Subject: Re: dictionary attack on nameservers

From: Peter Koch <[email-masked]>
Date: Fri, 13 Aug 2004 11:23:03 +0200

Alex Bligh <[email-masked]> wrote:

> Anyone have an obvious large source of in-addr.arpa PTR
> records that we could do use to extract .de names and get the percentage of
> the total .de zone size that yields (even with false positives)?

given that a very large fraction of the names/zones within DE points to a
relatively small number of IP addresses (which has been a result of the
various hostcounts during recent years), and, in turn, most of the PTR RR
targets then differ only at the third, fourth, fifth level, I'd be surprised
if this approach would change the result dramatically.

-Peter

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Marcos Sanz/Denic <[email-masked]>
Date: Fri, 13 Aug 2004 11:44:01 +0200

> Interesting - is that after a full run? IE you didn't stop because you
> got bored.

That was a full run. It didn't require much patience because the attack 
was performed directly over the zone file and not via DNS queries.

Regards,
Marcos