5 Jul
2019
5 Jul
'19
2:59 p.m.
On Fri, Jul 05, 2019 at 12:33:25PM +0000, Giovane Moura <giovane.moura@sidn.nl> wrote a message of 26 lines which said:
My hypothesis is that the field *rtt* on DNS queries on Atlas[1], for TCP, is, in fact, measuring 2 RTTs: the RTT of the TCP handshake, and the RTT of query/response itself.
I assume (I didn't check with tcpdump) that Atlas starts the clock when the SYN packet leaves, and dig when the DNS request leaves. That would explain your observation. Both make sense, and I disagree when you say that the second method is the only right one. In practice, which method is the most relevant depends on whether you use persistent TCP connections or not.