Re: Open Resolver List, New Orleans, etc..

[Jon Lewis <jlewis () lewis org>]

On Thu, 9 May 2013, Jared Mauch wrote:

> Some interesting data: about 46% of the IPs that respond to a DNS query 
> do not respond from port 53, meaning they are "broken" in some 
> interesting way.

Maybe I'm not being very imaginative, but how can something from !53 be 
considered a DNS response to a query sent to port 53?  Can you give some 
examples of the sorts of packets that fall into this rather large % of 
ill-behaved hosts?  Are you sure you're not treating things like icmp port 
unreachable as a "!udp/53 src response"?

----------------------------------------------------------------------
 Jon Lewis, MCP :)           |  I route
                             |  therefore you are
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________