Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky
[email protected] (Paul Jarc)
| Newsgroups | gmane.network.djbdns |
|---|---|
| Organization | What did you have in mind? A short, blunt, human pyramid? |
| Message-ID | <[email protected]> |
Michael Sierchio <[email protected]> wrote: > Paul Jarc wrote: >> qmerge + 200 identical attack queries -> >> dnscache chooses a single new port for a new outgoing query >> >> no-qmerge + 1 attack query -> >> dnscache chooses a single new port for a new outgoing query >> >> I don't see any significant difference between these cases - in >> particular, they seem equally vulnerable to port guessing and to DOS. > > The difference is fairly simple -- the stock behavior is vulnerable > to being flooded with a crafted query, pushing legitimate queries > off the queue. I think this was articulated in a lucid and cogent > manner. Right. But Dean is saying that qmerge is more vulnerable in some other way. That's what I'm asking about. paul