Queries per day that include the EDNS0 option edns-key-tag

Description:


Get the # of queries per day that include the EDNS0 option edns-key-tag (14)

NOTE: the edns_keytag_count column is only present in ENTRADA versions >= 0.0.9

More info for this option is found in rfc8145:
"Signaling Trust Anchor Knowledge in DNS Security Extensions (DNSSEC)"

https://tools.ietf.org/html/rfc8145

More info on edns-key-tag can be found here:

https://indico.dns-oarc.net/event/26/session/6/contribution/15/material/slides/0.pdf



Impala Query:


select trunc(query_ts,'DD') as qdate, count(1) as qtot
from dns.queries  
where year = 2017 and month = 8 
and ( (qtype = 10 and qname ilike "\_ta-%") or (edns_keytag_count > 0) ) 
group by qdate
order by qdate asc 



Example Output:


1 2017-08-01 00:00:00 4
2 2017-08-02 00:00:00 4
3 2017-08-03 00:00:00 4
4 2017-08-06 00:00:00 6
5 2017-08-07 00:00:00 4
6 2017-08-08 00:00:00 6
7 2017-08-09 00:00:00 4