Re: how many angels can dance on the head of a pin?

[Alex Bligh <[e-mail]>]

Ben,

--On 10 August 2008 12:30:10 +0100 Ben Laurie <[e-mail]> wrote:

>> I should have added that whilst non-broken NATs don't make things worse
>> (*), they also don't make things better.
>
> Not so, actually. If the NAT does random port assignment, then the
> resolver's assignment can be predictable.

Yep quite possibly. My post was precaffeinated and I was referring to
resolvers that were fixed-up, i.e. unpredictable. In practice though, I
suspect (Roy will know better) that a NAT seeing traffic from a single
internal (src IP, src port) tuple will continue to map that to a single
external (src IP, src port) tuple because, unless it's doing deeper
inspection than normal, it doesn't know which packets form separable
conversations. So the improvement would only occur where the broken
resolver used a non-constant but predictable port, which is the minority of
cases.

My point was that one should not think one can just stick a caching
resolver behind a NAT device and suddenly achieve immunity from this
particular poisoning attack. I presume you agree with that?

Alex

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>