Subject: [dnsop] I-D ACTION:draft-ietf-dnsop-reflectors-are-evil-02.txt

From: [email-masked]
Date: Tue, 19 Sep 2006 15:50:02 -0400

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.
This draft is a work item of the Domain Name System Operations Working Group of the IETF.

	Title		: Preventing Use of Recursive Nameservers in Reflector Attacks
	Author(s)	: J. Damas, F. Neves
	Filename	: draft-ietf-dnsop-reflectors-are-evil-02.txt
	Pages		: 8
	Date		: 2006-9-19
	
This document describes the use of default configured recursive
   nameservers as reflectors on DOS attacks.  Recommended configuration
   as measures to mitigate the attack are given.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dnsop-reflectors-are-evil-02.txt

To remove yourself from the I-D Announcement list, send a message to 
[email-masked] with the word unsubscribe in the body of 
the message. 
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the 
username "anonymous" and a password of your e-mail address. After 
logging in, type "cd internet-drafts" and then 
"get draft-ietf-dnsop-reflectors-are-evil-02.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-dnsop-reflectors-are-evil-02.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Frederico A C Neves <[email-masked]>
Date: Tue, 19 Sep 2006 21:21:42 -0300

> 	Filename	: draft-ietf-dnsop-reflectors-are-evil-02.txt
...

This -02 version address comments on the mailing list and the 3 [1]
open issues raised during the meeting in Montreal and they should be
considered closed by now.

Diffs could be found at http://tinyurl.com/kzdzz [2]

- The title is the one suggested by the editors.
- There is no recommendation on the draft on how to respond to
  non-authenticated clients.
- Added SIG(0) as alternative authentication mechanism.

- Acronym change from PRNS to ORNS
- response size to response packet size
- Added Interface based authentication

Fred

[1] https://rt.psg.com/Ticket/Display.html?id=1341
    https://rt.psg.com/Ticket/Display.html?id=1342
    https://rt.psg.com/Ticket/Display.html?id=1343
[2] http://tools.ietf.org/wg/dnsop/draft-ietf-dnsop-reflectors-are-evil/draft-ietf-dnsop-reflectors-are-evil-02-from-01.diff.html

.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Joe Abley <[email-masked]>
Date: Wed, 20 Sep 2006 10:15:44 -0400

> - response size to response packet size

This is a very minor nit, but since both a single request and a  
single response could each be carried using more than one packet  
(e.g. through fragmentation) I think "message size" is better than  
"packet size".

I have no substantive concerns with -02 otherwise, and if a last call  
were to be issued I would say "it is ready, send it away". :-)

Joe

.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 25 Sep 2006 10:34:19 +0200

On Tue, Sep 19, 2006 at 03:50:02PM -0400,
 [email-masked] <[email-masked]> wrote 

> 	Filename	: draft-ietf-dnsop-reflectors-are-evil-02.txt

I've read it and I find no issues in it and I support it going
forward. 
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html