OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Teardrop2 - still getting DNS bad packets
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Teardrop2 - still getting DNS bad packets

  • To: NTBUGTRAQLISTSERV.NTBUGTRAQ.COM
  • Subject: Re: Teardrop2 - still getting DNS bad packets
  • From: Leon McCalla <mccallaNETROX.NET>
  • Date: Sun, 15 Mar 1998 16:13:06 -0500
  • Comments: To: Russ <Russ.CooperRC.ON.CA>
  • In-Reply-To: <199803151656.LAA24310netrox.net>
  • Reply-To: Leon McCalla <mccallaNETROX.NET>
  • Sender: Windows NT BugTraq Mailing List <NTBUGTRAQLISTSERV.NTBUGTRAQ.COM>
I don't know exactly what returning 24 IP addresses is against but i think
it has something to do with the size of a single UDP packet. There was a
lot of discussion about this issue on the bindNT list about a year ago
with AOL DNS people and MSN DNS people as well. The result was that AOL
reconfigured thier 30+ MX records into 5 or 6 cnames. Each cname was
inturn part of a round robin scheme that had 5 or 6 IPs. The result was
that in a single query to find the address of an AOL mail server you
should not exceede whatever the original limitation was.

You may want to suggest a similar solution to the DNS admin of flycast.com

(not that anything is completely broken but co-operation goes a long way
into making a smoother and faster Internet)

Leon McCalla
leonnetrox.net

> 207.240.24.115 is ns1.flycast.com. Their web server, www.flycast.com,
> uses a round robin DNS that contains 24 IP address'. I've spoken with
> their DNS administrator and we're of the opinion that the MS-NT DNS has
> a problem dealing with that many IP address' in response to a single A
> record.
>
> It would appear to me that having 24 IP address' returned would be
> against RFC 1035 (where I believe its stated the response should be no
> more than 255 characters total), but I'm not sure of this. If this were
> true, I would suspect a lot of DNS servers would be having the same
> problems, but so far I've only seen reports from MS-NT DNS servers.
> Maybe its the fact that they report the event in the Event Logger and
> non-MS DNS servers are just ignoring packets beyond what's acceptable??