Re: [dns-operations] That?ll never work?we don?t allow port 53 out | Strategic Cyber LLC

2013-06-21 Thread Jared Mauch
On Jun 21, 2013, at 2:57 PM, "Lawrence K. Chen, P.Eng." wrote: > Wonder about all the other people that run their own DNS (and such) on > campusOne time the physics department was all angry that we (central IT) > had changed the size of a DNS packet to be larger than 512-bytes on them. >

Re: [dns-operations] That?ll never work?we don?t allow port 53 out | Strategic Cyber LLC

2013-06-21 Thread Lawrence K. Chen, P.Eng.
- Original Message - > Jared wrote on 06/21/2013 01:16:14 PM: > > > These things always interest/amuse me when folks try to find a way > > around "airgapped means airgapped" between networks that need to be > > secured. > > Only to get to sites blocked as "security risk" when researchin

Re: [dns-operations] That?ll never work?we don?t allow port 53 out | Strategic Cyber LLC

2013-06-21 Thread WBrown
Jared wrote on 06/21/2013 01:16:14 PM: > These things always interest/amuse me when folks try to find a way > around "airgapped means airgapped" between networks that need to be > secured. Only to get to sites blocked as "security risk" when researching DNSSEC from my desktop. Confidential

Re: [dns-operations] That’ll never work–we don’t allow port 53 out | Strategic Cyber LLC

2013-06-21 Thread Paul Vixie
Jared Mauch wrote: > ... > > These things always interest/amuse me when folks try to find a way around > "airgapped means airgapped" between networks that need to be secured. That > includes removable media. in 1996 or so, an IOCCC entry (didn't win but got honourable mention) used rwho/rupda

Re: [dns-operations] That’ll never work–we don’t allow port 53 out | Strategic Cyber LLC

2013-06-21 Thread Jared Mauch
On Jun 21, 2013, at 7:24 AM, Mike Jones wrote: > http://code.kryo.se/iodine/ allows you to set up a full IP(v4) VPN over DNS. > > Obviously a VPN type setup with IP packet headers and TCP retransmits etc > doesn't help performance compared to a program implementing its own data > channel over

Re: [dns-operations] Resolvers choosing low latency nameservers

2013-06-21 Thread Matthew Pounsett
On 2013/06/21, at 09:27, Matthäus Wander wrote: > Hi, > > are there any studies or anecdotal evidence about how recursive > resolvers select a query destination from a set of authoritative servers > with known RTTs, and how often they re-probe the slower ones? > > Specifically, how many queries

Re: [dns-operations] Resolvers choosing low latency nameservers

2013-06-21 Thread bert hubert
On Fri, Jun 21, 2013 at 02:26:05PM +, Jain, Vipin wrote: > This work, published from Verisign, takes a look at the server selection > algorithms of the various recursive resolvers: > http://www.sigcomm.org/ccr/papers/2012/April/2185376.2185387 For PowerDNS: SyncRes::doResolveAt first shuffle

Re: [dns-operations] Resolvers choosing low latency nameservers

2013-06-21 Thread Jain, Vipin
Hello, Unbound is known to use banding of about 400 msec, and bind 9 also used banding(~128 msec) until 9.8 when they removed it. More information here: https://www.isc.org/blogs/rtt-banding-removal-from-bind-9/ Now they use Smooth RTT. This work, published from Verisign, takes a look at the se

[dns-operations] Resolvers choosing low latency nameservers

2013-06-21 Thread Matthäus Wander
Hi, are there any studies or anecdotal evidence about how recursive resolvers select a query destination from a set of authoritative servers with known RTTs, and how often they re-probe the slower ones? Specifically, how many queries in what period of time would it take until a BIND or Unbound ha

Re: [dns-operations] That’ll never work–we don’t allow port 53 out | Strategic Cyber LLC

2013-06-21 Thread Mike Jones
http://code.kryo.se/iodine/ allows you to set up a full IP(v4) VPN over DNS. Obviously a VPN type setup with IP packet headers and TCP retransmits etc doesn't help performance compared to a program implementing its own data channel over DNS, but it does mean it works with unmodified software. SSH