Re: I-D ACTION:draft-ietf-dnsext-forgery-resilience-01.txt

[Peter Koch <[e-mail]>]

On Mon, Aug 13, 2007 at 01:06:43PM +0200, bert hubert wrote:

> > Why? I mean, firewalls often block these, but any special reason other than that?
> 
> No, I think Peter Koch suggested it for this reason. No other special

this was one of the operational issues I had (review of -01 still pending).
There are still many people out there with stateless packet filters and
recommending a default behaviour should take into account the consequences
for the operator.

> If you turn it to 64511 you get DJBDNS or PowerDNS, and the highest
> possible protection against spoofing.

Yes, but at what cost and operational complexity? Many sites completely block
UDP ports 2049, 135-139 and others at their perimeter.  "Chargen" is a very
nice source port for DNS queries as well, so there's a lot to avoid.
A name server that is just "as open as possible" may not see the responses
to some of the queries it sends.

1024 is not magic, but it's often enough the threshold value chosen for inbound
packets. Also, a couple of years ago CAIDA, I think, did some research on source
port distribution.  We've done some stats on our AS112 system and see similar
results (see also John K's posting):  53 is the only "low" port with noteworthy
use with huge numbers strating at 1024 and again at 32768.
Even though it would cut the space to 25%, recommending ports in the "dynamic"
port range (49152-65535), might be a better approach.

-Peter

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>