3

Let's assume I have a domain name, for example, myproxy.com. Then I have many websites, like kitty.myproxy.com , wow.myproxy.com I want to configure an authoritative DNS server for the domain name.

I hope, if a user wants to visit these websites, when the browser send a DNS query, the DNS query will finally arrive at the authoritative DNS server. and in this way, the authoritative can obtain the IP of the host which did the DNS query.

my expectation is: all DNS queries for these websites have to be sent to the authoritative DNS server so I can know all the hosts that did the DNS queries. Is it possible or not?

I'm afraid some other DNS servers which cache the DNS records, so these DNS server will answer the DNS queries, then these queries are not forwarded to the authoritative DNS server. Is it possible to prevent this?

Note: I'm doing a research work. My target is to make a proxy. There are many web servers which register on the proxy. Only the proxy knows the IP of these web servers. When a browser wants to visit one of these web servers, it can obtain the IP of the proxy from DNS query. And then it connects to the proxy. I hope that the proxy can know exactly which web server this browser wants to visit when the TCP SYN comes(before the HTTP request, indeed, by parsing the HTTP request, the proxy can get to know which web server the browser wants to visit). So if the web browser does a DNS query and this query is known by the proxy, the proxy can then cache a mapping between the web server and the browser host IP. When the TCP SYN comes, the proxy immediately check the mapping and get to know which web server the browser actually wants to visit. thanks!

Improve this question
3

2 Answers 2

Reset to default
9

What are you trying to accomplish? My guess is you're trying to do something and you think "monitoring DNS is the answer" when it won't work.

If you're looking to see a hit from a client IP on every DNS request, that will never happen. DNS is layered, and clients are configured to hit a local DNS server, which will then eventually hit your DNS server.

If you're looking to see a request (from someone) on every DNS request, you can try to tune your TTL to something small, like a second. You'd then see a hit from someone, somewhere. This may not be 100% - it depends on everyone respecting your TTL, which isn't a given.

UPDATE

If I read correctly, you're trying to associate a DNS request to a future HTTP request. This will fail for several reasons.

  1. Caching. DNS - IP mappings are very cacheable, and therefore they are cached heavily. Even setting TTL won't help all that much, since some ISPs ignore TTL and cache for an hour/a day or so no matter the setting. Browsers also have their own DNS cache. There are too many levels for you to control all.

  2. Multiple users - one IP address. Between NAT (and Carrier Grade NAT is on the horizon) and normal multiple users per machine, you can't map an IP to a browser anymore (not that you really ever could). Even multiple browsers per user or multiple tabs could throw this system off.

  3. People may use DNS for other reasons. What if someone just does an nslookup on one domain, but then hits another (with the IP in cache). You'd forward the wrong site.

  4. Multiple egress points. Though less common now, it used to be very common for ISPs to proxy requests out and at times a single subscriber might get rotated on egress points (what you'd see as their IP) in even a single session. AOL used to do this a lot, and as they've dropped in popularity, I've seen other tools (mobile Opera) use proxies as well.

  5. DNS forwarding does not work this way. If someone tries to look up a hostname in your site, the vast majority of the time they'll wind up asking either google's 8.8.8.8 server or their ISP's recursive DNS server. In either case, the IP address that queries your DNS server for a hostname will not be the same as the source IP address of the web browser that comes looking a moment later.

In short, you can't get there from here. IP addresses are not (not they ever have been) unique 1-1 identifiers for a user. You'd break HTTP. You're stuck looking at the HTTP stream and parsing. Make sure your proxy supports Keep-Alive and you'd lessen the hit a bit.

Improve this answer
4
  • setting TTL to a small value sounds good. Pity it is not 100%! what is the percentage do you estimate? above 80% or around 50% or blabla? I know that PC may have a local DNS cache, will that cache normally respect the TTL? thanks!
    – misteryes
    May 29, 2013 at 1:05
  • @misteryes it's impossible to tell percentage, since ISPs often cache the value, meaning that it may be one client or a thousand. Again, what do you want to do? The specific actions you're asking about can't be done (because of caching), but you may be able to do what you want in a different way.
    – Rich Homolka
    May 29, 2013 at 2:30
  • what I want to do is updated in my question
    – misteryes
    May 29, 2013 at 12:05
  • @misteryes What you want to do is called "Name-based Virtual Hosting" and has already been done repeatedly in ways that are not terrible ideas.
    – Shadur-don't-feed-the-AI
    Sep 11, 2014 at 9:16
1

How would the browser/user know what http request to make in order to let your proxy to determine the actual requested server?

If you plan to have a portal from which the user would select the server he wants, you could generate random subdomains for your proxy depending on the user's choices/accessibility.

You can see a similar implementation on a rebind attack demonstration where the user would go to a server and since the server knows the user's ip, server creates a new random generated subdmain, assiging the desired server ip address on the DNS record and redirects the user to that subdomain.

You can't find the user's ip address on the DNS server.

As others wrote earlier, you shouldn't rely on TTL, since not all DNS resolvers respect it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .