4 ms·
A more interesting spin is TCP-over-DNS. Some networks will block TCP but not DNS, so you send all your traffic over DNS. It's not very efficient, though. If
by wisty 14y ago
A more interesting spin is TCP-over-DNS. Some networks will block TCP but not DNS, so you send all your traffic over DNS.
It's not very efficient, though.
If you have a server somewhere, there's no real limit to the creative ways you can get around network restrictions.
- chris_wot 14y agoDNS is an application protocol, TCP is a transport protocol. You can't be tunneling TCP over DNS, DNS (when not using UDP) actually uses TCP port 53. Are you sure that you are just getting SSH to listen on port 53?
- nitrogen 14y agoguylhem mentioned a few TCP-over-DNS applications in the seventh paragraph of this comment: https://news.ycombinator.com/item?id=4410722 https://news.ycombinator.com/item?id=4410722 Also, a quick search for "dns-over-tcp" yields several results.
- chris_wot 14y agoUh, he said tcp over dns, not dns over tcp.
- nitrogen 14y agoTypo. I searched for "tcp-over-dns", the first sentence of my comment said TCP-over-DNS, and tcp-over-dns is what several other comments on this thread are describing.
- chris_wot 14y agoFair enough :-) I'm actually quite amazed this is even possible, but quite happy to have been proven wrong! You learn something every day on this site...
- s_henry_paulson 14y agoDNS tunneling is actually possible: http://dnstunnel.de/ http://dnstunnel.de/ It's also interesting to note that Julian Assange (AFAIK) was the first person to come up with this idea back in 2006. http://re-iq.blogspot.com/2006/12/ip-over-ppp-over-dns-over-ip.html http://re-iq.blogspot.com/2006/12/ip-over-ppp-over-dns-over-...
- mherdeg 14y agoThe first entry in iodined's changelog is from June 2006, http://code.kryo.se/iodine/ http://code.kryo.se/iodine/, http://code.kryo.se/iodine/CHANGELOG.html http://code.kryo.se/iodine/CHANGELOG.html.
- oskarpearson 14y agoHi there I have to interject here - not to blow my own trumpet, but as a 'point of fact'. (Oops... once you start correcting misinformation on the internet, you are going to be busy for a long time.) I wrote about this in 1998, when I released source code that did this on the bugtraq mailing list - http://gray-world.net/papers/dnstunnel.txt http://gray-world.net/papers/dnstunnel.txt has a copy of my mail. Before that there was a long standing existing technique to tunnel data through UDP packets that simply pretended to be destined for the DNS port (53). That stopped working if the network admin filtered outbound UDP and forced people to use their local DNS server instead. My method still works in that scenario though. (If anyone knows of an earlier reference to the method I posted about, please let me know.. for all I know it was a well-known tactic in the underworld before I posted to bugtraq.) From Julian's post, it's not possible to see which of the two methods his code used, since the rb file seems to have disappeared. I suspect it was "my" method. I do like the ppp interface through - mine just tunneled bash commands + responses. Oskar
- jjguy 14y agoOskar, I didn't know you were an HN'er. Thanks for posting. I have studied malicious use of DNS for a long time and have not yet found any reference prior to your post in 1998. In fact, I used your original bugtraq post as a reference to kick off a whitepaper detection solution approach for enterprises: http://armatum.com/blog/2009/dns-part-ii/ http://armatum.com/blog/2009/dns-part-ii/ I'd sincerely welcome your feedback. HN'ers -- Despite Kaminsky's ego, all signs indicate Oskar invented DNS tunneling.
- eidorb 14y agoI've been living in a hotel for a few weeks. The internet is just a little expensive - $20 for 50 MB or 3 hours, whichever comes first. I had some time on my hands and got TCP over DNS working. It's obviously quite slow, but certainly useable. A fun exercise anyway.