Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Fri, Feb 13, 2009 at 03:54:36AM -0500, Dean Anderson wrote:

> Jeff: What I suggest is that you reuse some of the qmerge code to detect
> an attack in progress and then change the affected queries to TCP
> fallback, expiring the UDP queries and removing any results from the
> cache.  So, instead of merging, just count the number of identical
> queries. Any number over some threshold, say 75, indicates an attack in
> progress.

I have neither the time nor the inclination to implement TCP fallback as
you describe.  But djbdns is now in the public domain, as are my
patches. I invite you to implement it yourself based on those works.

-Peff