Skip to content

Commit 132f9b6

Browse files
committed
TST: Add tests for new Dataplane feeds, rework
1 parent fc8adae commit 132f9b6

17 files changed

+706
-126
lines changed
Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# DataPlane.org - for operators, by operators
2+
# dnsrd
3+
# 2021-08-27 10:00 - 2021-09-03 10:00
4+
#
5+
# The dnsrd report is free for non-commercial use ONLY. If you wish
6+
# to discuss commercial use of this service, please contact us at
7+
# info@dataplane.org. Redistribution of the dnsrd report in whole or
8+
# in part without the express permission of DataPlane is expressly
9+
# prohibited.
10+
#
11+
# This report is made possible through the generous support of people
12+
# like you. Sensor, processing, and distribution systems require
13+
# non-free resources to setup and maintain. We are always looking for
14+
# financial contributions to help pay the bills and hosting to increase
15+
# visibility. If you find what we do useful, please consider supporting
16+
# us.
17+
#
18+
# This report is informational. It is not a block list, but some may
19+
# choose to use it to actively protect their networks and systems. The
20+
# report is provided on an as-is basis with no expressed warranty or
21+
# guarantee of accuracy. Use of this data is at your own risk. If you
22+
# have questions about this report do not hesitate to contact us.
23+
#
24+
# Entries below are records of source IP addresses that have been
25+
# identified as sending recursive DNS queries.
26+
# Each entry is sorted according to a route originating ASN. An entry
27+
# for the IP address is listed only once even if there are multiple
28+
# origin AS (MOAS) announcements for the covering prefix. We use the
29+
# PyASN IP address to ASN mapping service to construct an origin AS
30+
# number and name. For details about PyASN, see:
31+
#
32+
# <https://pypi.org/project/pyasn/>.
33+
#
34+
# The report format is as follows:
35+
#
36+
# ASN | ASname | ipaddr | lastseen | category
37+
#
38+
# Each field is described below. Please note any special formatting
39+
# rules to aid in processing this file with automated tools and scripts.
40+
# Blank lines may be present to improve the visual display of this file.
41+
# Lines beginning with a hash ('#') character are comment lines. All
42+
# other lines are report entries. Each field is separated by a pipe
43+
# symbol ('|') and at least two whitespace characters on either side.
44+
#
45+
# ASN Autonomous system number originating a route for the
46+
# entry IP address. Note, 4-byte ASNs are supported and
47+
# will be displayed as a 32-bit integer. NA is shown if
48+
# an origin ASN cannot be found.
49+
#
50+
# ASname A descriptive network name for the associated ASN. The
51+
# name is truncated to 30 characters. NA is shown if an
52+
# AS name cannot be found.
53+
#
54+
# ipaddr The IPv4 address that is being reported.
55+
#
56+
# lastseen A last seen timestamp formatted as YYYY-mm-dd HH:MM:SS
57+
# in UTC time.
58+
#
59+
# category Descriptive tag name for this entry. For this report,
60+
# the text dnsrd will appear.
61+
#
62+
# A commented footer section shows an aggregate count of ASNs and
63+
# addresses seen in the current report.
64+
#
65+
174 | COGENT-174 | 185.142.236.35 | 2021-08-31 10:07:10 | dnsrd
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
SPDX-FileCopyrightText: 2021 Mikk Margus Möll <mikk@cert.ee>
2+
SPDX-License-Identifier: AGPL-3.0-or-later
Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# DataPlane.org - for operators, by operators
2+
# dnsrdany
3+
# 2021-08-27 11:00 - 2021-09-03 11:00
4+
#
5+
# The dnsrdany report is free for non-commercial use ONLY. If you wish
6+
# to discuss commercial use of this service, please contact us at
7+
# info@dataplane.org. Redistribution of the dnsrdany report in whole or
8+
# in part without the express permission of DataPlane is expressly
9+
# prohibited.
10+
#
11+
# This report is made possible through the generous support of people
12+
# like you. Sensor, processing, and distribution systems require
13+
# non-free resources to setup and maintain. We are always looking for
14+
# financial contributions to help pay the bills and hosting to increase
15+
# visibility. If you find what we do useful, please consider supporting
16+
# us.
17+
#
18+
# This report is informational. It is not a block list, but some may
19+
# choose to use it to actively protect their networks and systems. The
20+
# report is provided on an as-is basis with no expressed warranty or
21+
# guarantee of accuracy. Use of this data is at your own risk. If you
22+
# have questions about this report do not hesitate to contact us.
23+
#
24+
# Entries below are records of source IP addresses that have been
25+
# identified as sending recursive DNS IN ANY queries.
26+
# Each entry is sorted according to a route originating ASN. An entry
27+
# for the IP address is listed only once even if there are multiple
28+
# origin AS (MOAS) announcements for the covering prefix. We use the
29+
# PyASN IP address to ASN mapping service to construct an origin AS
30+
# number and name. For details about PyASN, see:
31+
#
32+
# <https://pypi.org/project/pyasn/>.
33+
#
34+
# The report format is as follows:
35+
#
36+
# ASN | ASname | ipaddr | lastseen | category
37+
#
38+
# Each field is described below. Please note any special formatting
39+
# rules to aid in processing this file with automated tools and scripts.
40+
# Blank lines may be present to improve the visual display of this file.
41+
# Lines beginning with a hash ('#') character are comment lines. All
42+
# other lines are report entries. Each field is separated by a pipe
43+
# symbol ('|') and at least two whitespace characters on either side.
44+
#
45+
# ASN Autonomous system number originating a route for the
46+
# entry IP address. Note, 4-byte ASNs are supported and
47+
# will be displayed as a 32-bit integer. NA is shown if
48+
# an origin ASN cannot be found.
49+
#
50+
# ASname A descriptive network name for the associated ASN. The
51+
# name is truncated to 30 characters. NA is shown if an
52+
# AS name cannot be found.
53+
#
54+
# ipaddr The IPv4 address that is being reported.
55+
#
56+
# lastseen A last seen timestamp formatted as YYYY-mm-dd HH:MM:SS
57+
# in UTC time.
58+
#
59+
# category Descriptive tag name for this entry. For this report,
60+
# the text dnsrdany will appear.
61+
#
62+
# A commented footer section shows an aggregate count of ASNs and
63+
# addresses seen in the current report.
64+
#
65+
209 | CENTURYLINK-US-LEGACY-QWEST | 63.224.250.215 | 2021-08-30 07:08:00 | dnsrdany
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
SPDX-FileCopyrightText: 2021 Mikk Margus Möll <mikk@cert.ee>
2+
SPDX-License-Identifier: AGPL-3.0-or-later
Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# DataPlane.org - for operators, by operators
2+
# dnsversion
3+
# 2021-08-27 11:00 - 2021-09-03 11:00
4+
#
5+
# The dnsversion report is free for non-commercial use ONLY. If you wish
6+
# to discuss commercial use of this service, please contact us at
7+
# info@dataplane.org. Redistribution of the dnsversion report in whole or
8+
# in part without the express permission of DataPlane is expressly
9+
# prohibited.
10+
#
11+
# This report is made possible through the generous support of people
12+
# like you. Sensor, processing, and distribution systems require
13+
# non-free resources to setup and maintain. We are always looking for
14+
# financial contributions to help pay the bills and hosting to increase
15+
# visibility. If you find what we do useful, please consider supporting
16+
# us.
17+
#
18+
# This report is informational. It is not a block list, but some may
19+
# choose to use it to actively protect their networks and systems. The
20+
# report is provided on an as-is basis with no expressed warranty or
21+
# guarantee of accuracy. Use of this data is at your own risk. If you
22+
# have questions about this report do not hesitate to contact us.
23+
#
24+
# Entries below are records of source IP addresses that have been
25+
# identified as sending DNS CH TXT VERSION.BIND queries.
26+
# Each entry is sorted according to a route originating ASN. An entry
27+
# for the IP address is listed only once even if there are multiple
28+
# origin AS (MOAS) announcements for the covering prefix. We use the
29+
# PyASN IP address to ASN mapping service to construct an origin AS
30+
# number and name. For details about PyASN, see:
31+
#
32+
# <https://pypi.org/project/pyasn/>.
33+
#
34+
# The report format is as follows:
35+
#
36+
# ASN | ASname | ipaddr | lastseen | category
37+
#
38+
# Each field is described below. Please note any special formatting
39+
# rules to aid in processing this file with automated tools and scripts.
40+
# Blank lines may be present to improve the visual display of this file.
41+
# Lines beginning with a hash ('#') character are comment lines. All
42+
# other lines are report entries. Each field is separated by a pipe
43+
# symbol ('|') and at least two whitespace characters on either side.
44+
#
45+
# ASN Autonomous system number originating a route for the
46+
# entry IP address. Note, 4-byte ASNs are supported and
47+
# will be displayed as a 32-bit integer. NA is shown if
48+
# an origin ASN cannot be found.
49+
#
50+
# ASname A descriptive network name for the associated ASN. The
51+
# name is truncated to 30 characters. NA is shown if an
52+
# AS name cannot be found.
53+
#
54+
# ipaddr The IPv4 address that is being reported.
55+
#
56+
# lastseen A last seen timestamp formatted as YYYY-mm-dd HH:MM:SS
57+
# in UTC time.
58+
#
59+
# category Descriptive tag name for this entry. For this report,
60+
# the text dnsversion will appear.
61+
#
62+
# A commented footer section shows an aggregate count of ASNs and
63+
# addresses seen in the current report.
64+
#
65+
174 | COGENT-174 | 185.142.236.35 | 2021-08-31 10:07:09 | dnsversion
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
SPDX-FileCopyrightText: 2021 Mikk Margus Möll <mikk@cert.ee>
2+
SPDX-License-Identifier: AGPL-3.0-or-later
Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# DataPlane.org - for operators, by operators
2+
# proto41
3+
# 2021-08-27 08:00 - 2021-09-03 08:00
4+
#
5+
# The proto41 report is free for non-commercial use ONLY. If you wish
6+
# to discuss commercial use of this service, please contact us at
7+
# info@dataplane.org. Redistribution of the proto41 report in whole or
8+
# in part without the express permission of DataPlane is expressly
9+
# prohibited.
10+
#
11+
# This report is made possible through the generous support of people
12+
# like you. Sensor, processing, and distribution systems require
13+
# non-free resources to setup and maintain. We are always looking for
14+
# financial contributions to help pay the bills and hosting to increase
15+
# visibility. If you find what we do useful, please consider supporting
16+
# us.
17+
#
18+
# This report is informational. It is not a block list, but some may
19+
# choose to use it to actively protect their networks and systems. The
20+
# report is provided on an as-is basis with no expressed warranty or
21+
# guarantee of accuracy. Use of this data is at your own risk. If you
22+
# have questions about this report do not hesitate to contact us.
23+
#
24+
# Entries below are records of source IP addresses that have been
25+
# identified as an open IPv4 protocol 41 relay (i.e. IPv6 over IPv4).
26+
# To read more about the IPv4 protocol feed see:
27+
#
28+
# <https://dataplane.org/jtk/blog/2020/12/prot41-feed/>
29+
#
30+
# Each entry is sorted according to a route originating ASN. An entry
31+
# for the IP address is listed only once even if there are multiple
32+
# origin AS (MOAS) announcements for the covering prefix. We use the
33+
# PyASN IP address to ASN mapping service to construct an origin AS
34+
# number and name. For details about PyASN, see:
35+
#
36+
# <https://pypi.org/project/pyasn/>.
37+
#
38+
# The report format is as follows:
39+
#
40+
# ASN | ASname | ipaddr | firstseen | lastseen | category
41+
#
42+
# Each field is described below. Please note any special formatting
43+
# rules to aid in processing this file with automated tools and scripts.
44+
# Blank lines may be present to improve the visual display of this file.
45+
# Lines beginning with a hash ('#') character are comment lines. All
46+
# other lines are report entries. Each field is separated by a pipe
47+
# symbol ('|') and at least two whitespace characters on either side.
48+
#
49+
# ASN Autonomous system number originating a route for the
50+
# entry IP address. Note, 4-byte ASNs are supported and
51+
# will be displayed as a 32-bit integer. NA is shown if
52+
# an origin ASN cannot be found.
53+
#
54+
# ASname A descriptive network name for the associated ASN. The
55+
# name is truncated to 30 characters. NA is shown if an
56+
# AS name cannot be found.
57+
#
58+
# ipaddr The IPv4 address that is being reported.
59+
#
60+
# firstseen A first seen timestamp formatted as YYYY-mm-dd HH:MM:SS
61+
# in UTC time.
62+
#
63+
# lastseen A last seen timestamp formatted as YYYY-mm-dd HH:MM:SS
64+
# in UTC time.
65+
#
66+
# category Descriptive tag name for this entry. For this report,
67+
# the text proto41 will appear.
68+
#
69+
# A commented footer section shows an aggregate count of ASNs and
70+
# addresses seen in the current report.
71+
#
72+
1 | LVLT-1 | 45.6.192.1 | 2021-08-28 05:00:18 | 2021-08-28 05:00:18 | proto41
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
SPDX-FileCopyrightText: 2021 Mikk Margus Möll <mikk@cert.ee>
2+
SPDX-License-Identifier: AGPL-3.0-or-later
Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# DataPlane.org - for operators, by operators
2+
# smtpdata
3+
# 2021-08-27 11:00 - 2021-09-03 11:00
4+
#
5+
# The smtpdata report is free for non-commercial use ONLY. If you wish
6+
# to discuss commercial use of this service, please contact us at
7+
# info@dataplane.org. Redistribution of the smtpdata report in whole or
8+
# in part without the express permission of DataPlane is expressly
9+
# prohibited.
10+
#
11+
# This report is made possible through the generous support of people
12+
# like you. Sensor, processing, and distribution systems require
13+
# non-free resources to setup and maintain. We are always looking for
14+
# financial contributions to help pay the bills and hosting to increase
15+
# visibility. If you find what we do useful, please consider supporting
16+
# us.
17+
#
18+
# This report is informational. It is not a block list, but some may
19+
# choose to use it to actively protect their networks and systems. The
20+
# report is provided on an as-is basis with no expressed warranty or
21+
# guarantee of accuracy. Use of this data is at your own risk. If you
22+
# have questions about this report do not hesitate to contact us.
23+
#
24+
# Entries below are records of source IP addresses that have been
25+
# identified as SMTP clients sending DATA commands.
26+
# To read more about the SMTP data feed see:
27+
#
28+
# <https://dataplane.org/jtk/blog/2021/01/smtp-feeds/>
29+
#
30+
# Each entry is sorted according to a route originating ASN. An entry
31+
# for the IP address is listed only once even if there are multiple
32+
# origin AS (MOAS) announcements for the covering prefix. We use the
33+
# PyASN IP address to ASN mapping service to construct an origin AS
34+
# number and name. For details about PyASN, see:
35+
#
36+
# <https://pypi.org/project/pyasn/>.
37+
#
38+
# The report format is as follows:
39+
#
40+
# ASN | ASname | ipaddr | lastseen | category
41+
#
42+
# Each field is described below. Please note any special formatting
43+
# rules to aid in processing this file with automated tools and scripts.
44+
# Blank lines may be present to improve the visual display of this file.
45+
# Lines beginning with a hash ('#') character are comment lines. All
46+
# other lines are report entries. Each field is separated by a pipe
47+
# symbol ('|') and at least two whitespace characters on either side.
48+
#
49+
# ASN Autonomous system number originating a route for the
50+
# entry IP address. Note, 4-byte ASNs are supported and
51+
# will be displayed as a 32-bit integer. NA is shown if
52+
# an origin ASN cannot be found.
53+
#
54+
# ASname A descriptive network name for the associated ASN. The
55+
# name is truncated to 30 characters. NA is shown if an
56+
# AS name cannot be found.
57+
#
58+
# ipaddr The IPv4 address that is being reported.
59+
#
60+
# lastseen A last seen timestamp formatted as YYYY-mm-dd HH:MM:SS
61+
# in UTC time.
62+
#
63+
# category Descriptive tag name for this entry. For this report,
64+
# the text smtpdata will appear.
65+
#
66+
# A commented footer section shows an aggregate count of ASNs and
67+
# addresses seen in the current report.
68+
#
69+
3216 | SOVAM-AS PJSC "Vimpelcom" | 213.234.207.188 | 2021-08-31 13:52:46 | smtpdata
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
SPDX-FileCopyrightText: 2021 Mikk Margus Möll <mikk@cert.ee>
2+
SPDX-License-Identifier: AGPL-3.0-or-later

0 commit comments

Comments
 (0)