Subject: is this proper behavior?

From: Edward Lewis <[email-masked]>
Date: Mon, 24 Jun 2002 17:40:05 -0400

(I appologize if this has been seen before.  I apparently forgot to 
subscribe from this address, and I suspect the mail was silently 
rejected based on looking at another account I have.)

I've been testing some delegations, trying to measure the extent of 
lameness in a few zones.  I've come across an interesting result that 
I'd like to discuss.  My hope is that this discussion is within 
charter of this list, if it is not, just tell me to stop...

It's probably clearest if I give an anonymized example of the 
behavior I am seeing.  So I'll start with an example.

According to our records, the four zones [0123].287.in-addr.arpa, are 
being hosted on ns.one.two.  When I ask ns.one.two. (substituting an 
IP address for the domain name in dig) for the SOA record of 
1.287.in-addr.arpa. I get a positive response that confirms that the 
delegation is correct.  The same happens for the 2 zone.  But when I 
query for the 3 zone, I get a server time out.  I.e., no udp response 
- no SERVFAIL, no REFUSED, no NXDOMAIN, not even a referral.  BTW, my 
queries are all non-recursive.

(This is the question that led me to ask this on DNSOP.)  Is it 
acceptable for a server to answer for some zones and not at all for 
others?  Wouldn't this cause a problem for DNS implementations that 
measure round trip times in order to select one server over another? 
I don't think such behavior is subject to a specification.

Being that I am familiar with BIND mostly, I did try to ask the 
server for its version.bind/chaos/txt, and got a FORMERR response 
back, so I have no clue as to the implementation I am testing at that 
address.  I was asking for this to see, if this was BIND, if I could 
replicate the server's behavior in order to understand what it was 
doing.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

---

From: Rob Austein <[email-masked]>
Date: Mon, 24 Jun 2002 18:30:40 -0400

> measure round trip times in order to select one server over another? 

Depends on the algorithm.  If the observed behavior were that the name
server repeatedly answers queries for different names at different
speeds (that is, if there were a repeatable pattern to the round trip
times), I'd agree that it was a measurement problem.  As you describe
it, though, it's a sampling problem (which data does one feed into the
RTT estimator?), which is a subtly different thing.   TCP, for
example, would not regard lack of response as any kind of sample at
all (that is, the connection would of course eventually time out, and
the RTO would back off, but the RTT estimate would not change -- see
RFC 1122 4.2.3.1 and follow the references to the SIGCOMM papers).

With all that said, the behavior you describe is questionable in light
of the robustness principle, so it's probably a bad thing unless
there's a very good reason for doing things that way.

---

From: Randy Bush <[email-masked]>
Date: Mon, 24 Jun 2002 16:09:10 -0700

i commonly get non-responses to non-recursive digs to servers which
seem not to be authoritative.

randy

---

From: Robert Elz <[email-masked]>
Date: Tue, 25 Jun 2002 13:29:32 +0700

Date:        Mon, 24 Jun 2002 17:40:05 -0400
    From:        Edward Lewis <[email-masked]>
    Message-ID:  <a05111b03b93d41f48c5a@[208.58.208.43]>

  | Being that I am familiar with BIND mostly, I did try to ask the 
  | server for its version.bind/chaos/txt, and got a FORMERR response 
  | back, so I have no clue as to the implementation

Sounds like djb's "thing" - his opinion was that if you asked his server
for something for which it hadn't been configured, it would simply ignore
you (no answer of any kind).

I think that's broken, but there's little that can be done to stop it,
if people don't want to send you packets, no matter what the circumstances,
there's nothing you can do to make them.

kre

---

From: Markus Stumpf <[email-masked]>
Date: Thu, 27 Jun 2002 20:25:17 +0200

> you (no answer of any kind).

Yeah! Kewl isn't it?
Script kiddies send queries for MX hotmail.com from spoofed addresses
and it doesn't work (i.e. 29 bytes query vs 507 bytes answer would be a
multiplicator of about 17 and is even more effective as a ping to the
broadcast address of a /28).
At least however you have 29 bytes query vs 29 bytes answer from a
REFUSED answer and it's your DNS Server that shows up on the target.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: Roy Arends <[email-masked]>
Date: Thu, 27 Jun 2002 12:26:23 -0700 (PDT)

> broadcast address of a /28).

No, its not. 29 bytes vs 507 bytes is 1 packet vs 1 packet. broadcast
related DoS is 1 packet vs N packets.

You're comparing apples and oranges.

Roy Arends
Nominum

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 28 Jun 2002 00:23:46 +0200

> You're comparing apples and oranges.

Pardon? I compare bytes/bandwidth with bytes/bandwidth.
Nobody denies that splitting the bytes to a lot of packages put more
load on the routers, but if you have a 10 Mbit leased line and you get
loaded with 20 Mbit you dont really care if it's 1 thousand or 1
million packets.

Even worse, as the target has no associated UDP port open (most likely)
the local host additionally generates an outgoing ICMP packet.

Read
    http://www.s0ftpj.org/docs/spj-002-000.txt
for an insight.

And I don't say it doesn't work with djbdns also, it's only not as easy,
because you can't simply send it anything and get an answer.

	\Maex