3 ms·
I imagine the switch over to TCP is more because the response is likely to be larger than a UDP packet (which IIRC is why DNS-over-TCP exists) (looks to be the
by kevinbowman 13y ago
I imagine the switch over to TCP is more because the response is likely to be larger than a UDP packet (which IIRC is why DNS-over-TCP exists) (looks to be the case [1]), as opposed to stopping an amplified reflection attack, but it's a nice side effect.
[1] http://serverfault.com/questions/404840/when-do-dns-queries-use-tcp-instead-of-udp http://serverfault.com/questions/404840/when-do-dns-queries-...
- makomk 13y agoNope. Normal DNS behaviour is to send the first few records over UDP and set the response truncated flag, which would still allow amplified reflection. They're intentionally sending no records at all in order to protect against this.
- kevinbowman 13y agoAh I see, thanks for the clarification.
- colmmacc 13y agoSome name servers include partial rrsets in truncated responses, some decide it's best to omit the entire rrset, some decide it's best to omit that entire section. All of those behaviors are valid (RFC2181 section 9 is about as detailed as it gets). I think there's enough variety that really there's no "normal" for this.