[Cerowrt-devel] [OT] DNS redirected to third-part​​y servers: www.google​​.com ?

[Cerowrt-devel] [OT] DNS redirected to third-part​​y servers: www.google​​.com ?

[Maciej Soltysiak]

[-- Attachment #1: Type: text/plain, Size: 893 bytes --]

Hi,

A bit off topic, not sure if this is cerowrt related but I know you guys
use netalyzr.

My netalyzr on cerowrt-3.3.8-3  started recently to show that my ISP
redirects www.google.com to 3rd party.
My run is here:
http://n1.netalyzr.icsi.berkeley.edu/summary/id=43ca253f-21386-3947730d-5148-4bce-9140#DNSLookup
The IPs that get resolved are e.g.:
46.28.247.113
46.28.247.118

Can anyone please do a netalyzr scan and see if you report anything similar?
Maybe it's google CDN, maybe it's something in bind build.

Funny thing is that on a windows client when I do nslookup
www.google.com172.30.42.97 (or .1) I get different results, but never
this 46.28 nonsense.
I get same results when I query my ISP DNS or some other major ISP's DNS in
my country.

When I do diagnostics from cerowrt, it shows 46.28.x.y.

Thanks in advance for having a go with the test!

Best regards,
Maciej Soltysiak

[-- Attachment #2: Type: text/html, Size: 1316 bytes --]

Re: [Cerowrt-devel] [OT] DNS redirected to third-part​​y servers: www.google​​.com ?

[Dave Taht]

On Thu, Jun 14, 2012 at 2:32 PM, Maciej Soltysiak <maciej@soltysiak.com> wrote:
> Hi,
>
>
> A bit off topic, not sure if this is cerowrt related but I know you guys use
> netalyzr.
>
> My netalyzr on cerowrt-3.3.8-3  started recently to show that my ISP
> redirects www.google.com to 3rd party.

cerowrt by default accesses the *ROOT* servers to get it's dns data.
so if that is corrupt or wrong, there's a major issue. It is possible
you are losing on a geo-location basis, however.

If your ISP supports DNSSEC (and is not playing games with DNS) you
can optimize your dns access by using your ISP's provided dns servers
in the forwarders.conf file and uncommenting the relevant line in
named.conf.

What I get for a host www.google.com is:

www.google.com is an alias for www.l.google.com.
www.l.google.com has address 74.125.45.105
www.l.google.com has address 74.125.45.147
www.l.google.com has address 74.125.45.103
www.l.google.com has address 74.125.45.104
www.l.google.com has address 74.125.45.99
www.l.google.com has address 74.125.45.106
www.l.google.com has IPv6 address 2001:4860:800a::63


> My run is here:
> http://n1.netalyzr.icsi.berkeley.edu/summary/id=43ca253f-21386-3947730d-5148-4bce-9140#DNSLookup
> The IPs that get resolved are e.g.:
> 46.28.247.113
> 46.28.247.118
>
> Can anyone please do a netalyzr scan and see if you report anything similar?
> Maybe it's google CDN, maybe it's something in bind build.
>
> Funny thing is that on a windows client when I do nslookup www.google.com
> 172.30.42.97 (or .1) I get different results, but never this 46.28 nonsense.
> I get same results when I query my ISP DNS or some other major ISP's DNS in
> my country.
>
> When I do diagnostics from cerowrt, it shows 46.28.x.y.
>
> Thanks in advance for having a go with the test!
>
> Best regards,
> Maciej Soltysiak
>
> _______________________________________________
> Cerowrt-devel mailing list
> Cerowrt-devel@lists.bufferbloat.net
> https://lists.bufferbloat.net/listinfo/cerowrt-devel
>



-- 
Dave Täht
SKYPE: davetaht
http://ronsravings.blogspot.com/

Re: [Cerowrt-devel] [OT] DNS redirected to third-part​​y servers: www.google​​.com ?

[Maciej Soltysiak]

[-- Attachment #1: Type: text/plain, Size: 2690 bytes --]

Hi Dave,

Thanks for having a go and confirming bind setup.

I hear from netalyzr folks it might be a new CDN setup for Poland by Google
and the reverse dns is not yet renamed.
Other than that, the response seems legit, will wait for update on google
front as somebody on netalyzr list said he can ask.

Regards,
Maciej

On Thu, Jun 14, 2012 at 8:42 PM, Dave Taht <dave.taht@gmail.com> wrote:

> On Thu, Jun 14, 2012 at 2:32 PM, Maciej Soltysiak <maciej@soltysiak.com>
> wrote:
> > Hi,
> >
> >
> > A bit off topic, not sure if this is cerowrt related but I know you guys
> use
> > netalyzr.
> >
> > My netalyzr on cerowrt-3.3.8-3  started recently to show that my ISP
> > redirects www.google.com to 3rd party.
>
> cerowrt by default accesses the *ROOT* servers to get it's dns data.
> so if that is corrupt or wrong, there's a major issue. It is possible
> you are losing on a geo-location basis, however.
>
> If your ISP supports DNSSEC (and is not playing games with DNS) you
> can optimize your dns access by using your ISP's provided dns servers
> in the forwarders.conf file and uncommenting the relevant line in
> named.conf.
>
> What I get for a host www.google.com is:
>
> www.google.com is an alias for www.l.google.com.
> www.l.google.com has address 74.125.45.105
> www.l.google.com has address 74.125.45.147
> www.l.google.com has address 74.125.45.103
> www.l.google.com has address 74.125.45.104
> www.l.google.com has address 74.125.45.99
> www.l.google.com has address 74.125.45.106
> www.l.google.com has IPv6 address 2001:4860:800a::63
>
>
> > My run is here:
> >
> http://n1.netalyzr.icsi.berkeley.edu/summary/id=43ca253f-21386-3947730d-5148-4bce-9140#DNSLookup
> > The IPs that get resolved are e.g.:
> > 46.28.247.113
> > 46.28.247.118
> >
> > Can anyone please do a netalyzr scan and see if you report anything
> similar?
> > Maybe it's google CDN, maybe it's something in bind build.
> >
> > Funny thing is that on a windows client when I do nslookup
> www.google.com
> > 172.30.42.97 (or .1) I get different results, but never this 46.28
> nonsense.
> > I get same results when I query my ISP DNS or some other major ISP's DNS
> in
> > my country.
> >
> > When I do diagnostics from cerowrt, it shows 46.28.x.y.
> >
> > Thanks in advance for having a go with the test!
> >
> > Best regards,
> > Maciej Soltysiak
> >
> > _______________________________________________
> > Cerowrt-devel mailing list
> > Cerowrt-devel@lists.bufferbloat.net
> > https://lists.bufferbloat.net/listinfo/cerowrt-devel
> >
>
>
>
> --
> Dave Täht
> SKYPE: davetaht
> http://ronsravings.blogspot.com/
>

[-- Attachment #2: Type: text/html, Size: 4448 bytes --]