I spent today reading up on Sunscreen, the Solaris 9 bundled IPfiltering system. It's been interesting, partly because Sunscreen'sbuilt around a different packet matching model than I'm used to, anduses a great deal of different terminology (for example, what I thinkof as 'transparent bridging' is called 'stealth mode').

Sunscreen doesn't actually match packets as such. Instead you define'services', for which you specify some combination of destinationand/or source ports

A recent commentator on HowNotToDoDNSI has prompted me to write aboutthe hell that glue records could be in in the Internet's old days. Toreally cover the horror, I'll start with the ordinary glue recordhorror.

Glue records are additional A records that get returned by higherlevel nameservers when people ask for NS records to avoid recursionproblems that would otherwise ensue when, eg, foo.com has www.foo.com as its nameserver. This can be exploited to optimize DNSlookups a bit, as