News for hackers. Stuff that matters.

A comment on The story of a little DNS easter egg.

Re:The story of a little DNS easter egg by kevinbowman on Tuesday August 27, 2013 @07:43AM (#6282836)
I imagine the switch over to TCP is more because the response is likely to be larger than a UDP packet (which IIRC is why DNS-over-TCP exists) (looks to be the case [1]), as opposed to stopping an amplified reflection attack, but it's a nice side effect.

[1] http://serverfault.com/questions/404840/when-do-dns-queries-...

[ Parent | on HN ]
Re:The story of a little DNS easter egg by makomk on Tuesday August 27, 2013 @07:59AM (#6282901)
Nope. Normal DNS behaviour is to send the first few records over UDP and set the response truncated flag, which would still allow amplified reflection. They're intentionally sending no records at all in order to protect against this.
[ Parent | on HN ]
Re:The story of a little DNS easter egg by colmmacc on Tuesday August 27, 2013 @01:40PM (#6284931)
Some name servers include partial rrsets in truncated responses, some decide it's best to omit the entire rrset, some decide it's best to omit that entire section. All of those behaviors are valid (RFC2181 section 9 is about as detailed as it gets). I think there's enough variety that really there's no "normal" for this.
[ Parent | on HN ]
Re:The story of a little DNS easter egg by kevinbowman on Tuesday August 27, 2013 @10:19AM (#6283548)
Ah I see, thanks for the clarification.
[ Parent | on HN ]