Discuss mailing list

[Larry Brower <larry AT maxqe.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 12/28/2010 10:01 PM, Christopher wrote:
> Have you tried adding a second rule for TCP connections? Usually
> they're not used, but if it's some sort of botnet it may be configured
> to try both to increase its chances of success. This would also cause
> higher bandwidth usage. Of course, this assumes the server accepts TCP
> connections.
> 


TCP will get used now because of DNSSEC and more and more recursive
servers validating DNSSEC signatures.


For instance if you do dig -tANY isc.org you will get back not only the
resource records but also the DNSSEC signature records which makes for a
large response


;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Dec 28 22:05:42 2010
;; MSG SIZE  rcvd: 5160
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBCgAGBQJNGrOoAAoJEBgaXYoZ++875+UH/js/enrc67lzRfqOd21LatrB
tE7/ojBXZrN8z3OMkOxax96JipddPvrqhcHrZGvf1GAe20N4jNkVq6OptMJXz79G
v8Ak3w/q8hsW4KUk+X2foqunC5M2o5WDLv+/xt9L8GD1dg1iMnwQU/Sk1YvIeopT
lV7pqh69GzXYgxY7Ndl7unGeGb3zgvcCZ90la2eixmfsP+sofl1li9iJnUl4yp/t
3SUJeshkup+ADWnod6CiLwcMuTfv2jT3geM9nMVf3T45SmE/mLDVt6a1A+i5Tnwb
8ZEoG6YkfDZ2ssGr4Pb5ZIp9o+oz2+LmcxkSjZrAtmNrM7uNZ9iukfQfnj3Jyqc=
=kKaW
-----END PGP SIGNATURE-----