Subject: [Ecrit] LoST issue: authoritative answer only, please

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 8 Nov 2006 11:19:49 -0800

Should there be a query flag that allows a seeker to specify that it  
would like the resolver to obtain an authoritative answer  
(recursively) from the authoritative mapping server (AMS), rather  
than a cached answer?

In favor:
    Can bypass broken caches and allows easier debugging.

Against:
   (1) Possibly dangerous tool that exposes the tree infrastructure  
to a much higher load if used indiscriminately.
   (2) Can be approximated by redirect mode.

Henning

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: John Schnizlein <[email-masked]>
Date: Wed, 8 Nov 2006 14:06:09 -0800

Recreating the problems that DNS has with recursion for this protocol 
seems unwise, especially just as draft-ietf-dnsop-reflectors-are-evil 
is in Last Call in DNS-OP.

At the very least, any recursion-desired flag should be accompanied by 
a flag that indicates the server's recursion-available status.  If this 
approach is taken, the advice for mitigating denial-of-service in 
"reflectors-are-evil" should be included.

John

On Nov 8, 2006, at 11:19 AM, Henning Schulzrinne wrote:

> (recursively) from the authoritative mapping server (AMS), rather than 
> a cached answer?
>
> In favor:
>   (1) Possibly dangerous tool that exposes the tree infrastructure to 
> a much higher load if used indiscriminately.

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 8 Nov 2006 14:12:16 -0800

Please note in the introduction of that draft:

asides perhaps the fact that DNS relies heavily on
    UDP, the easy abuse of which is at the source of the problem.

Currently, only TCP has been specified as a transport protocol,  
although we've obviously had proposals to provide LoST-over-UDP as  
well. Any such proposals presumably would have to worry about the  
reflector attacks mentioned in the draft you cite. Thanks for  
providing the reference.

On Nov 8, 2006, at 2:06 PM, John Schnizlein wrote:

> Recreating the problems that DNS has with recursion for this  
> protocol seems unwise, especially just as draft-ietf-dnsop- 
> reflectors-are-evil is in Last Call in DNS-OP.
>
> At the very least, any recursion-desired flag should be accompanied  
> by a flag that indicates the server's recursion-available status.   
> If this approach is taken, the advice for mitigating denial-of- 
> service in "reflectors-are-evil" should be included.
>
> John
>
>> Should there be a query flag that allows a seeker to specify that  
>> it would like the resolver to obtain an authoritative answer

---

From: Andrew Newton <[email-masked]>
Date: Wed, 8 Nov 2006 21:14:16 -0500

> (recursively) from the authoritative mapping server (AMS), rather  

Considering that a resolver may just disallow/ignore this flag for  
load purposes, I don't think it is worth it.  Plus, if a seeker  
really needs this type of information, then it could use the  
information in the <via> to do its own investigation.  I don't see  
this flag of use in normal operation.

-andy