On Wed, Sep 30, 2009 at 11:44 AM, David Ball <[email protected]> wrote:
> If I'm not mistaken, this year's migration to DNS servers > supporting randomized source UDP ports (based on the Kaminsky thing) > may throw a wrench into some notions of filtering UDP traffic across > their network. I know we had issues with it. > > > On Wed, Sep 30, 2009 at 5:09 AM, Masood Shah <[email protected]> > wrote: > > > >> > >> If you are REALLY paranoid, you can DROP all UDP traffic and then only > open > >> the ports that you have services running on. Sometimes this is easier > said > >> than done though. > I think it really boils down to whether you are filtering Source Ports vs. Destination Ports. In the DNS case, there is rarely a need to block Source Ports, but it certainly would be prudent in certain circumstances to allow Destination Port 53 and then block everything else. Those who support this model shouldn't be affected by the newer versions of BIND and other resolvers which support larger Source Port pools... (BTW, I am talking from the perspective of a DNS provider... if we're dealing with a customer side filtering inbound traffic, the above model should be reversed). -- Stefan Fouant _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
