Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On 2/27/09, Paul Jarc <[email protected]> wrote:
> If dnscache is under a high load (200 ports in use), you can make a
> qmerge-patched dnscache forget about its previous ports and start
> using just one new one.  But look at dnscache.c:u_drop() - dnscache
> doesn't do anything to tell the kernel to forget about those previous
> ports. > Dean Anderson <[email protected]> wrote:

> paul
>

I looked at the code and unless I am missing something flooding
dnscache will not just allow an attack. It will run it out of file
descriptors, requireing a restart, long before an attack could succeed
! The fd of sockets pushed off the queue are never closed.  This seems
to make the whole argument moot.