Re: "honeyports"

David,

I saw your proposal.

I don't think it's necessary to dedicate specific ports, all you need to do is to take note when an incorrect ID is detected in the packet header, for example keep a count of the number seen over a fixed time period ( say the last 20 seconds ).

Then "additional measures" are taken according to how high the count is.

I have made a resolver that does this ( http://www.george-barwood.pwp.blueyonder.co.uk/DnsServer/ ), it uses query repetition ( as recommended by DJB at http://cr.yp.to/djbdns/forgery.html ), and the level of repetition increases when incorrect IDs are seen.

It doesn't defend against in-path attacks ( server-side changes are required for that, DNSSEC/DNSCurve ), but does at least defeat out-of-path attacks, which is a significant practical benefit.

George Barwood

----- Original Message ----- 
From: "David Nicol" <[email protected]>
To: "djbdns" <[email protected]>
Sent: Thursday, May 28, 2009 6:58 AM
Subject: "honeyports"


> "honeyports" dns security enhancement proposal now available at
> http://davidnicol.diaryland.com/honeyports.html
> 
> abstract: add additional random listen-only ports and get suspicious of
> unrequested information arriving on them.
>