Subject: Re: Proposal to fix NSEC

From: [email-masked] (Geoffrey Sisson)
Date: Mon, 31 May 2004 16:25:58 +0100 (BST)

Greg Hudson <[email-masked]> writes:

> On Mon, 2004-05-31 at 10:29, Geoffrey Sisson wrote:
> > Please note that information leakage is not the only issue attributable
> > to NSEC RR elaboration: resource depletion due to possibly frequent,
> > multiple simultaneous chains of elaboration could also be significant.
> 
> Two answers:
> 
> (1) The normal load on most of these servers is pretty high.  An awful
> lot of spammers would have to be doing simultaneous nsec walks (which
> are rate-limited to some extent by needing to wait an RTT for each
> request) before it would become a noticeable factor.

Except . . . (Copy of my reply to kre on Friday)

------------------------ Begin included text ------------------------
It would be surprising if NSEC RR elaboration techniques didn't
incorporate considerable parallelism, especially for large zones.  This
could impose arbitrarily high loads on a busy nameserver.  For example,
multiple simultaneous elaborations could be run, one starting at
'aaa.co.uk', another starting at 'aab.co.uk', and so on.

This isn't idle speculation: prior to incorporating token bucket into
the WHOIS server at whois.nic.uk [note: reference to WHOIS for
illustrative purposes only!] we used to have a one-second sleep to
limit the impact of scripts.  Impatient data miners designed tools
which sent queries in parallel -- sometimes hundreds per second -- in
order to collect data at higher rates.  The consequences to server
performance were, well, predictable . . .
------------------------- End included text -------------------------

> (2) An nsec walk is an awful lot more efficient than a PTR walk.

True, though PTR walks are probably more distributed (i.e. involve
traversing many different servers, not just RIR servers), though
perhaps Daniel or Ed may have more insight into this phenomenon.  Also,
I suspect that PTR walks are much less rewarding (require much more
effort for more lossy results) so would not be as ubiquitous.

Regards

Geoff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Jay Daley" <[email-masked]>
Date: Mon, 31 May 2004 22:26:01 +0100

Greg

> request) before it would become a noticeable factor.

Let me just put this one in perspective.  Each of our nameservers has an 
average load of 100 million queries per day with about 4 million records 
in our zone files.  That means it will take only 25 spammers doing a full 
walk in one day to double the load on that server (this is on top of the 
huge increase in traffic that DNSSEC means).  As we have on average 3,000 
new domains registered per day we can safely expect these spammers to do 
this every day.  Once the script kiddie tools are out then we can expect 
many, many more than just 25.

Jay