DNS problems to RoadRunner - tcp vs udp
justin at justinshore.com
Fri Jun 13 19:59:48 UTC 2008
Jon Kibler wrote:
> Various hardening documents for Cisco routers specify the best practices
> are to only allow 53/tcp connections to/from secondary name servers.
> Plus, from all I can tell, Cisco's 'ip inspect dns' CBAC appears to only
> handle UDP data connections and anything TCP would be denied. From what
> you are saying, the hardening recommendations are wrong and that CBAC
> may break some DNS responses. Is this correct?
A number of Cisco default from years gone by would break DSN, today, in
it's current form. Such as how PIXs and ASAs with fixup/DPI would block
udp/53 packets larger than 512 bytes, not permitting EDNS packets through.
> Also, other than "That's what the RFCs call for," why use TCP for data
> exchange instead of larger UDP packets?
More information about the NANOG