Subject: Re: draft-eastlake-dnsext-cookies-00.txt

From: Roy Arends <[email-masked]>
Date: Tue, 4 Jul 2006 10:58:24 +0200

John Kristoff wrote on 07/03/2006 11:58:50 PM:

> On Sun, 2 Jul 2006 22:41:33 -0400
> "Eastlake III Donald-LDE008" <[email-masked]> wrote:
> 
> > However, I did find one case, where servers that fingerprint (fpdns)
> > as a Microsoft Windows DNS 2000 implementation will first send back a
> > FORMERR.  Though some servers stop there, I've seen others that then
> > follow up immediately with an answer if the query was otherwise valid.
> > 
> > @@@ They actually sent two response messages (with the same ID
> > presumably) to one query? Sounds odd to me. Just ignoring an
> 
> If you need some sample code, reply off list and I'll send you a
> bit of Perl that uses Net::DNS to exhibit this behavior, but in the
> meantime, the DNS server at 207.198.250.119 is just one example of
> an implementation, which appears to do exactly that.  Here is what
> I see:
> 
>   A query for motorola.com to 207.198.250.119 over UDP/53, including
>   an additional section with an A record for foo.bar, type A, class
>   IN with address of 192.0.2.1.  RD bit set.
> 
> First response echoes back the query indicating a format error.
> 
> An immediate second packet from the server, with the same ID, but this
> time with an answer to the A query for motorola.  My particular resolver
> does not expect this response, so it issues an ICMP destination port
> unreachable back. I'll keep the pcap for a bit if someone thinks
> I'm making this up.  :-)  I guess servers like this would make those
> open recursive name server attacks that much more potent eh?  :-/

As for the configuration of 207.198.250.119, it seems it is (blindly) 
forwarding requests to both 204.141.112.2 and 129.250.16.14, 
simultaniously. 

The software running on 204.141.112.2 is Microsoft Windows DNS 2000, 
source of the FORMERR you have received. Note that ANY information in the 
additional section, including OPT RR (for edns purposes) causes a FORMERR 
with this implementation. 
The software running on 129.250.16.14 is ISC BIND 9.3.1, which silently 
ignores unknown data in the additional section.

Both hosts are open recursive resolvers.

So, to be correct, it is not that Windows DNS 2000 responds twice to a 
single request. It is the forwarder that causes that behavior by 
multiplexing a single request to two different recursive resolvers.

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>