Re: [dns-operations] dns-operations Digest, Vol 92, Issue 13

2013-09-11 Thread Paul Vixie
Aaron Campbell wrote: > On 2013-09-11, at 2:30 AM, Paul Vixie wrote: > >> "A DNS UDP responder shall, when transmitting a message which does not >> include embedded cryptographic marks such as TSIG or DNSSEC signatures, use >> an effective DNS message payload size which is calculated as MIN(OF

Re: [dns-operations] dns-operations Digest, Vol 92, Issue 13

2013-09-11 Thread Aaron Campbell
On 2013-09-11, at 2:30 AM, Paul Vixie wrote: > "A DNS UDP responder shall, when transmitting a message which does not > include embedded cryptographic marks such as TSIG or DNSSEC signatures, use > an effective DNS message payload size which is calculated as MIN(OFFERED, > MIN(DISCOVERED, ESTI

[dns-operations] amending 6891-bis

2013-09-11 Thread Jim Reid
On 11 Sep 2013, at 06:30, Paul Vixie wrote: > excuse me, i left an edit out of my earlier proposal. > > This specification does not define a maximum for any future IP transport > protocol, and so both initiators and responders should be prepared to > receive messages as large as the 9 kilobyte e

Re: [dns-operations] DNS Attack over UDP fragmentation

2013-09-11 Thread Stephane Bortzmeyer
On Tue, Sep 10, 2013 at 07:14:04PM +0300, Haya Shulman wrote a message of 187 lines which said: > > the trouble with randomizing the IPID is that this would require > > kernel-level patches (as opposed to just DNS server software > > upgrade), I believe. This makes it somewhat harder to deplo