Re: Dns tunnel detection/prevention

Grant Taylor via bind-users <[email protected]>
Newsgroups gmane.network.dns.bind9.user
Message-ID <f0b62c5b-28d1-470a-9883-a65c728ca943__15072.2548760072$1748053485$gmane$org@spamtrap.tnetconsulting.net>
On 5/23/25 8:53 PM, Fred Morris wrote:
> If you fail in an outright, reproducible, measurable fashion you give 
> your opponent predictability and confidence. As a defender you want to 
> undermine that and look like an under-resourced, poorly administered 
> network that somehow, we don't know exactly how but somehow: it's just 
> bad luck. There's a crappy network and every time your adversary messes 
> with it they just have inexplicable bad luck.

I understand the active and hidden (as in not overtly obvious) defender 
mentality.  But sometimes doing that brings it's own complexities and 
vulnerabilities.

There's also the fact that allowing a small percentage to leak through 
as the hey you beat the odds on a bad network link, is still allowing 
things to leak through.

Different environments have different security posture and are willing 
to tolerate different things.



-- 
Grant. . . .
-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
[email protected]
https://lists.isc.org/mailman/listinfo/bind-users
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.