[78963] in North American Network Operators' Group
Re: DNS cache poisoning attacks -- are they real?
daemon@ATHENA.MIT.EDU (Suresh Ramasubramanian)
Sun Mar 27 06:30:03 2005
Date: Sun, 27 Mar 2005 16:59:33 +0530
From: Suresh Ramasubramanian <ops.lists@gmail.com>
Reply-To: Suresh Ramasubramanian <ops.lists@gmail.com>
To: Sean Donelan <sean@donelan.com>
Cc: Florian Weimer <fw@deneb.enyo.de>, nanog@merit.edu
In-Reply-To: <Pine.GSO.4.58.0503261733230.24905@clifden.donelan.com>
Errors-To: owner-nanog@merit.edu
On Sat, 26 Mar 2005 17:52:56 -0500 (EST), Sean Donelan <sean@donelan.com> wrote:
>
> On the other hand, there are a lot of reasons why a DNS operator may
> return different answers to their own users of their resolvers. Reverse
> proxy caching is very common. Just about all WiFi folks use cripple
> DNS as part of their log on. Or my favorite, quarantining infected
> computers to get the attention of their owners.
>
I hate that cripple dns stuff - they seem to add transparent proxying
of dns requests to it as well, sometimes.
I've seen cases where my laptop's local resolver (dnscache) suddenly
starts returning weird values like 1.1.1.1, 120.120.120.120 etc for
*.one-of-my-domains.com for some reason.
Thank $DEITY for large ISPs running open resolvers on fat pipes ..
those do come in quite handy in a resolv.conf sometimes, when I run
into this sort of behavior.
--srs
