Re: terminal services

[Barney Wolff <barney () pit databus com>]

On Wed, Jan 29, 2003 at 05:09:29PM -0500, Paul Robertson wrote:
> ...
> Let's not forget that nailing DNS source ports to 53 reduces somewhat 
> (though by a trivial ammount) resistance to blind spoofing attacks. 

For named, the reduction is really trivial.  Bind8, at least, when
named.conf says "query-source * port *;" opens up a single non-priv
socket and uses it for all requests.  For real resistance to blind
spoofing, it should open a new socket for each request - but that
could lead to fatal resource exhaustion on a busy system, and might
even overload firewall state tables.  A casual scan of bind9 source
was not enough to figure out if it's any different.

-- 
Barney Wolff         http://www.databus.com/bwresume.pdf
I'm available by contract or FT, in the NYC metro area or via the 'Net.
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards