[apps-discuss] Apps-team review of draft-ietf-dnsop-as112-under-attack-help-help-05

S Moonesamy <sm+ietf@elandsys.com> Sat, 16 April 2011 17:19 UTC

Message-Id: <6.2.5.6.2.20110416073707.04f64b78@elandnews.com>
Date: Sat, 16 Apr 2011 08:28:51 -0700
To: apps-discuss@ietf.org
From: S Moonesamy <sm+ietf@elandsys.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format="flowed"
Cc: Peter Koch <pk@DENIC.DE>, Joe Abley <joe.abley@icann.org>, iesg@ietf.org
Subject: [apps-discuss] Apps-team review of draft-ietf-dnsop-as112-under-attack-help-help-05
Precedence: list

I have been selected as the Applications Area Review Team reviewer 
for this draft (for background on apps-review, please see 
http://www.apps.ietf.org/content/applications-area-review-team).

Please resolve these comments along with any other Last Call comments 
you may receive. Please wait for direction from your document 
shepherd or AD before posting a new version of the draft.

Document: draft-ietf-dnsop-as112-under-attack-help-help-05
Reviewer: S. Moonesamy
Review Date: April 16, 2011
IETF Last Call Date: 2011-04-11
IESG Telechat Date: 2011-04-28

Summary:

This draft is ready for publication as an Informational RFC.

The draft provides background information and technical advice to 
firewall operators about DNS answers from AS112 servers.

Major Issues:

None

Minor Issues:

None

Nits:

In Section 4:

   'From the perspective of the public DNS, these queries are junk --
    they cannot be answered usefully and result in unnecessary traffic
    being received by the nameservers which underpin the operation of
    the public DNS (the so-called root servers which serve
    "IN-ADDR.ARPA")'

According to RFC 5855, the (DNS) root servers no longer server 
"IN-ADDR.ARPA". See output from dig:

   ;; QUESTION SECTION:
   ;in-addr.arpa.                  IN      NS

   ;; ANSWER SECTION:
   in-addr.arpa.           29139   IN      NS      a.in-addr-servers.arpa.
   in-addr.arpa.           29139   IN      NS      f.in-addr-servers.arpa.
   in-addr.arpa.           29139   IN      NS      e.in-addr-servers.arpa.
   in-addr.arpa.           29139   IN      NS      c.in-addr-servers.arpa.
   in-addr.arpa.           29139   IN      NS      d.in-addr-servers.arpa.
   in-addr.arpa.           29139   IN      NS      b.in-addr-servers.arpa.

I suggest a minor change with a reference to RFC 5855:

  (the so-called reverse servers which serve "IN-ADDR.ARPA" [RFC 5855])

   'These servers are deployed in many places in a loosely-coordinated
    effort known as the "AS112 Project".  More details about the AS112
    Project can be found at <http://www.as112.net/>.'

I suggest moving the last sentence into an informational reference:

    These servers are deployed in many places in a loosely-coordinated
    effort known as the "AS112 Project" [AS112-Project].

   [AS112-Project] AS112 Project <http://www.as112.net/>

In Section 10:

   "The purpose of this document is to help site administrators properly
    identify traffic received from AS112 nodes, and to provide background
    information to allow appropriate measures to be taken in response to
    it."

I suggest moving the above paragraph to the Introduction Section as 
it does not fit under Security Considerations.

Regards,
S. Moonesamy

[apps-discuss] Apps-team review of draft-ietf-dns… S Moonesamy