IETF Logo Mail Archive

Re: [shara] port randomization (draft-ymbk-aplusp-03)

"Jan Zorz @ go6.si" <jan@go6.si> Sat, 14 March 2009 07:54 UTC

Return-Path: <jan@go6.si>
X-Original-To: shara@core3.amsl.com
Delivered-To: shara@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A974928C0EC for <shara@core3.amsl.com>; Sat, 14 Mar 2009 00:54:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.448
X-Spam-Level:
X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[AWL=-0.150, BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ejwb2lUxI7fR for <shara@core3.amsl.com>; Sat, 14 Mar 2009 00:54:32 -0700 (PDT)
Received: from nety.net (poirot.nety.net [89.212.42.194]) by core3.amsl.com (Postfix) with ESMTP id 41F5B28C0E0 for <shara@ietf.org>; Sat, 14 Mar 2009 00:54:31 -0700 (PDT)
Received: from [192.168.1.106] (unverified [89.212.15.159]) by nety.net (SurgeMail 3.9e) with ESMTP id 3462961-1926523 for multiple; Sat, 14 Mar 2009 08:55:10 +0100
Message-ID: <49BB62DD.9080109@go6.si>
Date: Sat, 14 Mar 2009 08:55:09 +0100
From: "Jan Zorz @ go6.si" <jan@go6.si>
Organization: go6.si
User-Agent: Thunderbird 2.0.0.19 (Macintosh/20081209)
MIME-Version: 1.0
To: =?ISO-8859-15?Q?R=E9mi_Denis-Courmont?= <remi.denis-courmont@nokia.com>
References: <022a01c9a2ab$fd5abf60$fd736b80@cisco.com> <04a201c9a338$d5ce8f70$fd736b80@cisco.com> <49B9752B.8030407@go6.si> <200903131023.13616.remi.denis-courmont@nokia.com>
In-Reply-To: <200903131023.13616.remi.denis-courmont@nokia.com>
Content-Type: multipart/alternative; boundary="------------050504040303090304060600"
X-Originating-IP: 89.212.15.159
X-Authenticated-User: jan@pragma.si
X-Encryption: SSL encrypted
X-IP-stats: Notspam Incoming Last 0, First 27, in=7, out=0, spam=0 Known=true ip=89.212.15.159
Cc: shara@ietf.org
Subject: Re: [shara] port randomization (draft-ymbk-aplusp-03)
X-BeenThere: shara@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Sharing of an IPv4 Address discussion list <shara.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/shara>, <mailto:shara-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/shara>
List-Post: <mailto:shara@ietf.org>
List-Help: <mailto:shara-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/shara>, <mailto:shara-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 14 Mar 2009 07:54:32 -0000

Rémi Denis-Courmont wrote:
> 	Hello,
>
> On Thursday 12 March 2009 22:48:43 ext Jan Zorz @ go6.si wrote:
>   
>> How important is port randomization and how big is the impact in real
>> life,
>>     
>
> It depends a _lot_ on the protocol.
>
> To reiterate what Dan said, DNS is vulnerable. The well-publicized attacks on 
> DNS (and in particular the "Kaminsky" vulnerability) rely on predictable port 
> numbers. Or rather, they are mitigated by port randomization.
>
> In principle, running a DNS cache on the NAT/address-sharing box could solve 
> this. DNS would be proxied at the application layer, and so port randomization 
> could be achieved properly by the box. Unfortunately, some of "box" vendors 
> probably do not want to have to provide a DNS cache.
>   
Remi, hi.

This seems quite a good idea. Maybe we should think and search for a 
solution in this direction.
Why do you suspect, that some of the vendors would refuse to provide a 
DNS cache?

regards, Jan Zorz

v2.8.7 | Report a Bug | By Email