2

Previously I had a router setup to use ISP provided DNS servers, but as of recently I setup two local DNS servers with forwarders set yo google's public dns. Whenever I visit a website which I assume is not yet cached in local DNS router reports a whole bunch of unreplied connections from local DNS server to google's dns server. At the same time internet speed is lagging until router stops reporting unreplied connections.

From what I have read this may be caused by ISP intercepting DNS queries, which I would love to check.

  • If you suspect your ISP is intercepting DNS queries stop using their DNS servers.Previous questions on this topic have been asked before.There is easy enough command you can use and lots of other results on this topic. – Ramhound Apr 3 '15 at 17:49
  • 2
    Not using their DNS servers is exactly what I am trying to do, but if they are intercepting DNS queries to public DNS servers and resolving those queries on their end then there isn't much I can do. Ever since switching back to ISP DNS servers as forwarders, there are also no unreplied connections and no issues with internet connections. Therefore, I assume, ISP is fiddling with DNS queries intended for any but their servers, but I was hoping to find a way to get more concrete evidence. Edit: I might try routing DNS queries through remote site using VPN, but that again wont prove much – user68740 Apr 3 '15 at 18:10
  • 3
    @Ramhound he is talking about an ISP using something like NAT or route trickery to make something like Google's DNS be redirected to the ISP DNS servers. Something like this. serverfault.com/questions/672472/… – Zoredache Apr 3 '15 at 18:23
  • I would start by doing a traceroute to the servers you think may be intercepting. I think there are even tools that could do a UDP based traceroute with the port set to 53. See where the replies come from. – Zoredache Apr 3 '15 at 18:29
  • @Zoredache - I know what the author is talking about. – Ramhound Apr 3 '15 at 18:29
2

I have posted a detailed answer here because the questions are similar and that one is older.

In a nutshell:

  1. The easiest method is to use Netalyzr (retired) android app or the Namebench windows software by Google. They will inform you if your ISP is using a DNS proxy. You don't need any technical knowledge for this.

  2. Perform a DNS lookup to an authoritative nameserver and check if the reply is authoritative. For this example I will use dig. You can also use nslookup too. If the reply is authoritative, dig will display the aa flag in the reply. Now, a.ns.facebook.com is the authoritative NS of fb.me. If your ISP intercepts and redirects the request, you won't get an authoritative reply.

    dig @a.ns.facebook.com fb.me

  3. specify an IP address where no DNS server is running, as the DNS server while performing dig or nslookup. You will still receive reply if your ISP intercepts your request. Otherwise you will get Time Out.

  4. Use nmap on random IP addresses. You will always see port 53 open, if your ISP redirects all port 53 requests.

  5. Change your computer network settings and use Google public DNS or OpenDNS or Cloudflare DNS IP (Use one provider type at a time). Then go to Dns Leak Test website and notice if any different provider(s) is(are) appearing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.