[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.BSO.4.51.0309171714450.16428@naughty.monkey.org>
Date: Wed, 17 Sep 2003 17:19:20 -0400 (EDT)
From: Jose Nazario <jose@...key.org>
To: Thor Larholm <thor@...x.com>
Cc: list@...ield.org, bugtraq@...urityfocus.com,
NTBugtraq <NTBUGTRAQ@...TSERV.NTBUGTRAQ.COM>,
full-disclosure@...ts.netsys.com
Subject: Re: Verisign abusing .COM/.NET monopoly, BIND releases new
a number of options exist to help you remedy this issue:
- bind 9.2.3rc2 supports "delegation-only", stopping some
wildcard implementations from making any difference
if you simply want to stop traffic getting there (they are running a
website and a partially functional MTA on that IP):
- you can BGP null route this
http://www.merit.edu/mail.archives/nanog/msg13715.html
- cisco's NBAR functionality may be used to detect and block those
reply packets from coming in by looking for the response from
the nameservers.
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121limit/121e/121e2/nbar2e.htm
note that this wont stop the query from reaching verisign, it will just
stop you from going to that IP. however, for some enforcing network
privacy concerns, that may be worthwhile.
hope this helps,
___________________________
jose nazario, ph.d. jose@...key.org
http://monkey.org/~jose/
Powered by blists - more mailing lists