From: cldavis@speakeasy.net
To: netfilter@lists.netfilter.org
Subject: Re: pop3 and dns
Date: Thu, 13 May 2004 01:40:29 +0000 [thread overview]
Message-ID: <W123333069650381084412429@webmail2> (raw)
> -----Original Message-----
> From: Dick St.Peters [mailto:stpeters@NetHeaven.com]
> Sent: Wednesday, May 12, 2004 09:21 PM
> To: 'Cedric Blancher'
> Cc: 'Netfilter Mailing List'
> Subject: Re: pop3 and dns
>
> Cedric Blancher writes:
> > Le mer 12/05/2004 à 21:14, Dana Bourgeois a écrit :
> > > >>tcp for zone transfers
> > > > and large answers ...
> > > ...where a 'large answer' is usually taken to be a UDP packet of more
> > > than 512 bytes.
> >
> > I don't quite understand the meaning of this answer... So, I clarify.
> >
> > When a DNS server has to reply on UDP with more than 512 bytes of data,
> > it sends back an answer with TC bit (truncated) set to let client know
> > answer is not complete and have him send it again using TCP.
>
> To add my own bit of clarification, it's not large answers that need
> TCP open, it's requests that have large answers. If the client gets a
> UDP answer with the TC bit set, it should send the query again using a
> TCP connection ... and the server must listen for such connections
> ... and its firewall must let them through.
<snip>
In following this post...
I currently only allow port 53/udp through my wall for dns. I haven't noticed many
In the even that someone is able to comprimise a dns server, what would be the best way to restrict tcp zone transfers at the firewall? Rate limiting comes to my mind, any suggestions on the actual limits?
Other suggestions?
Thanks!
Christopher Davis
next reply other threads:[~2004-05-13 1:40 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-05-13 1:40 cldavis [this message]
2004-05-13 2:01 ` Filter all but 1 calss c Scott Miller
2004-05-13 3:00 ` Alistair Tonner
2004-05-13 3:31 ` Scott Miller
2004-05-13 4:48 ` Alistair Tonner
2004-05-13 23:49 ` pop3 and dns Mark E. Donaldson
-- strict thread matches above, loose matches on Subject: below --
2004-05-07 5:21 Fritz Mesedilla
2004-05-05 4:58 Fritz Mesedilla
2004-05-05 10:24 ` Antony Stone
2004-05-05 12:30 ` Alistair Tonner
2004-05-05 4:42 Fritz Mesedilla
2004-05-04 9:40 Fritz Mesedilla
2004-05-04 9:40 ` Ray Leach
2004-05-04 10:09 ` Antony Stone
2004-05-11 13:37 ` Peter Marshall
2004-05-12 4:22 ` Alexander Samad
2004-05-12 7:15 ` Ray Leach
2004-05-12 19:14 ` Dana Bourgeois
2004-05-12 19:34 ` Cedric Blancher
2004-05-12 21:21 ` Dick St.Peters
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=W123333069650381084412429@webmail2 \
--to=cldavis@speakeasy.net \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.