7

I've noticed some very suspicious activity from my ISP.

Sometimes I would notice that when I ping google.com it would resolve to an IP which is owned by my ISP. I currently don't have an example since it is resolving normally at the moment. However, here's a weird thing. My ISP's DNS servers (41.128.225.225), 8.8.8.8, 8.8.4.4 and 4.2.2.2 are all pinging at about 12ms. Here's a traceroute of all these IPs which shows that the traffic never leaves the ISPs network.

ISP DNS:

Tracing route to 41.128.225.225 over a maximum of 30 hops

  1     4 ms     4 ms     3 ms  192.168.1.1
  2     *        *        *     Request timed out.
  3    11 ms    11 ms    11 ms  172.18.1.85
  4    11 ms    11 ms    11 ms  41.128.225.225

Google DNS:

Tracing route to google-public-dns-a.google.com [8.8.8.8] over a maximum of 30 hops:

  1     4 ms     4 ms     3 ms  192.168.1.1
  2     *        *        *     Request timed out.
  3    11 ms    12 ms    11 ms  172.18.1.97
  4     *        *        *     Request timed out.
  5    12 ms    12 ms    12 ms  172.20.2.14
  6    48 ms    15 ms    13 ms  172.17.1.10
  7    13 ms    13 ms    12 ms  google-public-dns-a.google.com [8.8.8.8]

Level3 DNS:

Tracing route to b.resolvers.Level3.net [4.2.2.2]
over a maximum of 30 hops:

  1     6 ms     3 ms     2 ms  192.168.1.1
  2     *        *        *     Request timed out.
  3    11 ms    13 ms    11 ms  172.18.1.81
  4    14 ms    35 ms    16 ms  b.resolvers.Level3.net [4.2.2.2]

All the 172.16.0.0/12 are in the ISPs private network which means none of this traffic left into the outside world. Can someone confirm if this is genuinely suspicious activity by my ISP, and is there something I can do about it?

  • 3
    I wouldn't call this hijacking exactly. More traffic shaping than anything else. It could be an attempt to reduce latency by providing proxy/cache servers of popular content. (Which is quite common amongst ISPs) – Ben Poulson Jan 10 '14 at 13:01
5

Yes, your ISP is very clearly hijacking not only the DNS for google, but also DNS requests you try to send to outside DNS servers.

You are correct in your analysis that the traffic to Google is not leaving your ISPs network. Your traceroutes also show that your DNS queries to Google Public DNS, as well as to Level 3's open resolvers, are not leaving your ISP's network.

Furthermore, the DNS A records returned all point to an IP inside your ISP's network, regardless of which DNS provider you query. i.e., the A record provided is hijacked, as that is not the A record that Google themselves provides, but rather one that your ISP has provided in its place.

It would appear that your ISP is hijacking the actual DNS queries in order to prevent you from circumventing its hijacking of the DNS records.

No BGP tampering is required for them to do this. All they need to do (and likely all they are doing) is route all packets destined for UDP 53 to their own nameservers. A simple setting in their own router.

  • Care to elaborate? – cutrightjm Aug 16 '14 at 6:38
  • 2
    Absolutely! added a more detailed explanation to my answer. – Joe Sniderman Aug 16 '14 at 7:03
  • You can use a VPN service to bypass your ISP's DNS. You'll have to trust your VPN provider but you'll have choice. – Neil Smithline May 31 '15 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.