Re: DNS ports and scans

["Crist Clark" <crist.clark () globalstar com>]

Frijole wrote:
> There is one major downside to blocking TCP port 53 - some Microsoft clients
> will not be able to do host lookups properly. I have seen this on NT 4.0
> with OP4 installed. The SMTP service was polling the dns server using TCP,
> not UDP. Searching http://support.microsoft.com I found an obscure article
> (that I wish I had saved) which stated that according to the RFC, both TCP
> and UDP connections should be allowed on public DNS servers. Once I opened
> TCP, the SMTP was able to resolve properly and send messages.

It is not a Microsoft issue. The RFC does say that. See RFC1035, sections
4.2.1 and 4.2.2. The MX record that your SMTP server was trying to pull 
down was probably more than 512 bytes, thus it resorted to TCP.
-- 
Crist J. Clark                                Network Security Engineer
crist.clark () globalstar com                    Globalstar, L.P.
(408) 933-4387                                FAX: (408) 933-4926

The information contained in this e-mail message is confidential,
intended only for the use of the individual or entity named above.  If
the reader of this e-mail is not the intended recipient, or the employee
or agent responsible to deliver it to the intended recipient, you are
hereby notified that any review, dissemination, distribution or copying
of this communication is strictly prohibited.  If you have received this
e-mail in error, please contact postmaster () globalstar com