13 ms·
What is 1e100.net?
- cik 8y agoThe real reason they opted to do this, is make mobile firewalling more of a pain. If each application talked to the specific (types of) google services they needed, firewalling would be easier. Instead, users cannot have a global rule to block .1e100.net across their devices, due to this choice. In my case, this results in having literally dozens of rules - really one per application, in order to ensure that applications that are granted upstream internet access, are not granted .1e100.net access unless I explicitly feel that they need access to Google Services.
- sigjuice 8y agoHow is this specific to “mobile firewalling”? Wouldn’t my computer have to undergo the same pain?
- thanatropism 8y agoThere should be a market for devices that sit between your wi-fi modem and the ethernet cable that fulfill these firewalling needs. For security + convenience, they could be set up so that the internet can't update or configure it -- rather, you have to insert SD cards to upgrade or change rules. (Maybe the device already comes with "Full paranoia", "Dissident blogger", "All-family", etc. cards in different colors; updates are downloaded from the internet otherwise).
- jkaplowitz 8y agoNo such conspiracy theory needed: I don't think Google always uses separate IPs for each Google service. Their infrastructure is too large-scale, containerized and dynamic for that to be efficient.
- imglorp 8y agoSo, it's basically domain fronting. It's okay for them, when they do it to shroud their individual services and keep you from blocking one. If I want to pass Mail and block Adsense, no dice for me. But if I want to domain front, because I need to pass through a third party censor, tough darts for me.
- cik 8y agoExactly this, exactly my issue.
- ryanobjc 8y agoNo, this isn't domain fronting. This has to do with PTR records, reverse DNS. Domain fronting is all about the forward lookups, normally you wouldn't be making PTR requests in a normal web request. Putting all your infrastructure under a single utility domain is very common, all the ISPs do it. It's good practice for reasons listed elsewhere in here. Bringing in the practice of domain fronting into this conversation is technically irrelevant, but it does advance an agenda, relying upon the less-than-technically literate HN audience from being confused between reverse DNS, domain fronting, and firewall rules.
- walrus01 8y agoThis has nothing to do with domain fronting at all, this is industry standard reverse DNS and PTR records for ARIN, RIPE, APNIC, AFRINIC, etc IP space.
- fl0wenol 8y agoAll of their services and ad networks use the "regular" names (like youtube.com and google-analytics.com) for these services and webpages, so any browser or mobile device will be looking up IPs via those names. And it's not like they're using CNAMEs that point to mixed-in names either. You can block them selectively using proxies without issue. As far as 1e100.net goes, I'm not sure where that would be applicable or why it's an issue. Now, if you're looking to do that kind of selective blocking at the IP/netblock layer... good luck. That's a nearly impossible task since large network service providers like Google have so many network spaces coming and going and can move around their services as demand dictates. It's a core competency. And that wouldn't matter whether they were all part of one domain or all kept separate. Unless your strategy was to work out which netblocks each business unit's domains were authoratitive for on reverse lookup and then blocking all of that. But that's ... making a lot of assumptions.
- btian 8y agoI don't understand anything you said. Can you explain?
- deleted 8y ago[deleted]
- degenerate 8y agoGoogle should run a server on 1e100.net and redirect it to this answer. Some click tracking domains do this, and it helps non-technical people feel less worried when they punch the domain into their web browser and it goes somewhere with an explanation.
- walrus01 8y agoFor some ISPs, if you go to https://as12345.net https://as12345.net (where the 12345 is their globally unique AS number), you'll get a looking glass tool. Or a page with a link to their looking glass, contacts for NOC and abuse for use in NOC-to-NOC communications, etc. I don't think Google would do that, though.
- delroth 8y agoGoogle has https://peering.google.com/ https://peering.google.com/ for that purpose. My understanding is that it provides similar tooling for ASNs that have a relationship (peering, etc.) with Google ASNs.
- walrus01 8y agoYes, Google is pretty easy to peer with. At major public IXes they will bring up their V4 and v6 sessions on their side before yours, and leave them in an enabled state, since they use a suite of automation tools to manage traffic flows to regional peers. This makes it easy to bring up the session on your side and immediately see routes and live bgp prefix exchanges going both directions without having to interact with their noc. Given the number of peers that they have around the world, it would be very labor intensive to hand craft a bgp session config and leave it in a down state until mutual noc contact was made to bring it live. They obviously have a great interest in getting traffic like YouTube videos to the residential/commercial downstream eyeball ISP end users as efficiently as possible.
- skunkworker 8y agoI wish google would peer their fiber with Comcast better. That pipe is too small.
- EarthIsHome 8y agoAfter reading their explanation, I don't understand the purpose of 1e100.net. Maybe someone who is more technical than I am can explain how it is used to identify Google's servers and why that's useful. On that note, I should answer their question: Was this article helpful? with No.
- Pharaoh2 8y agoIts the domain name they use for their servers. Its generally a good practice to have a dns name that maps to a particular server apart form the website its supposed to be serving for administrative purposes. Try this: > dig google.com ;; ANSWER SECTION: google.com. 299 IN A 172.217.164.110 > nslookup 172.217.164.110 Non-authoritative answer: 110.164.217.172.in-addr.arpa name = sfo03s18-in-f14.1e100.net.
- aviau 8y agothey use subdomains of 1e100.net as names in their network
- cpeterso 8y agoI don't see any requests to 1e100.net when loading Google sites like google.com or youtube.com. I see domains like gstatic.com and apis.google.com, but but not 1e100.net.
- yebyen 8y agoTry a reverse lookup yebyen:~$ host google.com google.com has address 172.217.10.46 google.com has IPv6 address 2607:f8b0:4006:803::200e ... yebyen:~$ host 172.217.10.46 46.10.217.172.in-addr.arpa domain name pointer lga34s13-in-f14.1e100.net.
- forgottenpass 8y agoYou wouldn't. Multiple domain names can point to the same IP address. Any one IP address can only have one reverse (PTR) record.
- 8y ago
- 0x0 8y agoYou will often see the 1e100.net in reverse domain lookups, such as those produced by traceroute and ping. Try a traceroute to google.com and you should see at least one if not several 1e100.net hops.
- RyanShook 8y agoSo is all Google Cloud infrastructure routed through 1e100.net as well?
- deelowe 8y agoDomain names aren't routed. I assume every public ip maps to a name on this TLD, if that's what you're asking.
- chadcatlett 8y agoGoogle Cloud's infrastructure, AFAIK, has PTR records using 1e100.net. GC User's addresses, such as a GCE instance's public IP uses googleusercontent.com for PTR records.
- simon_acca 8y agodeelowe is right, this has not to do with routing, but to answer your question is spirit: yes, GCP machines user 1e100.net for their PTR records, Try pinging snapchat.com
- walrus01 8y agoDNS and IP routing (in the bgp/ospf/isis/rip/etc sense of the word) are two different things - you could theoretically build a rather large ISP with many peers and upstream transits but with no DNS. Just AS numbers, prefix lists, acls, vrfs, and v4 and v6 blocks from ARIN.
- equalunique 8y agoBe sure to hit "YES" under the "Was this article helpful?" prompt.
- kfrzcode 8y agoUnless, of course, the article wasn't helpful. Then hit "NO" under the same prompt. Because, you know, YMMV.
- emondi 8y agoInteresting that they group the machines by IATA airport codes. I guess that's the nearest airport for that datacenter.
- plttn 8y agoFrom my understanding it's more of a "what's the most well known airport". Google LA is in Venice, so it's closest airport should be SMO, it's still referred to in corp speak and machine naming as LAX.
- ryanobjc 8y agoThe point of naming convention isnt to be painfully pedantically correct, like this comment. It's to provide a useful guidepost to humans, who know LAX but don't know about SMO. Why didn't you mention ICAO codes, they'd be more universally correct anyways, right? KSMO, KLAX?
- deleted 8y ago[deleted]
- emondi 8y agoBut then NYC would not be LGA but JFK.
- sulam 8y agoFWIW this is a very wide practice in the industry.
- walrus01 8y agoNaming major city ISP POPs by IATA airport codes is a practice that goes back to uunet/AS701 in about 1995, maybe a bit earlier, when talking about reverse DNS for public IP space. It actually predates the existence of ARIN, even. then appending a number, so your first POP/core site in the DFW area might be DFW01, then DFW02, DFW03, and so on. On an international scale another non-airport or IATA related method is to group by ISO standard two or three country codes and then state/province/regional internal subdivision two letter abbreviations, so something in the bay area of california might have the last part of its DNS name as sfo01.ca.us.as12345.net
- dboreham 8y agoSee also : atdn.net ; tfbnw.net ; cloudfront.net In today's world of CDNs and IP anycast, I'm not sure how accurate it is to talk about these IPs corresponding to "a server". Obviously packets go to some NIC somewhere, but probably not the same one for each of us and likely not the same hour-to-hour. Seems that Facebook, Yahoo/AOL don't seem to go along with the convention that endpoint IPs reverse resolve to a different domain -- elsewhere in this thread mentioned as a cookie-payload-leak countermeasure. Google and Amazon do.
- ryanobjc 8y agoI don't think people appreciate how much effort Google does to minimizing cookie leakage. It's good security and privacy hygiene, and it also speeds requests - transmitting sizable cookies isn't free, and takes up time, especially when you're paying by the millisecond. This is why there are various different domains for static content, domains for user content (googleusercontent.com), domains for certain cloud services, etc. Protections against XSS and cookie leakage is taken very seriously.
- sigjuice 8y agoWhy not use a google.com subdomain? The first time I saw 1e100.net in the output of netstat, it confused the heck out of me.
- shizcakes 8y agoI recommend reading some of the other comments under this post - they dig into concepts like cookie leakage, reverse DNS separation, etc.
- xg15 8y agoI remember experimenting with traceroute and reverse DNS back in school and wondering what kind of mystery company even google was renting its servers from...
- sannee 8y agoHeh, I never realized doubles can fit a googol. I knew they work up to 1e300-ish, but never made this explicit connection.
- TillE 8y agoI'm usually extremely reluctant to use doubles past 2^52, when the minimum increment becomes larger than 1.0
- dagss 8y agoIn that case you should likely have used fixed point arithmetic to start with. Doubles larger than 2^52 are no different from smaller numbers in context of scientific computing etc. which is what floating point is for. E.g. in a particular numerical simulation you could bump above 2^52 by using units of nanometers or below by using units of kilometers... yet this is likely just a simple multiplicative factor and the result of the calculation does not change one bit because of what units of measurement you use. Getting closer to 10^300 and it is another story.
- dasyatidprime 8y ago“I would have liked to be able to represent (1 << 53) + 1 exactly, but all I have is JavaScript and importing a bignum library is a lot harder than just restricting the range” seems like an unfortunately common problem.
- simonbyrne 8y agoWell, only approximately: as a double it is actually 10000000000000000159028911097599180468360808563945281389781327557747838772170381060813469985856815104
- undersuit 8y agoIt still 'fits'. The box is just very weird and sometimes the object that comes out is slightly different in size, but at least it's predictable.
- beamatronic 8y agoA googol is a 1 with 100 zeroes after it. 1.0 x 10^100
- keajer 8y agoyes, this is the standard way to do the cookie syncing business.
- syncsynchalt 8y agoCookies will only use this domain if it's used in hostnames, but I think google only uses 1e100.net for reverse lookups (PTR results).
- gwerks 8y agoScientific notation for the number one google. I'm sure no one else knew that so I won't scroll down and check before answering.
- Zillion 8y ago1e100=1, not googol (which is 10e100). They should fix the name.
- chrismorgan 8y agoIn scientific notation, “e” means “×10^”, not “^”. “1e100” thus means “1×10¹⁰⁰”, which is correct.
- alpb 8y agoI also discovered while doing some whois checks that Google's domain registrar (Google Domains) is owned by a Google subsidiary called "Charleston Road Registry". http://charlestonroadregistry.com http://charlestonroadregistry.com This is the street that goes through the Google campus in Mountain View, CA.
- skunkworker 8y agoInteresting nomenclature but with google this makes sense. 1e100 = googol, which is 1 followed by 100 zeroes. And a googlgolplex is 1 followed by a googol zeroes.
- deleted 8y ago[deleted]
- oakpond 8y agoFYI, Android phones are always sending pings to 1e100 even if Google Apps are not installed. This is a system feature that detects 'captive portals'. If you want to observe your phone doing this, download the app 'Net Monitor' (also on F-droid). More info and how to disable this: https://www.reddit.com/r/LineageOS/comments/7m8tsq/mysterious_system_connections_to_1e100net/ https://www.reddit.com/r/LineageOS/comments/7m8tsq/mysteriou...
- deleted 8y ago[deleted]