nanog mailing list archives
Re: DNS problems to RoadRunner - tcp vs udp
From: Justin Shore <justin () justinshore com>
Date: Fri, 13 Jun 2008 14:59:48 -0500
Jon Kibler wrote:
Various hardening documents for Cisco routers specify the best practices are to only allow 53/tcp connections to/from secondary name servers. Plus, from all I can tell, Cisco's 'ip inspect dns' CBAC appears to only handle UDP data connections and anything TCP would be denied. From what you are saying, the hardening recommendations are wrong and that CBAC may break some DNS responses. Is this correct?
A number of Cisco default from years gone by would break DSN, today, in it's current form. Such as how PIXs and ASAs with fixup/DPI would block udp/53 packets larger than 512 bytes, not permitting EDNS packets through.
Also, other than "That's what the RFCs call for," why use TCP for data exchange instead of larger UDP packets?
Current thread:
- DNS problems to RoadRunner - tcp vs udp Mark Price (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Jon Kibler (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Valdis . Kletnieks (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Valdis . Kletnieks (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Mike Lewinski (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Seth Mattinen (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Kevin Oberman (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Jon Kibler (Jun 13)
- RE: DNS problems to RoadRunner - tcp vs udp Tomas L. Byrnes (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Justin Shore (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Justin Shore (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Robert E. Seastrom (Jun 14)
- Re: DNS problems to RoadRunner - tcp vs udp Simon Leinen (Jun 14)
- Re: DNS problems to RoadRunner - tcp vs udp Randy Bush (Jun 14)
- Re: DNS problems to RoadRunner - tcp vs udp Valdis . Kletnieks (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Jon Kibler (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Jon Kibler (Jun 13)
- Re: DNS problems to RoadRunner - tcp vs udp Scott McGrath (Jun 14)