The Query Classifications by Subnets plot shows a kind of "quality report" for each /24 subnet. Queries are classified according to a number of known misbehaviors, shown in the legend:

  • Malformed - The DNS message was malformed and could not be entirely parsed
  • Src port 0 - The UDP query came from source port 0
  • Funny Qtype - Query type was not one of the documented types
  • Funny Qclass - Query class was not IN
  • RFC1918PTR - The query type was PTR and the name was in an in-addr.arpa zone covered by RFC1918 private address space
  • A-for-. - The query name was empty (equal to the root zone)
  • A-for-A - The query name was already an IPv4 address
  • localhost - The query was for localhost
  • root-servers.net - The query was for a root-servers.net name
  • Non-Authoritative TLD - The query was for a known-invalid TLD
  • Unclassified - the query did not fall into one of the other categories.

Click on the legend to view the queries for a specific type.

[DSC]