Subject: in support of axfr-clarify

From: Bill Sommerfeld <[email-masked]>
Date: Thu, 05 Dec 2002 11:59:24 -0500

I support the current axfr-clarify draft as-is.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Bill Manning <[email-masked]>
Date: Thu, 5 Dec 2002 10:40:29 -0800 (PST)

% Where is the axfr-clarify draft? What is it that you support?
% 
% 		--Dean
% 
% On Thu, 5 Dec 2002, Bill Sommerfeld wrote:
% 
% > I support the current axfr-clarify draft as-is.
% >

Perhaps you missed this announcement to namedroppers:

To: IETF-Announce: ;
Cc: [email-masked]
Reply-to: [email-masked]
Subject: I-D ACTION:draft-ietf-dnsext-axfr-clarify-05.txt
Date: Tue, 03 Dec 2002 07:58:28 -0500
Sender: [email-masked]

[Part #1: Type: text/plain, Encoding: 7bit, Size: 2079]

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the DNS Extensions Working Group of the IETF.

        Title           : DNS Zone Transfer Protocol Clarifications
        Author(s)       : A. Gustafsson
        Filename        : draft-ietf-dnsext-axfr-clarify-05.txt
        Pages           : 7
        Date            : 2002-12-2

-- 
--bill

Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).

---

From: Bruce Campbell <[email-masked]>
Date: Fri, 13 Dec 2002 18:28:58 +0100 (CET)

On Thu, 12 Dec 2002, Andreas Gustafsson wrote:

> Bruce Campbell writes:
> > Actually, both 2845 and 2930 refer to (in their References) 2136, where
> > NotAuth is defined (for reasons other than an RCODE listing).  Could 2136
> > be added to the References section for completeness?
>
> I suppose it could; that's just an editorial change.  Added.

Thanks.

> > > What exactly do you mean by "not responding" in this case?  Not
> > > sending the zone data, or not even sending a single message with an
> > > RCODE indicating an error?
> >
> > Not acknowledging the request at all, terminating the connection
> > immediately.
> [...]
> > The (corner) case that I'm thinking of is a large DNS server (for
> > instance, a root server) under a DDoS where Bad People(tm) are getting
> > said large DNS server to swamp its outbound link in replying to (lots of)
> > bogus AXFR queries.  Even if they're just short replies, its still
> > avoidable traffic.
>
> It's quite a small amount of traffic compared to the TCP connection
> setup and teardown overhead - 14 bytes, to be precise.

( Well, I wasn't going to be worried about TCP teardown persay )

>
> In any case, I don't think making a specific exemption as part of the
> AXFR protocol itself makes sense.

Ok.

> A DDoSer could cause just as much
> harm by sending (e.g.) type A queries over TCP,

[snippery]

I've also reached the same conclusions, and think that I can find a more
general exception (ie, not specific to axfr).

This particular point can be dropped.

--==--
Bruce.