Re: DNS DoS ???

["Dobbins, Roland" <rdobbins () arbor net>]

On Aug 1, 2011, at 9:22 AM, Mark Andrews wrote:

> And even if DNS/TCP was use by default machines can still get DoS'd because IP is spoofable.

They can be DDoSed with spoofed or non-spoofed packets, and there are defenses against such attacks.  

Apologies if I was unclear - my point was that huge, crushing, multi-gigabit-per-second DNS reflection/amplification 
attacks would no longer be possible with a TCP-only DNS, and that there would be other benefits, as well.  Large-scale 
testing of TCP-only DNS would be quite informative, IMHO.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins () arbor net> // <http://www.arbornetworks.com>

                The basis of optimism is sheer terror.

                          -- Oscar Wilde