Re: Large DNS scans from 211.53.208.178

[RichardS () ADV NET NZ (Richard Stevenson)]

On 1 May 2000, at 1:49, Seth Georgion wrote:

> This is very common, especially from Korea and should be seen as obvious
> attempts to find Zone Transferable hosts and should be secured against by
> disallowing Unauthorized Zone Transfers. Of course any one who has an even
> minimal computer education should be aware that all zone transfers are by
> nature TCP based and that all DNS Lookups are by nature UDP based. Thus it
> would follow that no one, not even the village idiot, would allow TCP 53
> through the firewall.

That's not quite correct.  UDP-based DNS replies have a maximum size (about
500 bytes, IIRC), beyond which they include a flag stating that the reply
was truncated.  The client resolver may then query again using TCP, which
allows larger replies, to get the complete data set they asked for.

Regards

Richard