Re: [BEHAVE] DNS vs port overloading

[Simon Perreault <[e-mail]>]

Le 2013-06-27 16:36, Mark Andrews a écrit :
>>> And overloading DNS could potentially defeat the port randomisation
>>> done by the server even though nameservers do port overloading
>>> themselves to send traffic out a large set of ports choosen at
>>> random and reselected from at random.
>>
>> Good point.
>>
>> Could that be solved with operational advice? In the case of CGN, we
>> could advise the ISP could to make sure that its recursive nameserver
>> sits on the border between the internal and external realm such that no
>> DNS traffic is handled by the CGN.
>>
>> Would that fully address your concern?
>
> No.  Many ISP's have a history of mucking with DNS results when you
> use their servers.  Most ISP's don't muck DNS queries not directed
> to their servers.  For those that do you can usually see that they
> are mucking with results.
>
> You can't just redirect queries at a normal recursive server and
> think that will provide a "transparent DNS caching server".

Right, but, port overloading is not what kills the randomization done by 
the DNS client. Non-port preserving NAT is what kills it.

Non-port preserving NATs are already required to implement port 
randomization according to:

https://tools.ietf.org/html/rfc6056#section-4

Port overloading is not incompatible with port randomization. Maybe we 
should explicitly write this and add a reference to RFC 6056?

Simon