Subject: Re: claimed open relay [was: Re: [dnsext] RFC 5936 on DNS Zone Transfer Protocol (AXFR)]

From: "Jeffrey A. Williams" <[email-masked]>
Date: Mon, 28 Jun 2010 16:18:42 -0500 (GMT-05:00)

Alfred and all,

  Understood, but still closing up that open relay is in your and
everyone elses best interests don't you think? >:)

-----Original Message-----
>From: Alfred =?hp-roman8?B?SM5uZXM=?= <[email-masked]>
>Sent: Jun 28, 2010 4:14 PM
>To: [email-masked]
>Cc: [email-masked]
>Subject: Re: claimed open relay [was: Re: [dnsext] RFC 5936 on DNS Zone Transfer Protocol (AXFR)]
>
>Jeffrey A. Williams wrote:
>
>> All,
>>
>> Just as an aside note of interest, does everyone recognize that
>> TR-Sys.de refrenced below in the original message has an open relay?
>> See:
>> http://www.dnsstuff.com/tools/dnsreport?domain=TR-Sys.de&format=raw&loadresults=true&token=24f10c06c4cf7f7c04b5a0051ef10019
>>
>> ...
>
>This sounds rather incredibly -- the recursive server operated
>by TR-Sys is behind a NAT/firewall and does not answer any queries
>arriving on the WAN interface.  Of course, it is operated in an
>officially undefined mode -- split DNS.  :-)
>
>Kind regards,
>  Alfred.
>
Regards,

Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300+k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827

---

From: Nicholas Weaver <[email-masked]>
Date: Mon, 28 Jun 2010 14:38:21 -0700

> everyone elses best interests don't you think? >:)

HU?

dig www.google.com @tr-sys.de

; <<>> DiG 9.6.0-APPLE-P2 <<>> www.google.com @tr-sys.de
;; global options: +cmd
;; connection timed out; no servers could be reached
[gala:~/archive/svn_nweaver] nweaver% 

Also, frankly, with 3%+ of the residential NATs tested having open DNS relays, who cares?

---

From: David Conrad <[email-masked]>
Date: Mon, 28 Jun 2010 14:56:24 -0700

> Also, frankly, with 3%+ of the residential NATs tested having open DNS relays, who cares?

Egads.  Do you have an idea of the vendor(s) who facilitate this?

Also, do you have an estimate for the order of magnitude of the total number of boxes we're talking here?

Thanks,
-drc

---

From: Nicholas Weaver <[email-masked]>
Date: Mon, 28 Jun 2010 15:03:14 -0700

> Egads.  Do you have an idea of the vendor(s) who facilitate this?

Nope, we aren't doing NAT fingerprinting (would require connecting to port 80 and 443 on the NAT and we are uncertain whether we want to do that).

> Also, do you have an estimate for the order of magnitude of the total number of boxes we're talking here?

Hard to tell. The problem is we have a strong "geek bias" in our dataset for Netalyzr, so really, its 3% of the systems we check.

If you wanted to find out for yourself by just doing a full scan, thats only 4G addresses, at ~40B/packet, so $30 worth of bandwidth at EC2...

---

From: John Kristoff <[email-masked]>
Date: Mon, 28 Jun 2010 18:10:39 -0500

On Mon, 28 Jun 2010 14:56:24 -0700

> number of boxes we're talking here?

We're currently seeing about 6-7 million unique IPv4 addresses per
month that appear to be open resolvers.  I think it may be slightly
higher than that, but its noisy if not annoying to some folks if we
were to check more aggressively than we are.

There are many more, that are half open.  That is, you can query them
and the qname will be resolved, but the answer won't be returned to the
original querier.  This is likely due to one-way filtering near the
resolver.  There are also a fair number more that may not be completely
open, but answer with a referral, cached answer or something else.

John

---

From: Mark Andrews <[email-masked]>
Date: Tue, 29 Jun 2010 11:28:57 +1000

In message <[email-masked]>, Nicholas W
eaver writes:
> [gala:~/archive/svn_nweaver] nweaver%=20
> 
> 

A journey of a thousand miles starts with a single step.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Paul Vixie <[email-masked]>
Date: Tue, 29 Jun 2010 04:00:20 +0000

> From: Mark Andrews <[email-masked]>
> Date: Tue, 29 Jun 2010 11:28:57 +1000
> 

+1.