run dns-cctld-full ruleset at UCSD and SJC for a week, Sat 21 Sep to 28 Sep. Look at data ...
    • Definitions:
      • rtts = Sum of 5-minute distribution for DNS request/response times
      • Transactions = Observed attempts at DNS lookup in a 5-minute interval

      •       =    pkts_to + pkts_from - rtts

      • RTT = 5-minute median for rtts, averaged over a week
      • IQR = 5-minute Inter-Quartile Range for RTTs, averaged over a week

  8. Questions to consider

    • How are requests distributed among ccTLDs at each site?
    • What differences in request distributions between UCSD and SJC?
    • How significant are Multi-country servers?
    • Do rtts differ for Own, Other and Multi servers?
    • Are there patterns in the ways ccTLDs organise their servers?
    • What do we see for daily patterns in ccTLD RTTs?
    • How do the Multi-country servers behave compared to other ccTLDs?

  9. UCSD Request Distribution
    Totals: rtt=1362514, transaction=4232696
       About 1/4 rtts compared to transactions
    
    186 countries observed (not including multi-country servers)
    Top 186 countries by nbr of rtts:
    
            rtts    %   ccd%     trans    %   ccd%  servers      Country
    
       0  545076 (40.0, 60.0)  1287643 (30.4, 69.6) 103    0 ??  Multi
       1  143859 (10.6, 49.4)   277329 ( 6.6, 63.0)   8  201 sr  Suriname
       2   99441 ( 7.3, 42.1)   142209 ( 3.4, 59.7)   6  113 kr  Korea, Republic of
       3   60680 ( 4.5, 37.7)    61274 ( 1.4, 58.2)   6  108 jp  Japan
       4   41398 ( 3.0, 34.6)    90885 ( 2.1, 56.1)   4   11 am  Armenia
       5   38277 ( 2.8, 31.8)    65012 ( 1.5, 54.5)   6   38 ca  Canada
       6   37404 ( 2.7, 29.1)    40786 ( 1.0, 53.6)   6   45 cx  Christmas Island
       7   31407 ( 2.3, 26.8)    33727 ( 0.8, 52.8)   2  169 ph  Philippines
       8   30412 ( 2.2, 24.6)    87340 ( 2.1, 50.7)   3  224 us  United States
       9   26372 ( 1.9, 22.6)    96576 ( 2.3, 48.4)   6   81 de  Germany
      10   19771 ( 1.5, 21.2)    67690 ( 1.6, 46.8)   4  106 it  Italy
      11   18997 ( 1.4, 19.8)    37566 ( 0.9, 45.9)   4   47 co  Colombia
      12   16070 ( 1.2, 18.6)    38387 ( 0.9, 45.0)   2   30 br  Brazil
      13   14233 ( 1.0, 17.5)    57520 ( 1.4, 43.7)   4   73 fi  Finland
      14   13183 ( 1.0, 16.6)    72219 ( 1.7, 42.0)   5  198 es  Spain
      15   10019 ( 0.7, 15.8)    37195 ( 0.9, 41.1)   6   21 be  Belgium
      16    9633 ( 0.7, 15.1)    64295 ( 1.5, 39.6)   6   44 cn  China
      17    9400 ( 0.7, 14.4)    38866 ( 0.9, 38.7)   2   74 fr  France
      18    8376 ( 0.6, 13.8)    35514 ( 0.8, 37.8)   3   10 ar  Argentina
      19    8274 ( 0.6, 13.2)    17904 ( 0.4, 37.4)   2  225 um  United States minor outlying islands
      20    8227 ( 0.6, 12.6)    56900 ( 1.3, 36.0)   3  160 no  Norway
      21    7961 ( 0.6, 12.0)   253499 ( 6.0, 30.1)   3   17 bh  Bahrain
      22    7886 ( 0.6, 11.5)    51856 ( 1.2, 28.8)   3    7 ai  Anguilla
      23    7839 ( 0.6, 10.9)    44575 ( 1.1, 27.8)   4  171 pl  Poland
      24    7817 ( 0.6, 10.3)    55553 ( 1.3, 26.5)   2  216 tr  Turkey
      25    7219 ( 0.5,  9.8)    31251 ( 0.7, 25.7)   3   58 dk  Denmark
    
       Features:
         40% rtts, 30% transactions to 103 Multi servers !
            Next highest country is only 6.6%, then 3.3%
            ccd % down to 25% after 25 countries
         High proportion to small countries like Surinam, Armenia,
            Christmas Island!
         Otherwise distribution for transaction counts is a long, 
            slowly-falling tail.
         Usually many more transactions that rtts
    

  10. SJC Request Distribution
    Totals: rtt=8069458, transaction=40326286
       About 1/5 rtts compared to transactions
    
    151 countries observed (not including multi-country servers)
    Top 151 countries by nbr of rtts:
    
            rtts    %   ccd%     trans    %   ccd%  servers      Country
    
       0 2816673 (34.9, 65.1) 10661177 (26.4, 73.6)  87    0 ??  Multi (75 countries)
       1 2022496 (25.1, 40.0)  5901245 (14.6, 58.9)   6  207 tw  Taiwan, Province of China
       2  679611 ( 8.4, 31.6)  5576736 (13.8, 45.1)   7  201 sr  Suriname
       3  635169 ( 7.9, 23.7)  7705102 (19.1, 26.0)   6  113 kr  Korea, Republic of
       4  472667 ( 5.9, 17.9)  1359639 ( 3.4, 22.6)   6   44 cn  China
       5  256247 ( 3.2, 14.7)  1265597 ( 3.1, 19.5)   6  108 jp  Japan
       6  249077 ( 3.1, 11.6)   858853 ( 2.1, 17.4)   3  160 no  Norway
       7  225187 ( 2.8,  8.8)   925600 ( 2.3, 15.1)   5  219 tv  Tuvalu
       8  222990 ( 2.8,  6.1)  1173155 ( 2.9, 12.1)   4   11 am  Armenia
       9   75876 ( 0.9,  5.1)   277863 ( 0.7, 11.5)   4  104 ie  Ireland
      10   67010 ( 0.8,  4.3)   157084 ( 0.4, 11.1)   2  124 lu  Luxembourg
      11   56355 ( 0.7,  3.6)    80318 ( 0.2, 10.9)   2  148 nr  Nauru
      12   52260 ( 0.6,  2.9)   303302 ( 0.8, 10.1)   4  116 la  Lao People's Democratic Republic
      13   51607 ( 0.6,  2.3)    88855 ( 0.2,  9.9)   3  224 us  United States
    
       Features:
         About 10x UCSD transactions, but fewer countries (151, cf 185)
         35% rtts, 26% trans to 87 Multi-servers, noticeably less that at UCSD
         Much steeper tail; ccd below 25% for Multi+top 3 countries
         Taiwan, Suriname and Korea dominate the load,
            this link goes from Seattle to Asia
    


  11. Multi-server Request Distributions
    UCSD Multi servers, 30% of total.  First 50% of multiserver transactions:
    
        rtt   trans     %    ccd%   RTT (ms) IQR (ms)   Server         Countries
    
      28793   95496 (  5.3,  94.7)   89.97   3.84   15 AUTH03.NS.UU.NET       3
      72192   86014 ( 13.2,  81.5)   89.39   1.04   10 NS.UU.NET             39
      72274   74014 ( 13.3,  68.2)   93.43  13.26   35 AUTH00.NS.UU.NET       6
      32968   73625 (  6.0,  62.2)  183.45   2.63    1 NS.RIPE.NET           75
       3441   62539 (  0.6,  61.5)  760.42 674.03   32 NS2.GIP.NET            6
      35519   49885 (  6.5,  55.0)   38.40  20.18   14 NS-EXT.VIX.COM        15
       5734   43822 (  1.1,  54.0)  172.27   0.38   18 BOW.RAIN.FR            8
      10047   40172 (  1.8,  52.1)  192.78   2.83    4 NS.EU.NET             35
    

    • Q: Are we too dependent on multi servers?
    • A: No, at least not as seen from UCSD
    UCSD Multi servers, 30% of total.  First 50% of multiserver transactions:
    
        rtt   trans     %    ccd%   RTT (ms) IQR (ms)   Server            Countries
    
    2038774 7002812 ( 72.4,  27.6)    9.58  15.35   14 NS-EXT.VIX.COM          15
     277892  658010 (  9.9,  17.8)    7.35  19.92    6 UUCP-GW-1.PA.DEC.COM    10
     291464  630435 ( 10.3,   7.4)    6.45   8.27   31 UUCP-GW-2.PA.DEC.COM     5
      32961  466443 (  1.2,   6.2)    9.00   0.29  101 NS.ICANN.ORG             2
      83232  129575 (  3.0,   3.3)  208.87   2.36   53 NS.APNIC.NET             4
    
    • At SJC, 72% of rtts come from multi-server 14
    • Clearly, particular servers can dominate load at a site

  12. Do rtts differ for Own, Other, and Multi servers?
        rtt   trans     %    ccd%   RTT (ms) IQR (ms)        Server
    
       6751   18172 ( 35.5,  64.5)   78.20   0.89    4 Other CMCL2.NYU.EDU           47 co  Colombia
      11144   11203 ( 58.7,   5.8)   79.77   2.23    1 Other SAELL.CC.COLUMBIA.EDU   47 co  Colombia
        600    4366 (  3.2,   2.6)  247.00   8.80    3 Own   AYAX.UNIANDES.EDU.CO    47 co  Colombia
        502    3825 (  2.6,   0.0)  264.67   2.00    2 Own   CDCNET.UNIANDES.EDU.CO  47 co  Colombia
    
      13391   33069 ( 67.7,  32.3)   64.76   1.16    2 Other NS2.PSI.NET            106 it  Italy
       2182   13531 ( 11.0,  21.2)  178.39   2.04    3 Own   SERVER2.INFN.IT        106 it  Italy
       2145   11596 ( 10.8,  10.4)  205.48  11.23    1 Own   NAMESERVER.CNR.IT      106 it  Italy
       2053    9494 ( 10.4,  -0.0)  194.18   1.64    4 Own   DNS2.IUNET.IT          106 it  Italy
    

    • Other RTT << Own RTT
      • Note that bind (for local resolvers at UCSD) favours lower RTTs
      • But this isn't always the case ..
        rtt   trans     %    ccd%   RTT (ms) IQR (ms)        Server
    
      74654   74970 ( 75.1,  24.9)   20.24   1.83    6 Own   USNS.DACOM.CO.KR       113 kr  Korea, Republic of
       6005   22471 (  6.0,  18.9)  144.46   7.66    3 Own   KR2LD.DACOM.CO.KR      113 kr  Korea, Republic of
       5294   13366 (  5.3,  13.6)  149.10   3.38    5 Other KR2ND.HITEL.NET        113 kr  Korea, Republic of
       2641   12801 (  2.7,  10.9)  237.83  48.77    1 Other NS.KRNIC.NET           113 kr  Korea, Republic of
       4716   12270 (  4.7,   6.2)  232.00   4.13    2 Own   NS.KREONET.RE.KR       113 kr  Korea, Republic of
       6131    6331 (  6.2,  -0.0)  149.29   7.12    4 Other KR2ND.KORNET.NET       113 kr  Korea, Republic of
    
    • Best server is 'own' in the U.S.
      • Bind favours kr server 6 (lowest RTT)
      • kr server 1 (lowest nbr of rtts) has high IQR
        rtt   trans     %    ccd%   RTT (ms) IQR (ms)        Server
    
      12228   12370 ( 20.2,  79.8)  121.89  13.17    1 Own   DNS0.SPIN.AD.JP        108 jp  Japan
      11979   12057 ( 19.7,  60.1)  130.37   0.22    4 Own   NS0.IIJ.AD.JP          108 jp  Japan
      11035   11104 ( 18.2,  41.9)  131.31   6.60    5 Own   NS0.NIC.AD.JP          108 jp  Japan
       9138    9182 ( 15.1,  26.9)  144.36   5.34    6 Own   NS-JP.NIC.AD.JP        108 jp  Japan
       8913    8966 ( 14.7,  12.2)  143.39   1.25    2 Own   NS-JP.SINET.AD.JP      108 jp  Japan
       7387    7595 ( 12.2,   0.0)  152.92  22.69    3 Own   NS.WIDE.AD.JP          108 jp  Japan
    
       3459   25281 ( 42.0,  58.0)   24.20   2.41    3 Own   NOT.NORID.NO           160 no  Norway
       3503   19787 ( 42.6,  15.4)   24.13   1.41    2 Own   NJET.NORID.NO          160 no  Norway
       1265   11832 ( 15.4,   0.0)  188.55   1.08    1 Own   IFI.UIO.NO             160 no  Norway
    
       7788   41064 ( 59.1,  40.9)  220.44  31.18    5 Own   INECO.NIC.ES           198 es  Spain
       2875   12057 ( 21.8,  19.1)  210.01   1.68    3 Own   SUN.REDIRIS.ES         198 es  Spain
        828    7281 (  6.3,  12.8)  316.78 727.40    1 Own   NS.EUNET.ES            198 es  Spain
        807    6754 (  6.1,   6.7)  218.63   3.65    4 Own   NS1.NIC.ES             198 es  Spain
        885    5063 (  6.7,   0.0)  206.89   0.25    2 Own   PRADES.CESCA.ES        198 es  Spain
    
    • All Own servers, rtts distributed across them
        rtt   trans     %    ccd%   RTT (ms) IQR (ms)        Server
    
      68501  132802 ( 47.6,  52.4)   24.25   0.26    7 Other G3.NSTLD.COM           201 sr  Suriname
      18964   62790 ( 13.2,  39.2)   35.72   0.64    6 Other F3.NSTLD.COM           201 sr  Suriname
      14135   27545 (  9.8,  29.4)   77.48   1.54    2 Other L3.NSTLD.COM           201 sr  Suriname
      21690   22164 ( 15.1,  14.3)   81.26   0.62    3 Other D3.NSTLD.COM           201 sr  Suriname
      17808   17919 ( 12.4,   1.9)  101.38   3.58    5 Other C3.NSTLD.COM           201 sr  Suriname
       2699   13640 (  1.9,   0.0)    9.24   0.31    4 Other E3.NSTLD.COM           201 sr  Suriname
         57     281 (  0.0,   0.0)  659.51   0.00    1 Other NS1.SR.NET             201 sr  Suriname
          5     188 (  0.0,  -0.0)  121.58   0.00    8 Own   A.SRTLD.SR             201 sr  Suriname
    
       8910   35838 ( 29.3,  70.7)   81.10   0.80    2 Other B.GTLD.BIZ             224 us  United States
        399   27515 (  1.3,  69.4)  104.49   1.00    1 Other A.GTLD.BIZ             224 us  United States
      21103   23987 ( 69.4,   0.0)   17.79   0.40    3 Other C.GTLD.BIZ             224 us  United States
    
    • Small ccTLDs with high rtts

  13. Meanwhile, at SJC:
        rtt   trans     %    ccd%   RTT (ms) IQR (ms)        Server
    
      17444  700626 ( 57.2,  42.8)    1.88   0.68    1 Other UDNS1.ULTRADNS.NET      45 cx  Christmas Island
      13040  517878 ( 42.8,   0.0)    1.85  14.02    2 Other UDNS2.ULTRADNS.NET      45 cx  Christmas Island
    
     124732  429072 ( 50.1,  49.9)    1.04   0.23    2 Own   NJET.NORID.NO          160 no  Norway
     124345  426256 ( 49.9,   0.0)    1.04   0.24    3 Own   NOT.NORID.NO           160 no  Norway
    
       1506   18078 ( 99.0,   1.0)  398.97  25.72    3 Other NS2.IHUG.NET.NZ        158 nf  Norfolk Island
         11     128 (  0.7,   0.3)  183.84   0.00    1 Own   NS2.NF                 158 nf  Norfolk Island
          4      84 (  0.3,   0.0)  183.53   0.00    2 Own   NS1.NF                 158 nf  Norfolk Island
    
    • Christmas Island and Norway have two servers with very fast response near SJC
    • Norfolk Island isn't well served at SJC by IHUG in New Zealand
        rtt   trans     %    ccd%   RTT (ms) IQR (ms)        Server
    
     460691  976909 ( 97.5,   2.5)  146.96   7.89    1 Own   NS.CNC.AC.CN            44 cn  China
       7585   90902 (  1.6,   0.9)  460.73 115.08    5 Own   DNS4.CNNIC.NET.CN       44 cn  China
       2240   83859 (  0.5,   0.5)  289.11  49.08    2 Own   DNS2.CNNIC.NET.CN       44 cn  China
       2151   78852 (  0.5,  -0.0)  391.42 109.82    6 Own   DNS5.CNNIC.NET.CN       44 cn  China
    
     679437 4464980 (100.0,   0.0)   18.12   0.39    6 Other F3.NSTLD.COM           201 sr  Suriname
          3  288683 (  0.0,   0.0)   55.85   0.00    2 Other L3.NSTLD.COM           201 sr  Suriname
        166   75114 (  0.0,   0.0)   66.56   0.13    3 Other D3.NSTLD.COM           201 sr  Suriname
          5     603 (  0.0,  -0.0)  117.57   0.00    8 Own   A.SRTLD.SR             201 sr  Suriname
    

    • China and Suriname have a very dominant server near SJC

  14. Are there patterns in the ways ccTLDs organise their servers?

    • Yes, as observed above. Several strategies are common:
      • All Own servers, in own country (~ same RTTs)
      • Ditto, but place some servers in other countries, either for redundancy, or for better performance
      • Own servers, but use Other servers for redundancy or performance
      • Use Multi servers as alternative to Other. This seems common for small-country ccTLDs

  15. One week's RTT variation: Own servers only

    • jp:   6 servers, big steps, wide variations

    • Only plot four servers, leaving out two with high IQR
      • Server 6 has big steps in RTT
      • Otherwise median RTT is steady, but IQR is high
      • No diurnal variations visible for jp servers

  16. One week's RTT variation: Own vs Other servers

    • kr:   six servers. Wide range of RTT, U.S. server has very low RTT

    • no:   three servers, two in U.S, third in Norway

    • fi:   four servers. Wide range of RTT, lots of variation

  17. One week's RTT variation: Interesting ccTLDs (1)

    • es:   Five Own servers, big RTT variations

    • ca:   Six servers

    • dk:   Two servers, not much RTT variation

  18. One week's RTT variation: Interesting ccTLDs (2)

    • et:   Single server, little RTT variation

    • pl:   Four servers, mostly small IQR

    • tr:   2 servers, weekday loading effects
      • This is the only ccTLD with this behaviour
      • Other traces are mostly flat, with frquent spikes

  19. One week's RTT variation: ccTLDs with high DNS loads

    • sr:   Six servers, wide range of RTT and IQR

    • us:   Three servers, very like .sr

  20. How do Multi RTTs compare with Other ccTLD RTTs?

    • Oops, sever 6 (pink) has low RTT but high IQR!
      • Re-plot without server 6

    • Overall performance is satisfactory, but ..
      • Servers 14 (dark blue) and 4 (cyan) show signs of weekday loading
      •        We see a high request load for server 14 at SJC
      • Servers 2,10 and 13 have sudden steps in RTT
      • Server 3, Munnari (magenta) has high RTT and medium IQR

  21. Summary

    • ccTLDs use various strategies in setting up their DNS
    • 30% to 40% of DNS transactions use Multi servers
    • Smaller set of ccTLDs observed at SJC than at UCSD
    • DNS transaction load is generally well-distributed across ccTLDs
    • Server RTTs often show large steps, and have high IQR
    • Servers for a single ccTLD often show big differences in performance
    • Why are there so many more transactions than rtts?
    • Overall performance of ccTLDs is generally poorer than root/gTLDs
    • How can we make best use of ccTLD measurements?
    • Lots more work to be done

  22. Nevil Brownlee (nevil@caida.org)
    Last updated: 4 October 2002