Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

Paul Jarc wrote:

> qmerge + 200 identical attack queries ->
>   dnscache chooses a single new port for a new outgoing query
> 
> no-qmerge + 1 attack query ->
>   dnscache chooses a single new port for a new outgoing query
> 
> I don't see any significant difference between these cases - in
> particular, they seem equally vulnerable to port guessing and to DOS.

The difference is fairly simple -- the stock behavior is vulnerable
to being flooded with a crafted query, pushing legitimate queries
off the queue.  I think this was articulated in a lucid and cogent
manner.

The qmerge patch is makes the system more robust.