Re: draft-ietf-dnsext-forgery-resilience-01.txt

[bert hubert <bert.hubert@netherlabs.nl>]

On Mon, Nov 12, 2007 at 06:15:07PM +0100, Shane Kerr wrote:

> The only time you have an actual clash is when you have a duplicate ID+source
> IP+source port+destination IP+destination port for a UDP query, because then the
> resolver has no way to disambiguate the replies it gets.

Even more - "source ip, source port, destination ip, destination port, id,
qname, qtype" - these all have to match.

Authoritative servers do not look at the id of questions they get, except to
copy them to the answer. 

So duplicate query-IDs are only a problem for the resolver emitting them,
which will then have trouble disambiguating replies - iow, it is buggy.

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>