RE: firewall / DNS question

From: Yiming Gong (yiming@security.zz.ha.cn)
Date: 11/29/01 

From: "Yiming Gong" <yiming@security.zz.ha.cn>
To: "novitiate" <novitiate@perlmonk.org>, <security-basics@securityfocus.com>
Subject: RE: firewall / DNS question
Date: Thu, 29 Nov 2001 14:29:51 +0800
Message-ID: <EIEJLJCFAJCPIDBBOEICMEJNCAAA.yiming@security.zz.ha.cn>

Hey,
I think Richard Stevens ;) has a just answer for your question on his book
<TCP/IP Illustrated>
these are the answer
"When the resolver issues a query and the response comes back with the TC
bit set ("truncated") it means the size of the response exceeded 512 bytes,
so only the first 512 bytes were returned by the server. The resolver
normally issues the request again, using TCP. This allows more than 512
bytes to be returned. (Recall our discussion of the maximum UDP datagram
size in Section 11.10.) Since TCP breaks up a stream of user data into what
it calls segments, it can transfer any amount of user data, using multiple
segments.

Also, when a secondary name server for a domain starts up it performs a zone
transfer from the primary name server for the domain. We also said that the
secondary queries the primary on a regular basis (often every 3 hours) to
see if the primary has had its tables updated, and if so, a zone transfer is
performed. Zone transfers are done using TCP, since there is much more data
to transfer than a single query or response. "

And if you want to limit DNS zone transfers,why not use keyword
"allow-transfer",It can solve you question easily !
e.g.
options {
allow-transfer {ip.of.trust.server;}
        }; 

--
我要更好的生活

Yiming Gong
Senior System Administrator
China Telcom
yiming@security.zz.ha.cn
http://security.zz.ha.cn
0086-0371-7934907

> -----Original Message-----
> From: novitiate [mailto:novitiate@perlmonk.org]
> Sent: Tuesday, November 27, 2001 10:59 PM
> To: security-basics@securityfocus.com
> Subject: firewall / DNS question
>
>
> I want to limit DNS over TCP 53 to the servers that
> do zone transfers with me.  Will this in any way affect
> resolvers that get responses bigger than a UDP packet will
> allow ?  The DNS rfc states that the TC bit is set in the
> DNS header, but it does not specify what if any action is taken
> by the resolver subsequent to that;  i remember hearing that
> the resolver then uses TCP as the transport for the query.
>
> Can anyone help me on this one ?
>
> novitiate
>

Relevant Pages

  • RE: TCP DNS requests
    ... It is a common misconception that TCP DNS is only for zone transfers. ... You must have another DNS server in that network trying to do zone ...
    (Security-Basics)
  • Re: Firewall question
    ... > 53 TCP is not only for zone transfers, but also larger DNS answers. ... all DNS client lookups are done ...
    (comp.security.firewalls)
  • Re: which ports & protocols are necessary?
    ... :None of them use UDP, but don't forget the DNS service, ... only switches to TCP 53 for queries if the response had the "result was ... DNS uses TCP 53 for zone transfers not because going TCP is special but ...
    (comp.security.firewalls)
  • Re: which ports & protocols are necessary?
    ... :None of them use UDP, but don't forget the DNS service, ... only switches to TCP 53 for queries if the response had the "result was ... DNS uses TCP 53 for zone transfers not because going TCP is special but ...
    (comp.security.misc)
  • Re: Global Catalog / Domain Controller loses connection to Exchang
    ... Clients cannot log on to domain controllers that are Windows Server ... DNS can still perform dynamic updates ... Connection-specific DNS Suffix. ... TCP mail2k3:microsoft-ds mail2k3.pastongroup.com:0 LISTENING ...
    (microsoft.public.windows.server.networking)
Loading