2

If an ISP wants to gather profiles on users, or block certain websites, they can fairly easily redirect outgoing UDP traffic to port 53 to their own DNS servers.

How could this be detected by the end user? Assume that the redirection is being done via a trivial router rule rather than though deep packet inspection.

  • 1) DNS is over TCP as well as UDP, not counting the new forms over TLS or HTTPS 2) to gather data, for UDP and TCP it just needs to listen passively on the netowrk, not need to redirect anything 3) even to block websites it can just block all DNS traffic except the one going to the recursive nameserver he maintains where it can put in place any policy it wishes 4) outside than that, to detect changes, DNSSEC is here to do exactly that but depends on the domain; otherwise getting different results than tests done elsewhere can show packets being tampered with. – Patrick Mevzek Nov 4 '19 at 1:09
  • @PatrickMevzek Gathering data passively would involve having to do deep packet inspection, which seems less likely since it's "expensive". It'd be cheaper to just redirect the traffic, and collect data normally. – Steve Sether Nov 4 '19 at 1:19
  • There are a lot of passive DNS collection methods, and they are not expensive, at least at the level of an ISP for its customers traffic. This does not need any redirections. And it is then completely invisible, contrary to ISP hijacking well known IP addresses like 1.1.1.1. – Patrick Mevzek Nov 4 '19 at 1:49
  • @PatrickMevzek yes but if an ISP did hijack, say, 1.1.1.1, would it be obvious to the end user? That is the question being asked. – Conor Mancone Nov 4 '19 at 2:23
3

There are actually numerous useful hits when searching for detect isp dns interception. It basically boils down to this:

  • Check if any target port 53 gets redirected:
    Use tools like dig or nslookup to use an arbitrary external IP address which likely has no DNS server running as a DNS server. If one gets a response something has intercepted port 53 and replied to it.
  • Check if port 53 to specific servers gets redirected:
    Do a UDP based traceroute against the intended DNS server at port 53 and some other port. If the results differ a lot (i.e. port 53 has a way shorter route or totally different route) then there is likely interception going on.

For more see also How can I check if my ISP is intercepting DNS queries sent to alternative DNS servers? and Is Your ISP Hijacking Your DNS Traffic?.

Note that none of these techniques detects silent sniffing by the ISP. Also, in theory the ISP could work around such detection by not redirecting the DNS request but instead capturing a DNS response and modifying the result in it. This again could be detected if the response received differs from an expected response. DoH (DNS over HTTP) prevents both sniffing and modifications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.