Re: correction! Re: The math of RFC3822.2.2-spoofing a randomising source port resolver

[Bryan Seitz <seitz@bsd-unix.net>]

On Mon, Aug 04, 2008 at 04:47:57PM +0000, Paul Vixie wrote:
> > From: Stefan Schmidt <zaphodb@zaphods.net>
> > 
> > On Mon, Aug 04, 2008 at 02:22:41PM +0000, Paul Vixie wrote:
> > > indeed, noone on earth knew that this could be done in 11 seconds until
> > > february 2008.  given the severe trauma caused by udp port randomization
> > > for firewalls and NATs and solaris-10 and so on, i think there was a real
> > > and correct cost-benefit tradeoff being made when this attack took days
> > > or weeks of sustained multimegabit traffic to pull off.
> > 
> > Tradeoff yes, trauma not really for that is something that requires a shock.
> > You knew that this patch needed some ironing out and that the best way of
> > achieving that is to just roll it out, no need to be shocked about that now.
> 
> let's be clear about this.  neither dnscache nor powerdns was creating as many
> simultaneous upstream flows in those years as the kaminsky defense requires,
> and the market size for these tools was in those years so small that many of
> the firewall / NAT / kernel instabilities BIND is running into as we deploy 
> UDP port randomization were simply not encountered until now.
> 

FYI,

   In early 2006 I migrated approximately 120 BIND nameserver installations down to
approximately 30 PowerDNS installations for a very large ISP.  This migration not only 
allowed us to scale down the number of servers and save money on server hardware, but 
also improved query latencies and increased security due to port randomization. Thus,
source port randomization did not have an impact performance and we were able to reduce 
our server count by a factor of 4.

> > "cron loves you too, that's why it sends you so much mail."
> > - Paul Vixie, author of Vixie Cron
> 
> :-).

it sure does ;)

-- 
             
Bryan G. Seitz

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>