[167427] in North American Network Operators' Group
Re: Best practice on TCP replies for ANY queries
daemon@ATHENA.MIT.EDU (Anurag Bhatia)
Wed Dec 11 13:26:08 2013
In-Reply-To: <52A8ACB7.8000005@kenweb.org>
From: Anurag Bhatia <me@anuragbhatia.com>
Date: Wed, 11 Dec 2013 23:55:14 +0530
To: ml@kenweb.org
Cc: NANOG Mailing List <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Hi ML
Yeah I can understand. Even DNSSEC will have issues with it which makes me
worry about rule even today.
On Wed, Dec 11, 2013 at 11:49 PM, ML <ml@kenweb.org> wrote:
> On 12/11/2013 1:06 PM, Anurag Bhatia wrote:
> >
> > I am sure I am not first person experiencing this issue. Curious to hear
> > how you are managing it. Also under what circumstances I can get a
> > legitimate TCP query on port 53 whose reply exceeds a basic limit of less
> > then 1000 bytes?
> >
> >
> >
>
> I'm not a DNS guru so I don't have an exact answer. However my gut
> feeling is that putting in a place a rule to drop or rate limit DNS
> replies greater than X bytes is probably going to come back to bite you
> in the future.
>
> No one can predict the future of what will constitute legitimate DNS
> traffic.
>
>
--
Anurag Bhatia
anuragbhatia.com
Linkedin <http://in.linkedin.com/in/anuragbhatia21> |
Twitter<https://twitter.com/anurag_bhatia>
Skype: anuragbhatia.com
