What's Normal? DNS TTL Values
I am trying to start a series of brief diaries about "what's normal." Analysts often only look at the network when they suspect something is wrong. But to find the anomaly, someone must first know what's normal. So, I am trying to collect data from my home network to show what to consider. The values I am presenting here are normal for my home network and will likely differ for your network. So, instead of just copying/pasting, run the experiment yourself :)
For this first installment, I am looking at the DNS TTL values. Each DNS response includes a "Time to Live" (TTL). This is the time the answer is good for; your host or recursive DNS server will cache the answer for that many seconds. An answer retrieved from a recursive server will use the TTL remaining for the recursive server. A recursive server that 20 seconds ago received an answer with a TTL of 60 seconds will report a TTL of 40 seconds. The TTLs you observe may depend on the traffic you are collecting. You will see a more diverse set of TTLs if the answers are received from a recursive server. Answers from an authoritative server are likely clustered around common values like 60, 3600 (one hour), or 86400 (one day).
So, what are the median TTLs for each record type? (I am using the median. A few outliers were throwing off the average too much).
Query Type | Rounded Median TTL |
NS | 500,000 |
MX | 1800 |
PTR | 1800 |
TXT | 300 |
AAAA | 92 |
A | 60 |
SOA | 60 |
"NS" and "MX" records being long-lived is no surprise. You will not change your DNS and Mail servers all the time, and MX records poing to hostnames. If you intend to fail over an MX record, you update the A/AAAA records for the hostname. It is interesting that AAAA records are slightly longer lived than A records. But in line with the fact that "mobile IP" for IPv6 is a myth and operationally, IPv6 is treated just like IPv4. SOA records must be updated whenever any other records are updated. Keeping it's TTL small makes sense.
What about the distribution of records? A and AAAA records are remarkably similar (as expected from the similar median?). I sued a logarithmic x-axis to display the smaller TTL values properly.
(click on the image for the full resolution)
---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|
Comments
Anonymous
Dec 3rd 2022
9 months ago
Anonymous
Dec 3rd 2022
9 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
Anonymous
Dec 26th 2022
8 months ago
Anonymous
Dec 26th 2022
8 months ago
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
Anonymous
Dec 26th 2022
8 months ago
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
Anonymous
Dec 26th 2022
8 months ago
Anonymous
Dec 26th 2022
8 months ago
https://defineprogramming.com/
Dec 26th 2022
8 months ago
distribute malware. Even if the URL listed on the ad shows a legitimate website, subsequent ad traffic can easily lead to a fake page. Different types of malware are distributed in this manner. I've seen IcedID (Bokbot), Gozi/ISFB, and various information stealers distributed through fake software websites that were provided through Google ad traffic. I submitted malicious files from this example to VirusTotal and found a low rate of detection, with some files not showing as malware at all. Additionally, domains associated with this infection frequently change. That might make it hard to detect.
https://clickercounter.org/
https://defineprogramming.com/
Dec 26th 2022
8 months ago
rthrth
Jan 2nd 2023
8 months ago