* Douglas Otis:
Just using TCP would prevent most of the DNS poisoning attacks that
Amir's paper reports.
TCP is prone to DDoS attack.
Only when implemented naively. If the client does not split the query
into two packets or artificially lowers the window size, you can
answer it without creating any state.
The argument against TCP is not the protocol. It's just that you have
to upgrade both authoritative servers and resolvers to make it work
well.
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg