I'm the system admin of a company that has a fiber connection to Comcast
for Internet with Static IPs
At the same time I have a home copper coax connection to Comcast for
Internet with static IPs on it
Back in March I posted a query to the list asking about what I thought
was problems with bind only to be told this was due to Comcast's
firewalling, which I was unaware of. This was for my personal home
copper connection.
Anyway I did not have time then to investigate this further but now I have.
I wrote a couple of Powershell scripts to do this (with help from
OpenAI). Basically they are a dig-lite sort of thing that uses the
Powershell libraries, DNS pipeline, cmdlets whatever you want to call
them to make the usual A, MX, CNAME, etc record queries.
These libraries do NOT however have support for the NSID query. So, my 2
scripts manually construct an EDNS0 OPT record query packet and sends it
out via the UDP raw socket interface in Powershell then parses the response.
The first script does a standard UDP query and if it does not find a
NSID response it makes a TCP query (also manually constructed query) I
put the TCP fallback logic in there to see if I could get around the
transparent proxy when testing on my coax/copper connection but I
discovered that Comcast's transparent proxy intercepts both UDP and TCP
queries so falling back to TCP is not a way to get around the proxy.
The second script just does a standard UDP query and converts whatever
it gets back in the OPT packet into text even if it does not find a
valid NSID record.
Since it is known that transparent DNS proxies generally filter out the
NSIDs this is a useful way of detecting if someone at the ISP is
tampering with DNS queries to the root nameservers.
Here's the output of the first script on the copper:
=====================================
PS C:\Users\tedm\documents> .\dig-udp-tcp.ps1 -Hostname "." -RecordType
"NS" -DnsServer "192.5.5.241" -NSID
Using custom DNS server: 192.5.5.241
Querying DNS for . (NS)...
=== Answer Section ===
Name Type TTL IPAddress NameHost
---- ---- --- --------- --------
. NS 511683 b.root-servers.net
. NS 511683 c.root-servers.net
. NS 511683 d.root-servers.net
. NS 511683 e.root-servers.net
. NS 511683 f.root-servers.net
. NS 511683 g.root-servers.net
. NS 511683 h.root-servers.net
. NS 511683 i.root-servers.net
. NS 511683 j.root-servers.net
. NS 511683 k.root-servers.net
. NS 511683 l.root-servers.net
. NS 511683 m.root-servers.net
. NS 511683 a.root-servers.net
a.root-servers.net A 308636 198.41.0.4
a.root-servers.net AAAA 308691 2001:503:ba3e::2:30
b.root-servers.net A 309409 170.247.170.2
b.root-servers.net AAAA 315122 2801:1b8:10::b
c.root-servers.net A 310201 192.33.4.12
c.root-servers.net AAAA 315080 2001:500:2::c
d.root-servers.net A 313341 199.7.91.13
d.root-servers.net AAAA 315948 2001:500:2d::d
e.root-servers.net A 309377 192.203.230.10
e.root-servers.net AAAA 314310 2001:500:a8::e
f.root-servers.net A 308787 192.5.5.241
f.root-servers.net AAAA 310323 2001:500:2f::f
=== NSID Information ===
NSID try over UDP...
No NSID via UDP retrying over TCP...
NSID try over TCP...
No NSID option found (server may have stripped it).
Query complete.
PS C:\Users\tedm\documents>
=========================================================
The lack of NSID and the fact the TTLs are all over the map are proof
that a transparent proxy is interfering - I knew this already from my
March query to this mailing list.
===========================================
PS C:\Users\tedm\documents> .\dig-udp-scan.ps1 -Hostname "." -RecordType
"NS" -DnsServer "192.5.5.241" -NSID
Using custom DNS server: 192.5.5.241
Querying DNS for . (NS)...
=== Answer Section ===
Name Type TTL NameHost IPAddress Strings
---- ---- --- -------- --------- -------
. NS 512781 e.root-servers.net
. NS 512781 f.root-servers.net
. NS 512781 g.root-servers.net
. NS 512781 h.root-servers.net
. NS 512781 i.root-servers.net
. NS 512781 j.root-servers.net
. NS 512781 k.root-servers.net
. NS 512781 l.root-servers.net
. NS 512781 m.root-servers.net
. NS 512781 a.root-servers.net
. NS 512781 b.root-servers.net
. NS 512781 c.root-servers.net
. NS 512781 d.root-servers.net
=== Authority Section ===
No authority records found.
=== Additional Section (Glue Data) ===
Name Type TTL IPAddress
---- ---- --- ---------
a.root-servers.net A 595533 198.41.0.4
a.root-servers.net AAAA 595535 2001:503:ba3e::2:30
b.root-servers.net A 598318 170.247.170.2
c.root-servers.net A 597901 192.33.4.12
c.root-servers.net AAAA 595587 2001:500:2::c
d.root-servers.net A 595614 199.7.91.13
d.root-servers.net AAAA 601532 2001:500:2d::d
e.root-servers.net A 598584 192.203.230.10
f.root-servers.net A 601063 192.5.5.241
f.root-servers.net AAAA 602668 2001:500:2f::f
g.root-servers.net A 595608 192.112.36.4
h.root-servers.net A 596572 198.97.190.53
h.root-servers.net AAAA 600689 2001:500:1::53
=== NSID Information ===
=== NSID Information ===
Recursion Available: Yes
Raw NSID Response (hex): 26 77 81 80 00 01 00 00 00 01 00 01 00 00 01 00
01 00 00 06 00 01 00 00 03 75 00 40 01 61 0C 72 6F 6F 74 2D 73 65 72 76
65 72 73 03 6E 65 74 00 05 6E 73 74 6C 64 0C 76 65 72 69 73 69 67 6E 2D
67 72 73 03 63 6F 6D 00 78 C3 8E 08 00 00 07 08 00 00 03 84 00 09 3A 80
00 01 51 80 00 00 29 02 00 00 00 00 00 00 00
Raw NSID Response (ASCII):
&w.........................@.a.root-servers.net..nstld.verisign-grs.com.x.............:...Q...)........
No NSID data found in response.
PS C:\Users\tedm\documents>
===========================================
I know of course that to Comcast, home internet connections over coax
that have static IPs are barely one step above the garbage residential
customers and they have zero respect for those customers. Even though
they are extracting triple the money per month from those customers.
This is why we can't have nice things and this is why I have to
configure my 2 nameservers at home to send all queries to Comcast's DNS
servers and cannot do my own damn lookups.
But, OK. I get it. $250 a month is a lot to ME but chicken feed to Comcast.
Anyway I took my scripts to work and for funsies ran them there.
Here's the output from my first script there:
=================================================
PS C:\users\tedmittelstaedt\documents\work> powershell -ExecutionPolicy
Bypass -File .\dig-udp-tcp.ps1 -Hostname "." -RecordType "NS" -DnsServer
"192.5.5.241" -NSID
Using custom DNS server: 192.5.5.241
Querying DNS for . (NS)...
=== Answer Section ===
Name Type TTL IPAddress NameHost
---- ---- --- --------- --------
. NS 518400 a.root-servers.net
. NS 518400 b.root-servers.net
. NS 518400 c.root-servers.net
. NS 518400 d.root-servers.net
. NS 518400 e.root-servers.net
. NS 518400 f.root-servers.net
. NS 518400 g.root-servers.net
. NS 518400 h.root-servers.net
. NS 518400 i.root-servers.net
. NS 518400 j.root-servers.net
. NS 518400 k.root-servers.net
. NS 518400 l.root-servers.net
. NS 518400 m.root-servers.net
a.root-servers.net A 518400 198.41.0.4
a.root-servers.net AAAA 518400 2001:503:ba3e::2:30
b.root-servers.net A 518400 170.247.170.2
b.root-servers.net AAAA 518400 2801:1b8:10::b
c.root-servers.net A 518400 192.33.4.12
c.root-servers.net AAAA 518400 2001:500:2::c
d.root-servers.net A 518400 199.7.91.13
d.root-servers.net AAAA 518400 2001:500:2d::d
e.root-servers.net A 518400 192.203.230.10
e.root-servers.net AAAA 518400 2001:500:a8::e
f.root-servers.net A 518400 192.5.5.241
f.root-servers.net AAAA 518400 2001:500:2f::f
g.root-servers.net A 518400 192.112.36.4
g.root-servers.net AAAA 518400 2001:500:12::d0d
h.root-servers.net A 518400 198.97.190.53
h.root-servers.net AAAA 518400 2001:500:1::53
i.root-servers.net A 518400 192.36.148.17
i.root-servers.net AAAA 518400 2001:7fe::53
j.root-servers.net A 518400 192.58.128.30
j.root-servers.net AAAA 518400 2001:503:c27::2:30
k.root-servers.net A 518400 193.0.14.129
k.root-servers.net AAAA 518400 2001:7fd::1
l.root-servers.net A 518400 199.7.83.42
l.root-servers.net AAAA 518400 2001:500:9f::42
m.root-servers.net A 518400 202.12.27.33
m.root-servers.net AAAA 518400 2001:dc3::35
=== NSID Information ===
NSID try over UDP...
NSID: PDX.cf.f.root-servers.org
Query complete.
PS C:\users\tedmittelstaedt\documents\work>
==================================================
It seems to LOOK ok - but - here's the output of my SECOND script:
======================================================
PS C:\users\tedmittelstaedt\documents\work> powershell -ExecutionPolicy
Bypass -File .\dig-udp-scan.ps1 -Hostname "." -RecordType "NS"
-DnsServer "192.5.5.241" -NSID
Using custom DNS server: 192.5.5.241
Querying DNS for . (NS)...
=== Answer Section ===
Name Type TTL NameHost IPAddress Strings
---- ---- --- -------- --------- -------
. NS 518400 a.root-servers.net
. NS 518400 b.root-servers.net
. NS 518400 c.root-servers.net
. NS 518400 d.root-servers.net
. NS 518400 e.root-servers.net
. NS 518400 f.root-servers.net
. NS 518400 g.root-servers.net
. NS 518400 h.root-servers.net
. NS 518400 i.root-servers.net
. NS 518400 j.root-servers.net
. NS 518400 k.root-servers.net
. NS 518400 l.root-servers.net
. NS 518400 m.root-servers.net
=== Authority Section ===
No authority records found.
=== Additional Section (Glue Data) ===
Name Type TTL IPAddress
---- ---- --- ---------
a.root-servers.net A 518400 198.41.0.4
a.root-servers.net AAAA 518400 2001:503:ba3e::2:30
b.root-servers.net A 518400 170.247.170.2
b.root-servers.net AAAA 518400 2801:1b8:10::b
c.root-servers.net A 518400 192.33.4.12
c.root-servers.net AAAA 518400 2001:500:2::c
d.root-servers.net A 518400 199.7.91.13
d.root-servers.net AAAA 518400 2001:500:2d::d
e.root-servers.net A 518400 192.203.230.10
e.root-servers.net AAAA 518400 2001:500:a8::e
f.root-servers.net A 518400 192.5.5.241
f.root-servers.net AAAA 518400 2001:500:2f::f
g.root-servers.net A 518400 192.112.36.4
g.root-servers.net AAAA 518400 2001:500:12::d0d
h.root-servers.net A 518400 198.97.190.53
h.root-servers.net AAAA 518400 2001:500:1::53
i.root-servers.net A 518400 192.36.148.17
i.root-servers.net AAAA 518400 2001:7fe::53
j.root-servers.net A 518400 192.58.128.30
j.root-servers.net AAAA 518400 2001:503:c27::2:30
k.root-servers.net A 518400 193.0.14.129
k.root-servers.net AAAA 518400 2001:7fd::1
l.root-servers.net A 518400 199.7.83.42
l.root-servers.net AAAA 518400 2001:500:9f::42
m.root-servers.net A 518400 202.12.27.33
m.root-servers.net AAAA 518400 2001:dc3::35
=== NSID Information ===
=== NSID Information ===
Recursion Available: No
Raw NSID Response (hex): A5 48 85 00 00 01 00 00 00 01 00 01 00 00 01 00
01 00 00 06 00 01 00 01 51 80 00 40 01 61 0C 72 6F 6F 74 2D 73 65 72 76
65 72 73 03 6E 65 74 00 05 6E 73 74 6C 64 0C 76 65 72 69 73 69 67 6E 2D
67 72 73 03 63 6F 6D 00 78 C3 8E 08 00 00 07 08 00 00 03 84 00 09 3A 80
00 01 51 80 00 00 29 05 C0 00 00 00 00 00 1D 00 03 00 19 50 44 58 2E 63
66 2E 66 2E 72 6F 6F 74 2D 73 65 72 76 65 72 73 2E 6F 72 67
Raw NSID Response (ASCII):
.h.........................@.a.root-servers.net..nstld.verisign-grs.com.x.............:...Q...)............PDX.cf.f.root-servers.org
NSID: PDX.cf.f.root-servers.org
PS C:\users\tedmittelstaedt\documents\work>
======================================================
I believe this must not be tampered with, by a transparent proxy, the
TTLs look normal for a root, there is a NSID once more normal for a root
and RA is not set.
Anyway, yes I know dig is available for Windows but I thought it would
be interesting to see if it's possible to beat an AI into building a
dig-lite.
If anyone thinks these might have value let me know and I'll post them.
Ted
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list.
