Re: Does blocking TCP DNS packets keep your Bind safe?

["Tony Rall" <trall () almaden ibm com>]

Quite a bit of misinformation in this thread, as well as some good stuff.

There are cases where tcp is used for normal resolution requests.  If you
block it you will stop some degree of resolution from occurring.

Udp is not acceptable for zone transfers.

All valid dns udp messages are no greater than 512 bytes (and this is one
of the reasons why resolvers and servers need to be able to use tcp).  It
doesn't matter what version of bind is being used - this is explicitly
required by rfc1035.

Tony Rall

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards