4 ms·
So. A traceroute to thepiratebay.se is kind of amusing. From my home (Sweden), the packets seem to go to Frankfurt, then New York, take a link via an ip which
by Wilya 14y ago
So.
A traceroute to thepiratebay.se is kind of amusing.
From my home (Sweden), the packets seem to go to Frankfurt, then New York, take a link via an ip which reverses to intelsatone.net to a cambodgian ip (500ms latency right here), then reach the ip 175.45.177.217, assigned to Star Joint Venture Co Ltd. Who seem to be a legitimate North Korea internet provider (or, well, as legitimate as it gets, coming from North Korea). The rest of the traceroute doesn't ping back (edit: 6 hops, which could stay in NK, or lead you back anywhere in the world).
If it's a joke, it's a very elaborate one.
- willscott 14y agoI wouldn't be surprised if some of the ICMP responses are forged - It seems disadvantageous for the site to have such a long path, since each hop has the potential for attack. http://www.thoughtcrime.org/software/fakeroute/ http://www.thoughtcrime.org/software/fakeroute/ can be seen as previous work that it is practical to do something like this.
- RyanZAG 14y agoI don't believe forging will help them much - they are doing this to avoid international law enforcement, and international law enforcement can easily check through a simple bluff like that. Altering routing companies sending traffic through in bulk from Germany-NY-Satellite is far more difficult, but we may see them do this anyway. Time will tell.
- runn1ng 14y agoThey can also have someone inside the Thai Star Joint corporation that does the internet connectivity in NK.
- simcop2387 14y agoNot just ICMP, doing a traceroute over tcp also results in this. Looks to be either a really well done forgery, or legitimate.
- MichaelGG 14y agoTCP traceroute relies on ICMP responses, too.
- blumentopf 14y agoNo it's not forged as can be seen from the AS path in the global routing table.
- elsewhere 14y agoYes, it is forged, as explained by tuomasb. Furthermore, a round trip time less than about 60 ms between Europe and North Korea is impossible, assuming the data is traveling at the speed of light. And we measured much less than that.
- djcapelis 14y agoI don't see any open ports on that host, do you? Even if it's just a load balancer, the connection would need to terminate on a routable IP somewhere...
- blumentopf 14y agoAS path as seen from the RIPE NCC RIS looking glass for 194.71.107.0/24: ... 2914 39138 22351 131279 51040 ... [NTT America/ARIN] [rrbone/RIPE] [Intelsat/ARIN] [STAR JOINT VENTURE/APNIC] [The Pirate Bay/RIPE] Apart from that /24, STAR JOINT VENTURE only advertises 175.45.176.0/22 (albeit as four /24, idiotically enough). What's kind of interesting is that this /22 is visible with a much shorter AS path: ... 3257 4837 131279 ... [Tinet/RIPE] [China Netcom/APNIC] [STAR JOINT VENTURE/APNIC] The question is: Is is deliberate that the Chinese don't allow transit of the Pirate Bay /24 through their network? (As opposed to Intelsat, a Washington-based American company.)
- runn1ng 14y agoI don't understand BGP and AS... what does that mean?
- blumentopf 14y agoAS path = the numbers of the Autonomous Systems that traffic will pass through to reach that particular destination
- bm1362 14y agoSuperficial explanation: BGP is the border gateway protocol- you can think of large infrastructure providers as being huge networks that are connected through 'border nodes'. BGP is the protocol it uses to negotiate routes into each other's networks, each provider advertises to the other provider what routes it has available. A common way to make a country go dark is by simply removing the BGP routes advertised for that country.
- tuomasb 14y agoFirst type traceroute thepiratebay.se Then tcptraceroute -f 128 -m 128 thepiratebay.se http://news.ycombinator.com/item?id=5319720 http://news.ycombinator.com/item?id=5319720 for explanation how they did it.
- viraptor 14y agoIt could be bad labelling too. I'm not sure about the details of how it happened, but I used an ISP in UK who was assigning ranges officially located in Italy. (BTW: that really broke google for a long time. google will revert your language to the automatically discovered one, even after you use their magic url that should prevent this)
- ceph_ 14y agoYou're confusing how internet routing with how some internet services assign geographical locations to ip address (GeoIP). The path your traffic takes through the internet has nothing to do with geoip.
- ChiperSoft 14y agoI think what he's saying is that the IPs returned in the trace route might not actually be in the geography we think they are.
- viraptor 14y agoNo, I meant both. I got an IP which was identified as belonging to an Italian ISP by ripe. On top of that geoip results were obviously wrong/right depending on how you look at it.
- jlgaddis 14y agoThere is no "official location" of IP addresses. The IP addresses allocated to the ISP I work for are "officially located" (according to my ARIN POC records) in the city I live in (specifically, at my PO Box). We ($ISP) don't even provide service in that city.
- revelation 14y agoThis seems reasonably legit. AS131279 (Star Joint Venture Co Ltd) has (or had) a peering with the Piratpartie Norge (pirate party norway): http://bgp.he.net/AS131279#_peers http://bgp.he.net/AS131279#_peers