Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was checking a proxied program for DNS leaks with tshark when I noticed this:

13.170066    10.0.2.15 -> 192.168.1.1  DNS 66 Standard query 0xd473  A [hostname]
13.753496    10.0.2.15 -> 192.168.1.1  DNS 66 Standard query 0x7bb4  A [hostname]

where [hostname] is the hostname of the machine the program and tshark are running on, 10.0.2.15 is the local machine, and 192.168.1.1 is the router.

Why does the computer look up its own hostname and how can I prevent this from leaking information about the computer?

Note that changing the hostname once is not useful since an (untrusted) proxy knows that it is the same computer connecting every time since the computer sends the same hostname.

(crossposted from ask.wireshark.org)

share|improve this question
    
Can you fix this by hardcoding 10.0.2.15 [hostname] into your hosts file ? Hopefully this would stop the lookup leaking out your local machine ? –  davidgo Feb 9 '13 at 22:35
    
What are you afraid is "leaking" here? That it is asking for it's own IP address? Your system should have some kind of local name cache, so it shouldn't ask too often anyway. Re @davidgo's suggestion, don't hard-wire names that way. If DHCP sees fit to assign another IP address next month, things will fail in mystifying ways, and you'd have forgotten about this kludge. –  vonbrand Feb 10 '13 at 1:09
    
@vonbrand I am afraid that the hostname is leaking. If I connect to a proxy and query my hostname, the proxy can map my hostname to the data sent during the connection. Later, if I connect to the same proxy (through intermediate proxies) it knows that the data sent in the new connection was sent from the same machine that sent the previous data. BTW It actually looks up the hostname almost every time I run a test program (firefox on google.com). –  Navin Feb 10 '13 at 17:28
    
@davidgo , vonbrand: Are there any disadvantages to hardcoding the hostname to 127.0.0.1 ? –  Navin Feb 10 '13 at 17:30
    
If you are worried to that measure, better look into stuff like tor <torproject.org>;. Nothing you could knit at home will give you enough assurance (but even tor has had it's vulnerabilities...) –  vonbrand Feb 10 '13 at 17:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.