3 ms·
Yeah, but it doesn't cost much to accept connections on all ports (AIM did it in the 90s). DPI should be able to easily detect and block non-DNS traffic on por
by toast0 1y ago
Yeah, but it doesn't cost much to accept connections on all ports (AIM did it in the 90s).
DPI should be able to easily detect and block non-DNS traffic on port 53, as well as IP over DNS. Just a matter of configuration effort; but lots of networks lack configuration effort, so it's worth a try.
- sandworm101 1y ago5190 continued well into the 2000s.
- toast0 1y ago5190 was the default port, but if it wasn't open, any other port would work. You could have the client do a scan to try ports until one worked.
- ethbr1 1y agoIt'd be fascinating to get an at-scale timeline of ports blocked from common client connection points. I assume it's drifted over time, but couldn't guess which ways / why. (Other than converging on blocking all non-443)