Free Republic
Browse · Search
General/Chat
Topics · Post Article

To: HuntsvilleTxVeteran

This won't be an issue. IPv6 has been in testing for a few years now, and is being phased in slowly. It's a good thing Vista supports it, because in the next few years it will be the standard and IPv4 will be a thing of the past.

If something does go wrong though, it will be on the DNS servers shoulders, because they knew this was coming.


8 posted on 09/07/2006 2:08:48 AM PDT by jaredt112
[ Post Reply | Private Reply | To 1 | View Replies ]


To: jaredt112
If something does go wrong though, it will be on the DNS servers shoulders, because they knew this was coming.

I wonder if it will be possible to turn off this behavior. My RedHat boxes have supported IPv6 for quite a while now, but it is user configurable. If your network is not migrating to IPv6, it makes little sense to be banging your servers for AAAA addresses. 

 

One other consequence to the way MS-Vista is going to be generating DNS packets is that you'll no longer be able to block port 53/TCP at your firewalls.

This is a security mechanism implemented in many places because DNS queries are supposed to be sent as UDP packets. Problem is, with the new naming scheme, the packets are going to be too big to be sent as UDP, so they'll go out as TCP packets instead.

Why is this a big deal? Well, TCP and UDP work in a fundamentally different way. UDP is basically a "fire and forget" technology. You sent a UDP packet into the cloud, and if it gets there, it gets there, and you get a response. There is no followup from the sender.

With TCP data packets, it is a managed transmission, where the sender sends, and the reciever acknowledges. This prevents data from being lost. It's actually a bit more complicated than this, but this is a good working description in a nutshell.

Currently with DNS servers, some types of services, such as zone transfers and the like are sent via TCP. What this means from the point of security, is that in addition to specifying in your Bind configuration which servers you will allow to request entire zones from you, you can also specify rules in firewalls on a default deny rule, meaning that any request on TCP to a given server is denied by default unless is from a specified list. This make it a little bit easier to secure a server. Given how important it is for DNS servers to be secured, because so much communication depends upon them, one would think you would do what you can to maintain that security.

This is a massive oversimplification but is a good working starting point for those who are unfamiliar with these things.

21 posted on 09/07/2006 7:42:33 PM PDT by zeugma (I reject your reality and substitute my own in its place. (http://www.zprc.org/))
[ Post Reply | Private Reply | To 8 | View Replies ]

Free Republic
Browse · Search
General/Chat
Topics · Post Article


FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson