Re: [DNSOP] Re: [secdir] secdir review of draft-ietf-dnsop-reflectors-are-evil-04.txt (fwd)

2007-10-08 Thread Dean Anderson
On Mon, 8 Oct 2007 [EMAIL PROTECTED] wrote: On Sun, 7 Oct 2007 [EMAIL PROTECTED] wrote: The diagram looks like: Ax Bx || Xa---Xb || LBa--LBb \ / B{1..n} (backend) servers 1 through N On Xa, the preferred path for S is - LBa. On Xb, the preferred

Re: [DNSOP] Re: [secdir] secdir review of draft-ietf-dnsop-reflectors-are-evil-04.txt (fwd)

2007-10-06 Thread Brian Dickson
Brian Dickson wrote: It operates in exactly the same way, as if there were two equal cost routes to two or more routers, each advertising the existence of one of these servers, on the other side of a PPLB router - except that it has the ability to handle the state issue for TCP. Anyone who

Re: [DNSOP] Re: [secdir] secdir review of draft-ietf-dnsop-reflectors-are-evil-04.txt (fwd)

2007-10-04 Thread Dean Anderson
On Thu, 4 Oct 2007, Brian Dickson wrote: bill fumerola wrote: not all load balancers work the same. direct server return aka one-arm load balancing does no translation or rewrite of any headers (l3 or l4). all it does is make a switching decision based on health check and other weighting

Re: [DNSOP] Re: [secdir] secdir review of draft-ietf-dnsop-reflectors-are-evil-04.txt (fwd)

2007-10-04 Thread bill fumerola
On Wed, Oct 03, 2007 at 08:10:03PM -0400, Dean Anderson wrote: But none of this is relevant to the claims that Hickson made. no, but they're directly relevant to the claims that you made: direct server return aka one-arm load balancing does no translation or rewrite of any headers (l3 or l4).

Re: [DNSOP] Re: [secdir] secdir review of draft-ietf-dnsop-reflectors-are-evil-04.txt (fwd)

2007-10-04 Thread Dean Anderson
On Thu, 4 Oct 2007, bill fumerola wrote: On Wed, Oct 03, 2007 at 08:10:03PM -0400, Dean Anderson wrote: But none of this is relevant to the claims that Hickson made. no, but they're directly relevant to the claims that you made: direct server return aka one-arm load balancing does no

Re: [DNSOP] Re: [secdir] secdir review of draft-ietf-dnsop-reflectors-are-evil-04.txt (fwd)

2007-10-04 Thread Dean Anderson
On Thu, 4 Oct 2007, bill fumerola wrote: i just must be a fraud and liar, not to mention a junior sysadmin. There's nothing wrong with being a junior admin. I was one once, too. I was a programmer before I was an admin, and I sort of became an admin because I screwed up. Well, this wasn't my

Re: [DNSOP] Re: [secdir] secdir review of draft-ietf-dnsop-reflectors-are-evil-04.txt (fwd)

2007-10-03 Thread Dean Anderson
On Tue, 2 Oct 2007, John Kristoff wrote: On Tue, 2 Oct 2007 21:59:33 -0400 (EDT) Dean Anderson [EMAIL PROTECTED] wrote: In fact, using authority servers is _less_ risk to the abuser, because to compose the reflector attacks, s/he has to crack into a server, craft a record, One can

Re: [DNSOP] Re: [secdir] secdir review of draft-ietf-dnsop-reflectors-are-evil-04.txt (fwd)

2007-10-03 Thread Andrew Sullivan
On Wed, Oct 03, 2007 at 12:33:09PM -0400, Dean Anderson wrote: Then GROW considers an Anycast Draft, by your company. Just as a point of information, Afilias (in any of its guises -- Afilias Canada, Afilias USA, c. c.) has never written any Internet Draft. Afilias does employ people who are

Re: [DNSOP] Re: [secdir] secdir review of draft-ietf-dnsop-reflectors-are-evil-04.txt (fwd)

2007-10-03 Thread bill fumerola
On Wed, Oct 03, 2007 at 12:33:09PM -0400, Dean Anderson wrote: No, that isn't anycast. A loadbalancer is actually a stateful NAT with several different hosts behind the load balancing NAT. Those loadbalancer devices you buy from cisco and other companies are specialized NAT boxes. The servers

Re: [DNSOP] Re: [secdir] secdir review of draft-ietf-dnsop-reflectors-are-evil-04.txt (fwd)

2007-10-03 Thread Dean Anderson
On Wed, 3 Oct 2007, bill fumerola wrote: On Wed, Oct 03, 2007 at 12:33:09PM -0400, Dean Anderson wrote: No, that isn't anycast. A loadbalancer is actually a stateful NAT with several different hosts behind the load balancing NAT. Those loadbalancer devices you buy from cisco and other

Re: [DNSOP] Re: [secdir] secdir review of draft-ietf-dnsop-reflectors-are-evil-04.txt (fwd)

2007-10-03 Thread Brian Dickson
bill fumerola wrote: not all load balancers work the same. direct server return aka one-arm load balancing does no translation or rewrite of any headers (l3 or l4). all it does is make a switching decision based on health check and other weighting criteria. Just to clarify, for those who

Re: [DNSOP] Re: [secdir] secdir review of draft-ietf-dnsop-reflectors-are-evil-04.txt (fwd)

2007-10-02 Thread Brian Dickson
Dean Anderson wrote: The load balancer is really just a special kind of stateful NAT. No. Load balancers can load balance, without any translation being done at all. And a load balancer is by definition doing *anycast*. The same address is used as a destination, and the packets are