[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Thank you, Comcast.

Subject: Thank you, Comcast.
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Fri, 26 Feb 2016 07:20:28 +0100 (CET)
In-reply-to: <[email protected]>
References: <1310695257.13597.1456458114690.JavaMail.mhammett@ThunderFuck> <1341162075.13611.1456458371134.JavaMail.mhammett@ThunderFuck> <CAJayEpEU9aNHBnf+dG0KMypZmp7rQx-Ycz321-zWXi5anGfrUQ@mail.gmail.com> <[email protected]>

On Thu, 25 Feb 2016, Jared Mauch wrote:

> Make sure you permit TCP/53 for DNS queries so if TC=1 lookups work.

Speaking of which, historically ISPs have been blocking TCP/135, TCP/445 
and a few others towards customers (at least that's what I know). TCP/25 
seems to be blocked as well.

Why isn't UDP/53 blocked towards customers? I know historically there were 
resolvers that used UDP/53 as source port for queries, but is this the 
case nowadays?

I know providers that have blocked UDP/53 towards customers as a 
countermeasure to the amplification attacks. As far as I heard, there were 
no customer complaints.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

Follow-Ups:
- Thank you, Comcast.
  - From: marka at isc.org (Mark Andrews)
- Thank you, Comcast.
  - From: nanog at ics-il.net (Mike Hammett)
- Thank you, Comcast.
  - From: nick at foobar.org (Nick Hilliard)
- Thank you, Comcast.
  - From: jtk at cymru.com (John Kristoff)

References:
- Thank you, Comcast.
  - From: nanog at ics-il.net (Mike Hammett)
- Thank you, Comcast.
  - From: paras at protrafsolutions.com (Paras Jha)
- Thank you, Comcast.
  - From: jared at puck.nether.net (Jared Mauch)

Prev by Date: Thank you, Comcast.
Next by Date: Thank you, Comcast.
Previous by thread: Thank you, Comcast.
Next by thread: Thank you, Comcast.
Index(es):
- Date
- Thread