Hacker News Reader

Comment by colmmacc | Hacker News Reader

If anyone is in Turkey and can configure their system to use Google Public DNS IPs / OpenDNS IPs as their resolvers, I'd be interested to learn what you see on: http://whatsmyresolver.stdlib.net/

It's clear that addresses such as 8.8.8.8 are being intercepted. But it's unclear if the interceptor is passing on the uninteresting queries to the "real" Google Public DNS / OpenDNS, or if they are acting as standalone resolvers. The above website records what IP address the resolver uses to communicate with authoritative DNS servers.

View on HN

> http://whatsmyresolver.stdlib.net/

I didn't know this could be done. I am using powerdns on my own server at home, and it displays correctly my ip address. Can you give me some pointers to understand how this works?

Disclaimer: I don't know with absolute certainly that this is correct but based on a quick look at the page and what I already know I think it's probably correct.

Look at the the source for that page and you'll see:

  <script language="javascript" src="http://whatsmyresolver.stdlib.net/resolver/"></script>

When your browser loads that, it'll return a reference to a resource with a unique hostname. Open that URL in your browser, for example, and you'll likely see something like the following in the address bar (this is what I received, with a few characters changed):

  http://e9v4ftan41uv2676ycdcl1a504pupav2lp7hinqlffonpuk7wk87p9cd42oy4.nonce.stdlib.net/resolver/

Thus, your browser will do a DNS lookup for that hostname. Because that URL is unique to you, the DNS server knows that it is you making the DNS request. It makes a note of what IP address the request came from and returns that to you as the IP of your resolver.

Similar to you, I have a pair of resolvers running here at home and I am returned the IP address of one of them.

Thank you

You can be certain now, that's exactly how it works!

Hey, OP, I'm from Pakistan, but I thought you might like some comparative info, esp. since we are blocking youtube too.

----

Your resolver's source IP1 is:

58.27.204.243

1: Technically it's at least one of your resolver's IPv4 source addresses.

----

C:\Users\>tracert 8.8.8.8

Tracing route to google-public-dns-a.google.com [8.8.8.8] over a maximum of 30 hops:

  1     2 ms     1 ms     3 ms  192.168.0.1
  2    59 ms    64 ms    69 ms  10.204.0.1
  3    77 ms    99 ms     *     58-27-174-122.wateen.net [58.27.174.122]
  4    75 ms    84 ms    44 ms  58-27-174-65.wateen.net [58.27.174.65]
  5    75 ms    78 ms    59 ms  58-27-180-190.wateen.net [58.27.180.190]
  6    66 ms    63 ms    63 ms  58-27-174-26.wateen.net [58.27.174.26]
  7    95 ms   104 ms   125 ms  tw130-static117.tw1.com [119.63.130.117]
  8    90 ms   104 ms   114 ms  tw255-static233.tw1.com [110.93.255.233]
  9   200 ms   219 ms   209 ms  72.14.222.151
 10   229 ms   194 ms   225 ms  72.14.235.67
 11   215 ms   228 ms   229 ms  72.14.232.78
 12   194 ms   224 ms   224 ms  209.85.254.116
 13     *        *        *     Request timed out.
 14   225 ms   234 ms   224 ms  google-public-dns-a.google.com [8.8.8.8]

Trace complete.

----

195.175.255.82

Thanks! that looks like they are running standalone resolvers:

    inetnum:        195.174.0.0 - 195.175.255.255
    netname:        TR-TELEKOM-960902
    descr:          Turk Telekomunikasyon Anonim Sirketi

in that case, each ISP is probably running their own standalone servers.

Nope, this is not an ISP. Turk Telekom is stated-owned broadband internet (infrastructure) company. All of the ISPs are having the same peering. I checked your link through TTNet. We also have Superonline and Smile as main ISPs.

Turk Telekom is not state-owned, not for the last 8 years or so.

Details courtesy of Wikipedia: Privatized in 2005. "55% of the shares of Turk Telekom belongs to Oger Telekomünikasyon A.Ş. and 30% of the shares belongs to Undersecretariat of Treasure of Turkey. The remaining 15% of shares has been offered to the public." Oger Telekom is apparently 100% privately owned by the Hariri family.

So, still 30% state owned. As one point of reference, the German government still holds 15% directly plus 17% indirectly of Deutsche Telekom. France and Orange (nee France Telecom) are similar.

Would you mind posting a traceroute to 8.8.8.8? I'm curious as to the "how", e.g. if they're announcing the IP/subnet into BGP or (assuming traffic flows through them) if they're just transparently redirecting (DNAT, in effect) it to their own DNS servers.

  traceroute to 208.67.222.222 (208.67.222.222), 30 hops max, 60 byte packets
   1  192.168.1.1 (192.168.1.1)  2.525 ms  3.372 ms  8.410 ms
   2  78.180.240.1.dynamic.ttnet.com.tr (78.180.240.1)  26.861 ms  28.677 ms  30.683 ms
   3  81.212.78.13.static.turktelekom.com.tr (81.212.78.13)  32.834 ms  33.887 ms  34.726 ms
   4  gayrettepe-t2-3-gayrettepe-t3-5.turktelekom.com.tr.205.212.81.in-addr.arpa (81.212.205.105)  36.738 ms  37.718 ms  39.747 ms
   5  ulus-t2-3-gayrettepe-t2-3.turktelekom.com.tr.204.212.81.in-addr.arpa (81.212.204.205)  48.947 ms  49.867 ms  51.937 ms
   6  ulus-t3-4-ulus-t2-3.turktelekom.com.tr.204.212.81.in-addr.arpa (81.212.204.149)  56.001 ms  27.122 ms  29.496 ms
   7  * * *
   ...
   30 * * *

8.8.8.8 gives similar (indeed identical if I've good eye-diff skills) output.

Thanks, I found a TT LG in the meantime.

Interestingly enough, it throws an error ("Please enter a valid IPv4/IPv6 address!") when I ask it for the routes it has for 8.8.4.0/24 or 8.8.8.0/24. If I ask for 8.8.33.0/24 (the "closest" subnet I see in my own BGP tables), it responds normally.

It'd be easier for them to announce the /32, I'd think.

Right, I'm sure they are (they pretty much have to, unless they want to make it harder on themselves)... there's no reason they'd need to filter the /24s out, unless they're afraid that maybe Google would start using other IPs in the same /24 to help the Turks bypass it or something.

Reply on news.ycombinator.com