Re: [BEHAVE] DNS vs port overloading

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Simon Perreault writes:
> Le 2013-06-27 16:14, Mark Andrews a écrit :
> >> I have suggested that one condition where port overloading could be used
> >> is when the NAT knows that it will not disrupt the application protocol.
> >> For example, the protocols running on TCP port 80 and UDP port 53 (HTTP
> >> and DNS) are purely client-server and therefore would not be affected by
> >> port overloading. Allowing NATs to do port overloading for those ports
> >> only would probably solve the scalability problem since they account for
> >> a large portion of the traffic.
> >
> > And overloading DNS could potentially defeat the port randomisation
> > done by the server even though nameservers do port overloading
> > themselves to send traffic out a large set of ports choosen at
> > random and reselected from at random.
> 
> Good point.
> 
> Could that be solved with operational advice? In the case of CGN, we 
> could advise the ISP could to make sure that its recursive nameserver 
> sits on the border between the internal and external realm such that no 
> DNS traffic is handled by the CGN.
> 
> Would that fully address your concern?
> 
> Simon

No.  Many ISP's have a history of mucking with DNS results when you
use their servers.  Most ISP's don't muck DNS queries not directed
to their servers.  For those that do you can usually see that they
are mucking with results.

You can't just redirect queries at a normal recursive server and
think that will provide a "transparent DNS caching server".

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]