nanog mailing list archives
Re: BCP38.info
From: Jared Mauch <jared () puck nether net>
Date: Tue, 28 Jan 2014 14:16:09 -0500
On Jan 28, 2014, at 1:50 PM, Valdis.Kletnieks () vt edu wrote:
On Tue, 28 Jan 2014 08:06:31 -0500, Jared Mauch said:52731 ASN7922It includes IP address where you send a DNS packet to it and another IP address responds to the query, e.g.:The data only includes those where the “source-ASN” and “dest-asn” of these packets don’t match.Hang on Jared, I'm trying to wrap my head around this. You're saying that AS7922 has over 50K IP addresses which, if you send a DNS query to that IP, you get an answer back from *an entirely different ASN*? How the heck does *that* happen?
Yup.
Hmm.. Comcast. Anybody over there have an explanation what's going on there?
Most of these devices are CPE that perform DNS redirection/proxy wrong because they didn't constrain their udp/53 rule in iptables to only work on the "inside" interface. They then send the packet to their configured DNS server (eg: 8.8.8.8) and rewrite the source address in the packet to be the IP address of the OpenResolverProject.org scanning server. They then spoof me to 8.8.8.8 and I get the response from there. I have a unique QNAME per-IP i send, so I can decrypt/decode this to get the original destination to detect this. I mentioned this in the past, so please don't act so surprised :) http://mailman.nanog.org/pipermail/nanog/2013-August/060246.html - Jared
Current thread:
- BCP38.info Jay Ashworth (Jan 25)
- Re: BCP38.info Chris Grundemann (Jan 25)
- Re: BCP38.info Tony Tauber (Jan 25)
- Re: BCP38.info Jay Ashworth (Jan 26)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info TGLASSEY (Jan 28)
- Re: BCP38.info Valdis . Kletnieks (Jan 28)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info David Miller (Jan 28)
- Re: BCP38.info Stephen Frost (Jan 28)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info Chris Grundemann (Jan 25)
- <Possible follow-ups>
- Re: BCP38.info Nick Olsen (Jan 28)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info Andrei Robachevsky (Jan 29)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info Nick Olsen (Jan 28)
- Re: BCP38.info Jared Mauch (Jan 28)
- Re: BCP38.info Mark Andrews (Jan 28)
- Re: BCP38.info Jared Mauch (Jan 28)