Re: draft-ietf-dnsext-forgery-resilience-01.txt

[Wouter Wijngaards <wouter@NLnetLabs.nl>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tony Finch wrote:
> On Mon, 12 Nov 2007, Florian Weimer wrote:
>> Why are ID clashes a problem?
> 
> I'd expect them to cause in the most benign case delays because of
> retries. Or a server might be mistakenly marked as broken, or the client
> might get confused and return bogus data. It depends on how the client
> disambiguates replies to queries and how paranoid it is.

A quick calculation says that a busy resolver, talking to a
forwarder/cache, with 1000 queries per second, each query takes 500 msec
to be answered, that uses a plain random 16bit ID (no extra ports), has
85% chance of having a duplicate ID outstanding, and thus being unable
to disambiguate the reply. That is pretty high, I think the draft can
say something about avoiding these ID clashes.

Best regards,
   Wouter
PS. formula used, p = 1-exp(-n*n*H/2), with n=500, H=65536.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFHOWbRkDLqNwOhpPgRAij/AKCza9IdLGdqVxppySQf0Dgs1j0XNACeKROj
Eim/a3PHTnw2WXf7LDMrWn8=
=qxye
-----END PGP SIGNATURE-----

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>