Subject: Re: draft-eastlake-dnsext-cookies-00.txt

From: "Suranjith Ariyapperuma" <[email-masked]>
Date: Tue, 4 Jul 2006 16:38:05 +0100

Hi Roy,

Sorry if this sounds a silly question.

How did you figure out the below ?

As for the configuration of 207.198.250.119, it seems it is (blindly) 
forwarding requests to both 204.141.112.2 and 129.250.16.14, 
simultaneously

Best regards,
Suranjith

----- Original Message ----- 
From: "Roy Arends" <[email-masked]>
To: "John Kristoff" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, July 04, 2006 9:58 AM
Subject: Re: draft-eastlake-dnsext-cookies-00.txt

> John Kristoff wrote on 07/03/2006 11:58:50 PM:
> 
> > On Sun, 2 Jul 2006 22:41:33 -0400
> > "Eastlake III Donald-LDE008" <[email-masked]> wrote:
> > 
> > > However, I did find one case, where servers that fingerprint (fpdns)
> > > as a Microsoft Windows DNS 2000 implementation will first send back a
> > > FORMERR.  Though some servers stop there, I've seen others that then
> > > follow up immediately with an answer if the query was otherwise valid.
> > > 
> > > @@@ They actually sent two response messages (with the same ID
> > > presumably) to one query? Sounds odd to me. Just ignoring an
> > 
> > If you need some sample code, reply off list and I'll send you a
> > bit of Perl that uses Net::DNS to exhibit this behavior, but in the
> > meantime, the DNS server at 207.198.250.119 is just one example of
> > an implementation, which appears to do exactly that.  Here is what
> > I see:
> > 
> >   A query for motorola.com to 207.198.250.119 over UDP/53, including
> >   an additional section with an A record for foo.bar, type A, class
> >   IN with address of 192.0.2.1.  RD bit set.
> > 
> > First response echoes back the query indicating a format error.
> > 
> > An immediate second packet from the server, with the same ID, but this
> > time with an answer to the A query for motorola.  My particular resolver
> > does not expect this response, so it issues an ICMP destination port
> > unreachable back. I'll keep the pcap for a bit if someone thinks
> > I'm making this up.  :-)  I guess servers like this would make those
> > open recursive name server attacks that much more potent eh?  :-/
> 
> As for the configuration of 207.198.250.119, it seems it is (blindly) 
> forwarding requests to both 204.141.112.2 and 129.250.16.14, 
> simultaniously. 
> 
> The software running on 204.141.112.2 is Microsoft Windows DNS 2000, 
> source of the FORMERR you have received. Note that ANY information in the 
> additional section, including OPT RR (for edns purposes) causes a FORMERR 
> with this implementation. 
> The software running on 129.250.16.14 is ISC BIND 9.3.1, which silently 
> ignores unknown data in the additional section.
> 
> Both hosts are open recursive resolvers.
> 
> So, to be correct, it is not that Windows DNS 2000 responds twice to a 
> single request. It is the forwarder that causes that behavior by 
> multiplexing a single request to two different recursive resolvers.
> 
> Roy
> 
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
>