Subject: Re: dictionary attack on nameservers

From: Jay Daley <[email-masked]>
Date: Thu, 29 Jul 2004 11:38:07 +0100

Ted

Ted wrote on 29/07/2004 10:28:08:

> I am not sure what you call "a large zone", so also not if .nl
> qualifies (it is in the top-5 or so of largest zones, but, of
> course, much smaller than .com).
> The .nl domain has some 1.3M delegations, some 30k domains are
> newly registered and some 5k are released per month (from data
> over the first few months of 2004).

That will do.

> 
> I know of a number of registrars who keep daily updated, and
> very accurate lists of registrered and returned domain names.
> For .nl and also for other TLDs.
> 
> These guys use various techniques to keep their lists accurate
> and up-to-date. Although highly effective, these techniques are
> neither complicated, nor costly for the registrar.
> However, their load the .nl nameservers is significant, and thus
> one can easily see and determime who/what is causing it in the
> nameserver-traces which we routinely investigate in our testlab.

With respect this is still anecdotal.  Where is the real data?  i.e. "By 
dictionary attack X managed to guess Y% of the 1.3m names".

Jay

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Jay Daley" <[email-masked]>
Date: Thu, 29 Jul 2004 11:37:45 +0100

[ Moderators note: This post needed manual approval.

   Either because it was posted by a non-subscriber or because it contained
   to many characters (> 20000).

   With the massive amount of spam, it is easy to miss and therefore
   delete posts that need manual approval.

   Please fix your subscription addresses or shorten your postings by adding 
   links instead of attachments ] 

Ted

That will do.

Jay