Carnegie Mellon University cmu-wordmark

Passive Detection of Misbehaving Name Servers

• SEI Report
By
In this paper, the authors demonstrate that there are name servers that exhibit IP address flux, a behavior that falls outside the prescribed parameters.
Publisher

Software Engineering Institute

Topic or Tag

Abstract

In this paper we demonstrate that there are name servers that exhibit IP address flux, a behavior that falls outside the prescribed parameters. We demonstrate this flux in two types of data: passively collected DNS messages and the contents of several large, top-level domains' official zone files. The community of name server operators has previously indicated that there is no benign use case for such behavior and has attempted to quash it. The continued existence of such behavior is an indicator of malicious name server activity and the inadequacy of attempts to control it.

SHARE
Download PDF
Cite This SEI Report

Metcalf, L., & Spring, J. (2012, January 2). Passive Detection of Misbehaving Name Servers. Retrieved September 22, 2026, from https://www.sei.cmu.edu/library/passive-detection-of-misbehaving-name-servers-2/.

@techreport{metcalf_2012,
author={Metcalf, Leigh and Spring, Jonathan},
title={Passive Detection of Misbehaving Name Servers},
month={Jan},
year={2012},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/passive-detection-of-misbehaving-name-servers-2/},
note={Accessed: 2026-Sep-22}
}

Metcalf, Leigh, and Jonathan Spring. "Passive Detection of Misbehaving Name Servers." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, January 2, 2012. https://www.sei.cmu.edu/library/passive-detection-of-misbehaving-name-servers-2/.

L. Metcalf, and J. Spring, "Passive Detection of Misbehaving Name Servers," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 2-Jan-2012 [Online]. Available: https://www.sei.cmu.edu/library/passive-detection-of-misbehaving-name-servers-2/. [Accessed: 22-Sep-2026].

Metcalf, Leigh, and Jonathan Spring. "Passive Detection of Misbehaving Name Servers." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 2 Jan. 2012. https://www.sei.cmu.edu/library/passive-detection-of-misbehaving-name-servers-2/. Accessed 22 Sep. 2026.

Metcalf, Leigh; & Spring, Jonathan. Passive Detection of Misbehaving Name Servers. Software Engineering Institute. 2012. https://www.sei.cmu.edu/library/passive-detection-of-misbehaving-name-servers-2/

Ask a question about this SEI Report