On Jul 9, 2008, at 4:53 AM, Rod Whitworth wrote:

quoted text
>

>

> # tcpdump -nettti rl0 dst port 53

> tcpdump: listening on rl0, link-type EN10MB

> Jul 09 19:48:27.786683 00:01:80:0f:2b:94 00:00:24:c6:18:85 0800 70:

> 192.168.80.4.16284 > 192.168.80.1.53: 57120+ A? pps.com.au. (28)

> Jul 09 19:48:43.690332 00:01:80:0f:2b:94 00:00:24:c6:18:85 0800 67:

> 192.168.80.4.1356 > 192.168.80.1.53: 32536+ A? ibm.com. (25)

> Jul 09 19:49:11.013223 00:01:80:0f:2b:94 00:00:24:c6:18:85 0800 69:

> 192.168.80.4.14540 > 192.168.80.1.53: 29420+ A? intel.com. (27)

> ....

>

> # uname -a

> OpenBSD master.witworx.com 4.3 GENERIC#698 i386

>

> Guess again.

>

> Was that so hard to try?

I get a different result using the external interface of my caching

name server, and mine looks vulnerable.
frank# tcpdump -nettti em1 dst port 53

tcpdump: listening on em1, link-type EN10MB

Jul 09 05:54:23.291421 00:0f:1f:04:8c:36 00:02:b9:38:23:f0 0800 82:

xx.xx.9.35505 > 205.177.95.83.53: 27972 A? a1397.g.akamaitech.net. (40)

Jul 09 05:54:25.814869 00:0f:1f:04:8c:36 00:02:b9:38:23:f0 0800 86:

xx.xx.95.9.35505 > 75.126.144.219.53: 58999% [1au] A? www.virg9lio.it.

(44)

Jul 09 05:54:25.862953 00:0f:1f:04:8c:36 00:02:b9:38:23:f0 0800 87:

xx.xx.95.9.35505 > 75.126.144.219.53: 2869% [1au] A? www.virgbilio.it.

(45)

Jul 09 05:54:35.864421 00:0f:1f:04:8c:36 00:02:b9:38:23:f0 0800 87:

xx.xx.95.9.35505 > 75.126.217.184.53: 43066% [1au] A?

www.virgbilio.it. (45)

Jul 09 05:54:42.188507 00:0f:1f:04:8c:36 00:02:b9:38:23:f0 0800 102:

xx.xx.95.9.35505 > 216.239.36.10.53: 20026% [1au] A?

safebrowsing.clients.google.com. (60)

Jul 09 05:54:42.214185 00:0f:1f:04:8c:36 00:02:b9:38:23:f0 0800 91:

xx.xx.95.9.35505 > 64.233.167.9.53: 29212% [1au] A?

clients.l.google.com. (49)

Jul 09 05:54:42.347093 00:0f:1f:04:8c:36 00:02:b9:38:23:f0 0800 85:

xx.xx.95.9.35505 > 198.105.192.254.53: 9616% [1au] A? log.wip.go.com.

(43)

Jul 09 05:54:42.678103 00:0f:1f:04:8c:36 00:02:b9:38:23:f0 0800 96:

xx.xx.95.9.35505 > 64.233.167.9.53: 17632% [1au] A?

static.cache.l.google.com. (54)
frank# uname -a

OpenBSD frank.placeholder.com 4.3 GENERIC#698 i386