Full Disclosure mailing list archives
Re: Fw: [NTBUGTRAQ] Win 2003 DNS requests makes replies over 512 byte PIX limit
From: David Terrell <dbt () meat net>
Date: Sat, 10 May 2003 00:15:29 -0500
On Fri, May 09, 2003 at 09:47:01AM +0100, John.Airey () rnib org uk wrote:
I've mentioned this issue before on this list (see the thread "SQL Slammer - lessons learned"), but I'll repeat it again. Your internal resolver only needs to connect to port 53 of external machines to send email to them. The connection back to your machine will be on a higher port. The Pix will use stateful filtering to allow the connection to the higher port (ie it detects that the connection was originated from the inside). Try "show conn prot udp" (or "show conn") on the firewall to see where the connections are really going. Even "netstat -a" on the server should give you some information about connections.
'protocol fixup dns 53' (from memory, I fortunately no longer admin PIX firewalls for a living...) would affect both incoming and outgoing DNS packets, regardless of what the outgoing query port was... -- David Terrell | Prime Minister, NebCorp | Gary Hart for President! dbt () meat net | http://www.garyhartnews.com/hart/ http://wwn.nebcorp.com | _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Fw: [NTBUGTRAQ] Win 2003 DNS requests makes replies over 512 byte PIX limit John . Airey (May 09)
- Re: Fw: [NTBUGTRAQ] Win 2003 DNS requests makes replies over 512 byte PIX limit David Terrell (May 09)