Passive Detection of Misbehaving Name Servers
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
In this paper we demonstrate that there are name servers that exhibit IP address flux, a behavior that falls outside the prescribed parameters. We demonstrate this flux in two types of data: passively collected DNS messages and the contents of several large, top-level domains' official zone files. The community of name server operators has previously indicated that there is no benign use case for such behavior and has attempted to quash it. The continued existence of such behavior is an indicator of malicious name server activity and the inadequacy of attempts to control it.
Cite This SEI Report
Metcalf, L., & Spring, J. (2012, January 2). Passive Detection of Misbehaving Name Servers. Retrieved September 8, 2026, from https://www.sei.cmu.edu/library/passive-detection-of-misbehaving-name-servers-2/.
@techreport{metcalf_2012,
author={Metcalf, Leigh and Spring, Jonathan},
title={Passive Detection of Misbehaving Name Servers},
month={Jan},
year={2012},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/passive-detection-of-misbehaving-name-servers-2/},
note={Accessed: 2026-Sep-8}
}
Metcalf, Leigh, and Jonathan Spring. "Passive Detection of Misbehaving Name Servers." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, January 2, 2012. https://www.sei.cmu.edu/library/passive-detection-of-misbehaving-name-servers-2/.
L. Metcalf, and J. Spring, "Passive Detection of Misbehaving Name Servers," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 2-Jan-2012 [Online]. Available: https://www.sei.cmu.edu/library/passive-detection-of-misbehaving-name-servers-2/. [Accessed: 8-Sep-2026].
Metcalf, Leigh, and Jonathan Spring. "Passive Detection of Misbehaving Name Servers." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 2 Jan. 2012. https://www.sei.cmu.edu/library/passive-detection-of-misbehaving-name-servers-2/. Accessed 8 Sep. 2026.
Metcalf, Leigh; & Spring, Jonathan. Passive Detection of Misbehaving Name Servers. Software Engineering Institute. 2012. https://www.sei.cmu.edu/library/passive-detection-of-misbehaving-name-servers-2/