|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: Sitefinder and DDoS
But, that requirement simply says that if at x time you query *.something and otherwise-unmatched.something, you get the same result. It doesn't say that if you query at *.something at x time and otherwise-unmatched at x+5 time, you will get the same result. DNS servers can return different answers over time, and, expecting them not to change rapidly is an assumption not inherent in the protocol, much like the assumption that *.net and *.com would not get arbitrarily defined by the registry. While I would agree these are reasonable assumptions, I think we need to make some effort to get these assumptions codified into the protocol before someone else breaks them again. Owen --On Friday, October 10, 2003 9:41 AM +0200 Bruce Campbell <bc-nanog@vicious.dropbear.id.au> wrote: On Thu, 9 Oct 2003, Kee Hinckley wrote:At 10:41 PM +0300 10/9/03, Petri Helenius wrote: > With $100M annual revenue at stake, I would be willing to provide > distributed solutions > to this problem if you send me a reasonable fraction of that money. But can you do it without breaking the assumption that any lookup on *.TLD will always return the same value as badxxxdomain.TLD?Well, the problem space is that a wildcard is involved. Since 1034 indicates that the answer for '*.something' is the same as 'otherwise-unmatched.something', I think this assumption is fairly safe. The assumption is not safe if the authoritative nameservers for the underlying zone are not performing according to the DNS specs; ie, they have synthesised answers that are not from a wildcard (which can be queried). --==-- Bruce.
|