Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Running "nslookup google.com 8.8.8.8" yields IPs of my ISP (as Non-authoritative answer). I think this started occurring recently. Probably they are making some bullshit cache or something, as nearest Google data center is quite far away.

First of all, how is that even possible? I thought the worst they could do is block me from sending a DNS request to 8.8.8.8 (say by blocking remote port 53), but how can they trick 8.8.8.8 from sending me a correct address?

Second, how can I bypass this, if at all?

Thanks

EDIT:

Microsoft Windows [Version 6.1.7601]

Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\asdf nslookup google.com 8.8.8.8

Server: google-public-dns-a.google.com

Address: 8.8.8.8

Non-authoritative answer:

Name: google.com

Addresses: 2a00:1450:4017:801::1006

     212.199.205.232
     212.199.205.242
     212.199.205.222
     212.199.205.237
     212.199.205.231
     212.199.205.241
     212.199.205.212
     212.199.205.227
     212.199.205.247
     212.199.205.246
     212.199.205.251
     212.199.205.221
     212.199.205.217
     212.199.205.236
     212.199.205.226
     212.199.205.216

C:\Users\asdf>

And using DNSCrypt (with and without option of DNSCrypt over port 443):

Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\asdf>nslookup google.com

1.0.0.127.in-addr.arpa

primary name server = localhost

responsible mail addr = nobody.invalid

serial = 1

refresh = 600 (10 mins)

retry = 1200 (20 mins)

expire = 604800 (7 days)

default TTL = 10800 (3 hours)

Server: UnKnown

Address: 127.0.0.1

Non-authoritative answer:

Name: google.com

Addresses: 2a00:1450:4017:800::1008 212.199.205.242 212.199.205.247 212.199.205.237 212.199.205.232 212.199.205.231 212.199.205.226 212.199.205.217 212.199.205.212 212.199.205.227 212.199.205.241 212.199.205.236 212.199.205.246 212.199.205.216 212.199.205.251 212.199.205.221 212.199.205.222

C:\Users\asdf>

Formatting is a bit off, sorry about that.

share|improve this question
    
What IPs is it returning? It's actually quite trivial for an ISP to intercept the connection to 8.8.8.8 (or any non-encrypted connection) and inject whatever data they want; However, that kind of hijacking would be suicide for an ISP's reputation. –  Darth Android Aug 7 '13 at 21:48
    
It returns some of the ISP addresses, the exact IP is not really relevant I guess. This is not the US or western Europe btw, so ISP can do whatever they want without anyone even noticing something is wrong. –  ctlaltdefeat Aug 7 '13 at 21:58
    
If you remind me how to copy the contents of CMD on Windows, I'll paste the results. –  ctlaltdefeat Aug 7 '13 at 21:59
    
So you're also saying that if you go to google.com, it redirects to one of the IPs you get returned in your nslookup? All systems? One system? This could easily be a trojan or virus which is redirecting –  ernie Aug 7 '13 at 22:00
    

3 Answers 3

up vote 4 down vote accepted

I don't think what you think is hijacking is hijacking (I am not saying it is not happening, just the evidence does not point to it.)

From what it looks like you are just seeing 3rd party location based CDNs Google uses for it's servers.

Google would never be able to serve up pages at the speed it offers if every query had to go through a master database back in Mountain View, CA. So they have 1000's of mirrored servers at ISP's all over the world to help serve up content quicker. They do not necessarily manage the servers that are hosting the page, only the software running on the server. Heck it could be done all with VPS's.

So you are likely seeing the IP's belonging to the hosting company/CDN that Google is using for serving pages in your area.

(P.S. The way they are poiting you to the correct CDN (the reason you get a different set of numbers vs ping.eu) is the DNS servers sitting on 8.8.8.8 look at the requesting IP and reply with the IPs for the CDN serving that area by doing a IP Geolocation Lookup)

share|improve this answer
    
I think that you're probably right, it's the most logical answer at this point. –  ctlaltdefeat Aug 7 '13 at 23:01

Do you get the same results when using 8.8.4.4 as a DNS server? 208.67.222.222 ? 208.67.220.220 ?

If your ISP is hijacking connections to 8.8.8.8, there's not much you can do other than complain to them and connect to 8.8.8.8 over a VPN.

I would very much like to see the DNS report from NameBench, a DNS testing utility which is primarily used for comparing and finding the fastest DNS server available, but also checks for hijacking. It will tell you if your ISP is doing Bad ThingsTM with your internet.

share|improve this answer
    
Same thing with all of them (I noticed some give slightly different IP addresses still of my ISP, but that may be due to time of day as well). Also, I just now downloaded DNSCrypt, which supposedly combats against hijacking. I even marked for it resolve on port 443. Still same damn thing! I'll paste those results as well momentarily. –  ctlaltdefeat Aug 7 '13 at 22:22
    
Gah! Just tried it with my phone on cellular network, even here there's a DNS hijack! To different local ISPs addresses, but still...for example one of the addresses: whois.net/ip-address-lookup/213.57.24.38 When did this phenomenon start happening...I swear this didn't happen a few years ago –  ctlaltdefeat Aug 7 '13 at 22:33

Sounds like your ISP is transparently proxying outgoing UDP 53 and forcing it to go their DNS servers.

If you have Tor running, you can have it resolve DNS queries. You'll need to set your local DNS servers to point to the internal IP address on which you are running Tor.

I believe OpenDNS accepts DNS queries on UDP port 5353. You'll need a locally running proxy that accepts DNS requests on localhost and then redirects them to OpenDNS on port 5353. Something like Acrylic DNS Proxy can be used on Windows.

share|improve this answer
    
Would DNSCrypt ensure what you said above? Because that still didn't help. –  ctlaltdefeat Aug 7 '13 at 22:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.