Bugtraq mailing list archives
Re: Verisign abusing .COM/.NET monopoly, BIND releases new
From: Jose Nazario <jose () monkey org>
Date: Wed, 17 Sep 2003 17:19:20 -0400 (EDT)
a number of options exist to help you remedy this issue: - bind 9.2.3rc2 supports "delegation-only", stopping some wildcard implementations from making any difference if you simply want to stop traffic getting there (they are running a website and a partially functional MTA on that IP): - you can BGP null route this http://www.merit.edu/mail.archives/nanog/msg13715.html - cisco's NBAR functionality may be used to detect and block those reply packets from coming in by looking for the response from the nameservers. http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121limit/121e/121e2/nbar2e.htm note that this wont stop the query from reaching verisign, it will just stop you from going to that IP. however, for some enforcing network privacy concerns, that may be worthwhile. hope this helps, ___________________________ jose nazario, ph.d. jose () monkey org http://monkey.org/~jose/
Current thread:
- Verisign abusing .COM/.NET monopoly, BIND releases new Thor Larholm (Sep 17)
- Re: Verisign abusing .COM/.NET monopoly, BIND releases new Jose Nazario (Sep 17)
- Re: Verisign abusing .COM/.NET monopoly, BIND releases new SR (Sep 17)
- Re: Verisign abusing .COM/.NET monopoly, BIND releases new Damaged Industries (Sep 17)
- RE: Verisign abusing .COM/.NET monopoly, BIND releases new bugtraq (Sep 18)
- Re: Verisign abusing .COM/.NET monopoly, BIND releases new Damaged Industries (Sep 17)