Re: how many angels can dance on the head of a pin?

[Ben Laurie <[e-mail]>]

Alex Bligh wrote:
> Ben,
> 
> --On 10 August 2008 12:30:10 +0100 Ben Laurie <[e-mail]> wrote:
> 
>>> I should have added that whilst non-broken NATs don't make things worse
>>> (*), they also don't make things better.
>>
>> Not so, actually. If the NAT does random port assignment, then the
>> resolver's assignment can be predictable.
> 
> Yep quite possibly. My post was precaffeinated and I was referring to
> resolvers that were fixed-up, i.e. unpredictable. In practice though, I
> suspect (Roy will know better) that a NAT seeing traffic from a single
> internal (src IP, src port) tuple will continue to map that to a single
> external (src IP, src port) tuple because, unless it's doing deeper
> inspection than normal, it doesn't know which packets form separable
> conversations. So the improvement would only occur where the broken
> resolver used a non-constant but predictable port, which is the minority of
> cases.
> 
> My point was that one should not think one can just stick a caching
> resolver behind a NAT device and suddenly achieve immunity from this
> particular poisoning attack. I presume you agree with that?

Depends on your resolver, as you explained above.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>