Subject: [DNSOP] An efficient method to publish ranges of IP addresses in the DNS

From: John Levine <[email-masked]>
Date: 22 Dec 2010 04:49:24 -0000

We all know how DNSBLs and DNSWLs work for IPv4 addresses, just like
rDNS only with A or TXT records rather than PTR.

When I wrote RFC 5782 I assumed the same thing would work for IPv6
addresses.  But I was wrong -- the address space is so big that a
modestly hostile opponent can use a different IP address for each
message, which would cause disastrous cache behavior and equally
disastrous amounts of traffic to the DNSBL's servers.

So I came up with an entirely different way to store and query the
data in the DNS, which as far as I can tell will have excellent
performance and cache behavior, even if bad guys are hopping all over
the IP address space.  Take a look, tell me if I'm nuts:

http://www.ietf.org/id/draft-levine-iprangepub-00.txt

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 22 Dec 2010 09:06:35 +0100

On Wed, Dec 22, 2010 at 04:49:24AM -0000,
 John Levine <[email-masked]> wrote 

> http://www.ietf.org/id/draft-levine-iprangepub-00.txt

It seems an excellent idea. The DNS will be used only as a store and
the (relatively) complicated logic will be in the client.

Two small nits:

1) the attack you describe (a bad guy using all the addresses in its
/64 to send spam) may have limits, for instance in the ND cache of its
router which may become full soon. It is possible that the bad guy
will have to rate-limit its churn. AFAIK, there have not been a
serious experimental test of this attack, only guesses that it may be
possible.

2) I suggest to completely drop the acronym CIDR, which is not
necessary in IPv6, which was always classless.

---

From: Rémi Després <[email-masked]>
Date: Wed, 22 Dec 2010 11:10:15 +0100

Le 22 déc. 2010 à 09:06, Stephane Bortzmeyer a écrit :

>> Take a look... http://www.ietf.org/id/draft-levine-iprangepub-00.txt
> 
> ... I suggest to completely drop the acronym CIDR, which is not

1. 
May I suggest "prefix" in place of "CIDR range"

2. 
Also, as a range is typically defined by first and last value, I believe the title might better avoid the word.
It could be, for example:
"An efficient method to publish IP-address prefixes in the DNS"

Regards,
RD

---

From: "John R Levine" <[email-masked]>
Date: 22 Dec 2010 09:53:11 -0500

> the (relatively) complicated logic will be in the client.

Thanks.

> serious experimental test of this attack, only guesses that it may be

Given the size of zombie pools, the rate from each one doesn't have to be 
very fast.  If you have 100,000 hosts, and each one sends one message a 
minute, you can still send 3 million messages/hour.

> necessary in IPv6, which was always classless.

Is there a standard term for a range of addresses with the same prefix 
other than "a range of addresses with the same prefix"?

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
"I dropped the toothpaste", said Tom, crestfallenly.

---

From: Arturo Servin <[email-masked]>
Date: Wed, 22 Dec 2010 18:25:45 -0200

On 22 Dec 2010, at 12:53, John R Levine wrote:
> Is there a standard term for a range of addresses with the same prefix other than "a range of addresses with the same prefix"?

	Contiguous? contiguous address space?

	Haven't read the draft yet, so not sure if this word is what you are looking for.

regards,
as

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: John Levine <[email-masked]>
Date: 29 Dec 2010 16:54:29 -0000

I've done another version, with mostly editorial changes.  Comments
as always welcome.  Now I suppose I should implement it.

http://tools.ietf.org/html/draft-levine-iprangepub-01

Regards,