From janbraun at gmx.de  Sat Apr 23 02:12:18 2011
From: janbraun at gmx.de (Jan Braun)
Date: Sat, 23 Apr 2011 11:12:18 +0200
Subject: [Netalyzr] Are you sure that's random?
Message-ID: <20110423091218.GA27054@arakhar>

Hi,
first, many thanks for the netalyzr service, I found it quite
interesting.

Secondly, my scans reproducably show _nearly_ constant DNS source ports
for my ISP's DNS server, see e.g. here:
http://n2.netalyzr.icsi.berkeley.edu/restore/id=43ca208a-3238-4506bd22-0e99-4aa5-b6f8
http://n3.netalyzr.icsi.berkeley.edu/restore/id=ae81b058-26151-ba63fbea-f016-4707-a3f0

I suggest you improve your randomness detector.

    Jan
-- 
()  ascii ribbon campaign - against html e-mail
/\  www.asciiribbon.org   - against proprietary attachments

From christian at icir.org  Sat Apr 23 14:51:06 2011
From: christian at icir.org (Christian Kreibich)
Date: Sat, 23 Apr 2011 14:51:06 -0700
Subject: [Netalyzr] Are you sure that's random?
In-Reply-To: <20110423091218.GA27054@arakhar>
References: <20110423091218.GA27054@arakhar>
Message-ID: <4DB349CA.9080503@icir.org>

Hi Jan,

On 04/23/2011 02:12 AM, Jan Braun wrote:
> I suggest you improve your randomness detector.

You're no doubt right. This constellation of port numbers -- a global
maximum followed by smaller ones, constantly increasing -- has found a
loophole in our detector. We'll improve it.

Thanks!
Christian