1# Copyright (c) 2016-2017, OARC, Inc. 2# Copyright (c) 2007, The Measurement Factory, Inc. 3# Copyright (c) 2007, Internet Systems Consortium, Inc. 4# All rights reserved. 5# 6# Redistribution and use in source and binary forms, with or without 7# modification, are permitted provided that the following conditions 8# are met: 9# 10# 1. Redistributions of source code must retain the above copyright 11# notice, this list of conditions and the following disclaimer. 12# 13# 2. Redistributions in binary form must reproduce the above copyright 14# notice, this list of conditions and the following disclaimer in 15# the documentation and/or other materials provided with the 16# distribution. 17# 18# 3. Neither the name of the copyright holder nor the names of its 19# contributors may be used to endorse or promote products derived 20# from this software without specific prior written permission. 21# 22# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 23# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 24# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 25# FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 26# COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 27# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 28# BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 29# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 30# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 32# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 33# POSSIBILITY OF SUCH DAMAGE. 34 35package DSC::grapher::text; 36 37BEGIN { 38 use Exporter (); 39 use vars qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS); 40 $VERSION = '2.04'; 41 @ISA = qw(Exporter); 42 @EXPORT = qw( 43 %TEXTS 44 ); 45 %EXPORT_TAGS = ( ); 46 @EXPORT_OK = qw(); 47} 48use vars @EXPORT; 49use vars @EXPORT_OK; 50 51END { } 52 53use strict; 54use warnings; 55 56%TEXTS = ( 57 58 bynode => { 59 description => '<p>The <strong>Queries by Node</strong> plot shows the 60 amount of queries coming from each node in the server 61 cluster. If you would like to see the traffic for 62 a single node, select the node name in the Servers/Nodes 63 menu on the left.</p> 64 <p>Note that the <em>By Node</em> option disappears from the 65 Plots list when you are viewing the data for a single node. 66 It reappears if you click on the Server name in the 67 Servers/Nodes menu.</p>', 68 }, 69 70 qtype => { 71 description => '<p>The <strong>Queries by Qtype</strong> plot shows 72 the breakdown of queries by DNS query type:</p> 73 <ul> 74 <li>A - Queries for the IPv4 address of a name. Usually 75 the most popular query type. 76 <li>NS - Queries for the authoritative nameservers for 77 a particular zone. These are usually rare because end 78 users (and their software agents) do not normally send 79 NS queries. NS records are normally included in the 80 authority section of every DNS message. 81 </ul> 82 <p>Click on the legend to view the queries for a specific type.</p>', 83 }, 84 85 dnssec_qtype => { 86 description => '<p>The <strong>DNSSEC Query Types</strong> plot shows 87 queries recieved for certain DNSSEC-related query types (shown 88 in the legend). The first-generation DNSSEC types 89 (SIG, KEY, NXT) have been obsoleted by newer, second-generation 90 types (DS, RRSIG, NSEC, DNSKEY). 91 <p>Click on the legend to view the queries for a specific type.</p>', 92 }, 93 94 rcode => { 95 description => '<p>The <strong>Replies by Rcode</strong> plot shows 96 the breakdown of RCODE values in DNS responses:</p> 97 <ul> 98 <li>NOERROR - No error condition. 99 <li>SERVFAIL - The name server was unable to process the 100 query due to a problem with the name server. 101 <li>NXDOMAIN - The domain name referenced in the query does 102 not exist. 103 <li>REFUSED - The server refuses to perform the specified 104 operation for policy reasons. 105 <li>NXRRSET - Some RRset that ought to exist, does not exist (used 106 in dynamic updates). 107 <li>Other - All other response codes, including: FORMERR, NOTIMP, YXDOMAIN, YXRRSET, NOTAUTH, NOTZONE. 108 </ul> 109 <p>Click on the legend to view the queries for a specific RCODE.</p>', 110 }, 111 112 opcode => { 113 description => '<p>The <strong>Messages by Opcode</strong> plot shows 114 the breakdown of OPCODE values, other than QUERY, in DNS queries. 115 Since QUERY is the most common opcode, its inclusion here would 116 dominate the plot. Some of the less common opcodes are:</p> 117 <ul> 118 <li>IQUERY - An "inverse query" which has been deprecated 119 in favor of the PTR query type. 120 <li>STATUS - A server status request. 121 <li>NOTIFY - Allows master servers to inform slave servers when a zone has changed. 122 <li>UPDATE - Add or delete RRs or RRsets from a zone. 123 <li>Other - All other opcode values, legitimate or not. 124 </ul> 125 <p>Click on the legend to view the queries for a specific opcode.</p>', 126 }, 127 128 certain_qnames_vs_qtype => { 129 description => '<p>This plot shows 130 queries of type A, AAAA, or A6 for the name <strong>localhost</strong> 131 and anything under <strong>root-servers.net</strong>. We chose these 132 names because, historically, the DNS root servers see a significant 133 number of queries for them. These plots may be uninteresting on 134 normal nameservers.</p> 135 <p>Click on the legend to view the queries for a specific type/name 136 pair</p>', 137 138 }, 139 140 client_subnet_accum => { 141 description => '<p>The <strong>Busiest Client Subnet</strong> plot shows 142 the number of queries sent from each /24 network. The horizontal 143 bars are colored based on the RIR where the address space is 144 registered, followed by a two-letter country code.</p>', 145 }, 146 147 client_subnet2_accum => { 148 description => '<p>The <strong>Query Classifications by Subnets</strong> plot shows 149 a kind of "quality report" for each /24 subnet. Queries are classified 150 according to a number of known misbehaviors, shown in the legend: 151 <ul> 152 <li>Malformed - The DNS message was malformed and could not be entirely parsed 153 <li>Src port 0 - The UDP query came from source port 0 154 <li>Funny Qtype - Query type was not one of the documented types 155 <li>Funny Qclass - Query class was not IN 156 <li>RFC1918PTR - The query type was PTR and the name was in an in-addr.arpa zone covered by RFC1918 private address space 157 <li>A-for-. - The query name was empty (equal to the root zone) 158 <li>A-for-A - The query name was already an IPv4 address 159 <li>localhost - The query was for localhost 160 <li>root-servers.net - The query was for a root-servers.net name 161 <li>Non-Authoritative TLD - The query was for a known-invalid TLD 162 <li>Unclassified - the query did not fall into one of the other categories. 163 </ul> 164 <p>Click on the legend to view the queries for a specific type.</p>', 165 }, 166 167 client_subnet2_trace => { 168 description => '<p>This plot shows the same classification data, but 169 as a time series instead of per-subnet.</p> 170 <p>Click on the legend to view the queries for a specific type.</p>', 171 }, 172 173 client_subnet2_count => { 174 description => '<p>This plot shows the same classification data, but 175 here we see the number of subnets sending each class of misbehavior 176 over time.</p> 177 <p>Click on the legend to view the queries for a specific type.</p>', 178 }, 179 180 qtype_vs_all_tld => { 181 description => '<p>The <strong>Most Popular TLDs Queried</strong> plot shows 182 the types of queries for each TLD.</p> 183 <p>Click on one of the plot subtypes in the left-side menu to see 184 a subset of TLDs.</p> 185 <p>Click on the legend to view the queries for a specific type.</p>', 186 187 }, 188 189 qtype_vs_invalid_tld => { 190 description => '<p>The <strong>Most Popular TLDs Queried</strong> plot shows 191 the types of queries for each TLD. Here we show only 192 <em>invalid</em> TLDs. If you see TLDs listed here that 193 should be considered valid, then you need to set the 194 <em>domain_list</em> and </em>valid_domains</em> directives 195 in the dsc-grapher.cfg file.</p>', 196 }, 197 198 qtype_vs_valid_tld => { 199 description => '<p>The <strong>Most Popular TLDs Queried</strong> plot shows 200 the types of queries for each TLD. Here we show only 201 <em>valid</em> TLDs. If this plot is empty, then you need to set the 202 <em>domain_list</em> and </em>valid_domains</em> directives 203 in the dsc-grapher.cfg file.</p>', 204 }, 205 206 qtype_vs_numeric_tld => { 207 description => '<p>The <strong>Most Popular TLDs Queried</strong> plot shows 208 the types of queries for each TLD. Here we show only 209 "TLDs" that are numeric. Queries to TLDs are closely related to 210 A-for-A queries in the Classification plots.</p>', 211 }, 212 213 direction_vs_ipproto => { 214 description => '', 215 }, 216 217 direction_vs_ipproto_sent => { 218 description => '', 219 }, 220 221 query_attrs => { 222 description => '', 223 }, 224 225 reply_attrs => { 226 description => '', 227 }, 228 229 idn_qname => { 230 description => '', 231 }, 232 233 rd_bit => { 234 description => '', 235 }, 236 237 tc_bit => { 238 description => '', 239 }, 240 241 do_bit => { 242 description => '', 243 }, 244 245 edns_version => { 246 description => '', 247 }, 248 249 qtype_vs_qnamelen => { 250 description => '', 251 }, 252 253 rcode_vs_replylen => { 254 description => '', 255 }, 256 257 client_addr_vs_rcode_accum => { 258 description => '', 259 }, 260 261 ipv6_rsn_abusers_accum => { 262 description => '', 263 }, 264 265 chaos_types_and_names => { 266 description => '', 267 }, 268 269); 270 2711; 272