Full Disclosure mailing list archives
RE: Fw: [NTBUGTRAQ] Win 2003 DNS requests makes replies over 512 byte PIX limit
From: John.Airey () rnib org uk
Date: Fri, 9 May 2003 09:47:01 +0100
-----Original Message----- From: hggdh [mailto:hggdh () attbi com] Sent: 08 May 2003 18:09 To: full-disclosure () lists netsys com Subject: [Full-disclosure] Fw: [NTBUGTRAQ] Win 2003 DNS requests makes replies over 512 byte PIX limit FYI. Any ideas? ----- Original Message ----- From: "DeAvillez, Carlos" <Carlos_DeAvillez () stercomm com> To: <hggdh () attbi com> Sent: Thursday, May 08, 2003 12:08 Subject: FW: [NTBUGTRAQ] Win 2003 DNS requests makes replies over 512 byte PIX limit-----Original Message----- From: DeAvillez, Carlos Sent: Thursday, May 08, 2003 12:02 To: 'hddgh () attbi com' Subject: FW: [NTBUGTRAQ] Win 2003 DNS requests makesreplies over 512byte PIX limit -----Original Message----- From: Loucks, Jason [mailto:loucks () COMMPROD COM] Sent: Thursday, May 08, 2003 08:59 To: NTBUGTRAQ () LISTSERV NTBUGTRAQ COM Subject: [NTBUGTRAQ] Win 2003 DNS requests makes repliesover 512 bytePIX limit We recently upgraded our DNS servers to Win 2003. Afterthis time, itbecame apparent that we are unable to send email to somedomains whichhad been working fine before. After much investigation as to why it "suddenly" stopped working, we determined that Win 2003 requests everything but thekitchen cupboard inits DNS requests, apparently using RFC 2671 to specify theability toaccept >512 byte UDP replies. We are running the latest version (6.3.1) on our Cisco PIX and it appears that there is hard limit of 512 bytes on ANY UDP packets arriving on port 53. Everything exceeding that is dropped. Has anyone else seen this problem?
I was under the impression that the latest Pix version is 6.2.1, so I hope that the above is a typo. Assuming that your DNS server is an internal resolver (rather than a primary or secondary for your domain) there is no reason for it ever to receive external requests on port 53. The newer Pix versions are very picky about what they allow through on UDP, so I'm surprised you've ever got anything through on port 53. I've mentioned this issue before on this list (see the thread "SQL Slammer - lessons learned"), but I'll repeat it again. Your internal resolver only needs to connect to port 53 of external machines to send email to them. The connection back to your machine will be on a higher port. The Pix will use stateful filtering to allow the connection to the higher port (ie it detects that the connection was originated from the inside). Try "show conn prot udp" (or "show conn") on the firewall to see where the connections are really going. Even "netstat -a" on the server should give you some information about connections. If however I'm wrong and this DNS server is also your primary or secondary DNS server, I'd say that it is not a good idea to have this behind your firewall (and the same goes for web servers). IMNSHO a firewall should divide your network between publicly accessible parts and private parts, which if you look at the Cisco site is what they recommend. CERT recommend that you have a separate network inside your firewall for web servers, however I think that just over-complicates the matter. Let me know if you need any more help. - John Airey, BSc (Jt Hons), CNA, RHCE Internet systems support officer, ITCSD, Royal National Institute of the Blind, Bakewell Road, Peterborough PE2 6XU, Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 John.Airey () rnib org uk According to Mein Kampf, the so called "final solution" was merely the practical application of Natural Selection. - NOTICE: The information contained in this email and any attachments is confidential and may be legally privileged. If you are not the intended recipient you are hereby notified that you must not use, disclose, distribute, copy, print or rely on this email's content. If you are not the intended recipient, please notify the sender immediately and then delete the email and any attachments from your system. RNIB has made strenuous efforts to ensure that emails and any attachments generated by its staff are free from viruses. However, it cannot accept any responsibility for any viruses which are transmitted. We therefore recommend you scan all attachments. Please note that the statements and views expressed in this email and any attachments are those of the author and do not necessarily represent those of RNIB. RNIB Registered Charity Number: 226227 Website: http://www.rnib.org.uk _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Fw: [NTBUGTRAQ] Win 2003 DNS requests makes replies over 512 byte PIX limit John . Airey (May 09)
- Re: Fw: [NTBUGTRAQ] Win 2003 DNS requests makes replies over 512 byte PIX limit David Terrell (May 09)