Re: NSEC+ and NO

[Paul Vixie <paul@vix.com>]

> "NSEC" walking would usually not be done with explicit queries for NSEC RRs
> (because that's too easy to answer with REFUSED, since there's probably no
> need for those queries) ...

actually i was planning on using ANY queries starting at @, the answers to
which would include NSEC.  that way i can gather all the data in the same
pass where i gather all the names.

in the scenario, booby traps would be quite effective.

the trouble with booby traps is, since udp source addresses are spoofworthy,
it would possible to make an authority server generate and hold a huge amount
of state just by forging a boobytrap-o-gram from a zillion different addresses.
if there's a quota, you can make them overrun it, thus making room for your
real zonewalk queries.  if there's no quota, you can make them run out of
state-memory.

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>