0

I was checking a proxied program for DNS leaks with tshark when I noticed this:

13.170066    10.0.2.15 -> 192.168.1.1  DNS 66 Standard query 0xd473  A [hostname]
13.753496    10.0.2.15 -> 192.168.1.1  DNS 66 Standard query 0x7bb4  A [hostname]

where [hostname] is the hostname of the machine the program and tshark are running on, 10.0.2.15 is the local machine, and 192.168.1.1 is the router.

Why does the computer look up its own hostname and how can I prevent this from leaking information about the computer?

Note that changing the hostname once is not useful since an (untrusted) proxy knows that it is the same computer connecting every time since the computer sends the same hostname.

(crossposted from ask.wireshark.org)

7
  • Can you fix this by hardcoding 10.0.2.15 [hostname] into your hosts file ? Hopefully this would stop the lookup leaking out your local machine ?
    – davidgo
    Commented Feb 9, 2013 at 22:35
  • What are you afraid is "leaking" here? That it is asking for it's own IP address? Your system should have some kind of local name cache, so it shouldn't ask too often anyway. Re @davidgo's suggestion, don't hard-wire names that way. If DHCP sees fit to assign another IP address next month, things will fail in mystifying ways, and you'd have forgotten about this kludge.
    – vonbrand
    Commented Feb 10, 2013 at 1:09
  • @vonbrand I am afraid that the hostname is leaking. If I connect to a proxy and query my hostname, the proxy can map my hostname to the data sent during the connection. Later, if I connect to the same proxy (through intermediate proxies) it knows that the data sent in the new connection was sent from the same machine that sent the previous data. BTW It actually looks up the hostname almost every time I run a test program (firefox on google.com).
    – Navin
    Commented Feb 10, 2013 at 17:28
  • @davidgo , vonbrand: Are there any disadvantages to hardcoding the hostname to 127.0.0.1 ?
    – Navin
    Commented Feb 10, 2013 at 17:30
  • If you are worried to that measure, better look into stuff like tor <torproject.org>. Nothing you could knit at home will give you enough assurance (but even tor has had it's vulnerabilities...)
    – vonbrand
    Commented Feb 10, 2013 at 17:40

0

You must log in to answer this question.

Browse other questions tagged .