Subject: Re: dictionary attack on nameservers

From: [email-masked] (Ted Lindgreen)
Date: Thu, 29 Jul 2004 11:28:08 +0200

[Quoting Jay Daley, on Jul 29, 10:47, in "Re: dictionary attac ..."]

> If someone really has done this against a large zone then please let us 
> know.  If you want to test it against ours then please let me know so that 
> we can prepare for it.

I am not sure what you call "a large zone", so also not if .nl
qualifies (it is in the top-5 or so of largest zones, but, of
course, much smaller than .com).
The .nl domain has some 1.3M delegations, some 30k domains are
newly registered and some 5k are released per month (from data
over the first few months of 2004).

I know of a number of registrars who keep daily updated, and
very accurate lists of registrered and returned domain names.
For .nl and also for other TLDs.

These guys use various techniques to keep their lists accurate
and up-to-date. Although highly effective, these techniques are
neither complicated, nor costly for the registrar.
However, their load the .nl nameservers is significant, and thus
one can easily see and determime who/what is causing it in the
nameserver-traces which we routinely investigate in our testlab.

As for your second question: I do not think that any preparation
by your side is needed for us to "attack" your TLD, as the load
of our "attack" on the .nl zone was not even noticed (but will,
of course, be clearly visible in the nameserver-traces).

Regards,
-- ted

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jay Daley <[email-masked]>
Date: Thu, 29 Jul 2004 11:38:07 +0100

Ted

> over the first few months of 2004).

That will do.

> nameserver-traces which we routinely investigate in our testlab.

With respect this is still anecdotal.  Where is the real data?  i.e. "By 
dictionary attack X managed to guess Y% of the 1.3m names".

Jay

---

From: "Jay Daley" <[email-masked]>
Date: Thu, 29 Jul 2004 11:37:45 +0100

[ Moderators note: This post needed manual approval.

   Either because it was posted by a non-subscriber or because it contained
   to many characters (> 20000).

   With the massive amount of spam, it is easy to miss and therefore
   delete posts that need manual approval.

   Please fix your subscription addresses or shorten your postings by adding 
   links instead of attachments ] 

Ted

That will do.

Jay