Queries per day that include the EDNS0 option edns-key-tag
Description:
Get the # of queries per day that include the EDNS0 option edns-key-tag (14)
NOTE: the edns_keytag_count column is only present in ENTRADA versions >= 0.0.9
More info for this option is found in rfc8145:
"Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC)"
https://tools.ietf.org/html/rfc8145
More info on edns-key-tag can be found here:
https://indico.dns-oarc.net/event/26/session/6/contribution/15/material/slides/0.pdf
Impala Query:
select trunc(query_ts,'DD') as qdate, count(1) as qtot
from dns.queries
where year = 2017 and month = 8
and ( (qtype = 10 and qname ilike "\_ta-%") or (edns_keytag_count > 0) )
group by qdate
order by qdate asc
Example Output:
1 2017-08-01 00:00:00 4
2 2017-08-02 00:00:00 4
3 2017-08-03 00:00:00 4
4 2017-08-06 00:00:00 6
5 2017-08-07 00:00:00 4
6 2017-08-08 00:00:00 6
7 2017-08-09 00:00:00 4