using TCP53 for DNS

Tue Apr 26 19:04:25 UTC 2005

On Apr 26, 2005, at 2:45 PM, Florian Weimer wrote:

> * Patrick W. Gilmore:
>
>> At least one DoS mitigation box uses TCP53 to "protect" name
>> servers.  Personally I thought this was a pretty slick trick, but it
>> appears to have caused a lot of problems.  From the thread (certainly
>> not a scientific sampling), many people seem to be filtering port 53
>> TCP to their name servers.
>>
>
> "To their name servers"?  I think you mean "from their caching
> resolvers to 53/TCP on other hosts".

Either.  Both.

>> Is this common?
>
> Hopefully not.  Resolvers MUST be able to make TCP connections to
> other name servers.

I hope not as well, but people have posted here that they are doing  
so.  Which is why I am asking. :-)

>> Does anyone have stats on this (roots, GTLDs, other big name server
>> farms)?
>
> What kind of stats?  I might be able to provide some statistics about
> TC flag usage, but I doubt that this data is interesting.

I am interested in how many name servers - caching or authoritative -  
are filtering incoming and/or outgoing TCP port 53.

_Personally_ I am most interested in what percentage of caching name  
servers are incapable (either because of filters, software  
limitations, or any other reason) of making TCP queries.

More generally, I am interested in how many name servers are  
filtering TCP53 in any direction.

-- 
TTFN,
patrick