🚀 go-pugleaf

Bill Johnston <wdj-netconsult@consultant.com> wrote in message news:<Xns93C294B29ED49wdjohnstoncomcastnet@206.127.4.25>...
> [posted and mailed]
> 
> "jankemi(remove)" <"jankemi(remove)"@mail.com> wrote in news:LqFTa.116237
> $wk6.30285@rwcrnsc52.ops.asp.att.net:
> 
> > Bill Johnston wrote:
>  
> >> [...] certain well-known TCP ports.
>  
> > IP Protocols, not TCP ports.
> 
> Whoa!  Perhaps you should alert the IANA
> as well.  It is almost as if we've all been 
> using the same terminology for the past 
> twenty-five years and we all know what 
> we mean by it.  Perhaps it's a conspiracy?
>  

IP protocols and TCP ports are not the same thing.  I don't think IANA
will need to be alerted to this fact.

> > Cisco's alert was revised last week to include specific ACL's that will 
> > stop the attack. Our ACL's went in last Thursday evening.
> 
> The problem with these ACLs - "Transit ACLs", 
> to be precise, is that when applied to edge 
> routers earlier than 75xx or 12xxx series,
> the recommended line:
> 
> access list ### 101 deny 53 any any
> 
> means that DNS requests get blocked, with no
> workaround available.  If you happen to be an 
> organization that handles its own external DNS, 
> this is ungood.  Cisco acks this fact in the 
> advisory:
> 
> http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml
> 
> by noting in italics that:
> 
> "ACLs can have performance impact on certain platforms, 
> so care should be taken when applying the recommended 
> workarounds."
> 
> <<SNIP>>

This does not affect DNS in any manner whatsoever.  If we were talking
TCP ports, then yes, it would.  But we are talking about IP protocols
here, and 53 does not correspond to DNS.  What Cisco acknowledges in
the above quote is that access lists can have performance impacts
because all packets must be compared to them, not because there was
anything related to DNS.