Le protocole DNS utilise UDP quand tout baigne, la plupart du temps, et TCP quand ces foutues requêtes UDP ne passent pas (par exemple quand les paquets font plus de 512 octets).
If you're trying to block outgoing TCP connections, remember that DNS doesn't always use UDP; if the reply from the server exceeds 512 bytes, the client uses a TCP connection (still going to port number 53) to get the data.
This can be a trap because DNS will `mostly work' if you disallow such TCP transfers; you may experience strange long delays and other occasional DNS problems if you do.
[^] # Le DNS c'est UDP et TCP
Posté par Annah C. Hue (site web personnel) . En réponse à la dépêche Un ver déstabilise Internet. Évalué à 1.
http://www.wbglinks.net/pages/reads/chainstables/firewallrules.html(...)
TCP Connections to DNS (nameservers)
If you're trying to block outgoing TCP connections, remember that DNS doesn't always use UDP; if the reply from the server exceeds 512 bytes, the client uses a TCP connection (still going to port number 53) to get the data.
This can be a trap because DNS will `mostly work' if you disallow such TCP transfers; you may experience strange long delays and other occasional DNS problems if you do.