Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNS Cookies – Identify Related Network Flows

dnscookie.com

Post reply on HN
Print view View original

1–10 of 26 posts

Re: DNS Cookies – Identify Related Network Flows

#5

Post by bluejekyll »

SimeVidas wrote: post #3

ELI5 description?

The abstract from RFC 7873:

—— DNS Cookies are a lightweight DNS transaction security mechanism that provides limited protection to DNS servers and clients against a variety of increasingly common denial-of-service and amplification/forgery or cache poisoning attacks by off-path attackers. DNS Cookies are tolerant of NAT, NAT-PT (Network Address Translation - Protocol Translation), and anycast and can be incrementally deployed. (Since DNS Cookies are only returned to the IP address from which they were originally received, they cannot be used to generally track Internet users.) ——

At the end of the day, the data can really be any 8 byte set of data for the client part and up to 32 bytes for the server section. Which you could technically use to store anything you want (or the upstream resolver could).

The linked article talks about using it for tracking users, which the abstract ironically says isn’t generally possible.

Re: DNS Cookies – Identify Related Network Flows

#7

Post by pests »

bluejekyll wrote: post #5
SimeVidas wrote: post #3

ELI5 description?

The abstract from RFC 7873: —— DNS Cookies are a lightweight DNS transaction security mechanism that provides limited protection to DNS servers and clients against a variety of increasingly common denial-of-service and amplification/forgery or cache poisoning attacks by off-path attackers. DNS Cookies are tolerant of NAT, NAT-PT (Network Address Translation - Protocol Translation), and anycast and can be incrementall…

Specifically the tracking is done here by randomly choosing IP addresses from a pool and correlating connection attempts to the resolved IP to the original DNS request. To quote the article:

"With 2 IP addresses available in the pool, a 32-bit identifier requires 32 correlated connections. With 256 IP addresses, a 32-bit identifier requires only 4 correlated connections."

IPv6 brings it down to just one.

Re: DNS Cookies – Identify Related Network Flows

#8

Post by DanielDent »

bluejekyll wrote: post #5
SimeVidas wrote: post #3

ELI5 description?

The abstract from RFC 7873: —— DNS Cookies are a lightweight DNS transaction security mechanism that provides limited protection to DNS servers and clients against a variety of increasingly common denial-of-service and amplification/forgery or cache poisoning attacks by off-path attackers. DNS Cookies are tolerant of NAT, NAT-PT (Network Address Translation - Protocol Translation), and anycast and can be incrementall…

I published dnscookie.com in late 2015. I google "dns cookies" and a few other things terms, was surprised that the terminology appeared unused, and it seemed suitable for the concept I was describing.

In May 2016, RFC 7873 was published which also uses the term "DNS cookies".

These two things share a name but have different meanings. The naming collision is an unfortunate coincidence.

Post reply on HN