3 ms·

If anyone is in Turkey and can configure their system to use Google Public DNS IPs / OpenDNS IPs as their resolvers, I'd be interested to learn what you see on:

If anyone is in Turkey and can configure their system to use Google Public DNS IPs / OpenDNS IPs as their resolvers, I'd be interested to learn what you see on: http://whatsmyresolver.stdlib.net/ http://whatsmyresolver.stdlib.net/ It's clear that addresses such as 8.8.8.8 are being intercepted. But it's unclear if the interceptor is passing on the uninteresting queries to the "real" Google Public DNS / OpenDNS, or if they are acting as standalone resolvers. The above website records what IP address the resolver uses to communicate with authoritative DNS servers.

erhanerdogan 13y ago
195.175.255.82
- colmmacc 13y ago
  Thanks! that looks like they are running standalone resolvers: inetnum: 195.174.0.0 - 195.175.255.255 netname: TR-TELEKOM-960902 descr: Turk Telekomunikasyon Anonim Sirketi in that case, each ISP is probably running their own standalone servers.
  - erhanerdogan 13y ago
    Nope, this is not an ISP. Turk Telekom is stated-owned broadband internet (infrastructure) company. All of the ISPs are having the same peering. I checked your link through TTNet. We also have Superonline and Smile as main ISPs.
    - ardacinar 13y ago
      Turk Telekom is not state-owned, not for the last 8 years or so.
      - morsch 13y ago
        Details courtesy of Wikipedia: Privatized in 2005. "55% of the shares of Turk Telekom belongs to Oger Telekomünikasyon A.Ş. and 30% of the shares belongs to Undersecretariat of Treasure of Turkey. The remaining 15% of shares has been offered to the public." Oger Telekom is apparently 100% privately owned by the Hariri family. So, still 30% state owned. As one point of reference, the German government still holds 15% directly plus 17% indirectly of Deutsche Telekom. France and Orange (nee France Telecom) are similar.
- jlgaddis 13y ago
  Would you mind posting a traceroute to 8.8.8.8? I'm curious as to the "how", e.g. if they're announcing the IP/subnet into BGP or (assuming traffic flows through them) if they're just transparently redirecting (DNAT, in effect) it to their own DNS servers.
  - gkya 13y ago
    traceroute to 208.67.222.222 (208.67.222.222), 30 hops max, 60 byte packets 1 192.168.1.1 (192.168.1.1) 2.525 ms 3.372 ms 8.410 ms 2 78.180.240.1.dynamic.ttnet.com.tr (78.180.240.1) 26.861 ms 28.677 ms 30.683 ms 3 81.212.78.13.static.turktelekom.com.tr (81.212.78.13) 32.834 ms 33.887 ms 34.726 ms 4 gayrettepe-t2-3-gayrettepe-t3-5.turktelekom.com.tr.205.212.81.in-addr.arpa (81.212.205.105) 36.738 ms 37.718 ms 39.747 ms 5 ulus-t2-3-gayrettepe-t2-3.turktelekom.com.tr.204.212.81.in-addr.arpa (81.212.204.205) 48.947 ms 49.867 ms 51.937 ms 6 ulus-t3-4-ulus-t2-3.turktelekom.com.tr.204.212.81.in-addr.arpa (81.212.204.149) 56.001 ms 27.122 ms 29.496 ms 7 * * * ... 30 * * * 8.8.8.8 gives similar (indeed identical if I've good eye-diff skills) output.
    - jlgaddis 13y ago
      Thanks, I found a TT LG in the meantime. Interestingly enough, it throws an error ("Please enter a valid IPv4/IPv6 address!") when I ask it for the routes it has for 8.8.4.0/24 or 8.8.8.0/24. If I ask for 8.8.33.0/24 (the "closest" subnet I see in my own BGP tables), it responds normally.
      - askbjoernhansen 13y ago
        It'd be easier for them to announce the /32, I'd think.
        jlgaddis 13y ago
        Right, I'm sure they are (they pretty much have to, unless they want to make it harder on themselves)... there's no reason they'd need to filter the /24s out, unless they're afraid that maybe Google would start using other IPs in the same /24 to help the Turks bypass it or something.
y0ghur7_xxx 13y ago
> http://whatsmyresolver.stdlib.net/ http://whatsmyresolver.stdlib.net/ I didn't know this could be done. I am using powerdns on my own server at home, and it displays correctly my ip address. Can you give me some pointers to understand how this works?
- jlgaddis 13y ago
  Disclaimer: I don't know with absolute certainly that this is correct but based on a quick look at the page and what I already know I think it's probably correct. Look at the the source for that page and you'll see: <script language="javascript" src="http://whatsmyresolver.stdlib.net/resolver/"></script> When your browser loads that, it'll return a reference to a resource with a unique hostname. Open that URL in your browser, for example, and you'll likely see something like the following in the address bar (this is what I received, with a few characters changed): http://e9v4ftan41uv2676ycdcl1a504pupav2lp7hinqlffonpuk7wk87p9cd42oy4.nonce.stdlib.net/resolver/ Thus, your browser will do a DNS lookup for that hostname. Because that URL is unique to you, the DNS server knows that it is you making the DNS request. It makes a note of what IP address the request came from and returns that to you as the IP of your resolver. Similar to you, I have a pair of resolvers running here at home and I am returned the IP address of one of them.
  - y0ghur7_xxx 13y ago
    Thank you
  - colmmacc 13y ago
    You can be certain now, that's exactly how it works!
ryzvonusef 13y ago
Hey, OP, I'm from Pakistan, but I thought you might like some comparative info, esp. since we are blocking youtube too. ---- Your resolver's source IP1 is: 58.27.204.243 1: Technically it's at least one of your resolver's IPv4 source addresses. ---- Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Users\>tracert 8.8.8.8 Tracing route to google-public-dns-a.google.com [8.8.8.8] over a maximum of 30 hops: 1 2 ms 1 ms 3 ms 192.168.0.1 2 59 ms 64 ms 69 ms 10.204.0.1 3 77 ms 99 ms * 58-27-174-122.wateen.net [58.27.174.122] 4 75 ms 84 ms 44 ms 58-27-174-65.wateen.net [58.27.174.65] 5 75 ms 78 ms 59 ms 58-27-180-190.wateen.net [58.27.180.190] 6 66 ms 63 ms 63 ms 58-27-174-26.wateen.net [58.27.174.26] 7 95 ms 104 ms 125 ms tw130-static117.tw1.com [119.63.130.117] 8 90 ms 104 ms 114 ms tw255-static233.tw1.com [110.93.255.233] 9 200 ms 219 ms 209 ms 72.14.222.151 10 229 ms 194 ms 225 ms 72.14.235.67 11 215 ms 228 ms 229 ms 72.14.232.78 12 194 ms 224 ms 224 ms 209.85.254.116 13 * * * Request timed out. 14 225 ms 234 ms 224 ms google-public-dns-a.google.com [8.8.8.8] Trace complete. ----

erhanerdogan 13y ago

195.175.255.82

colmmacc 13y ago
Thanks! that looks like they are running standalone resolvers: inetnum: 195.174.0.0 - 195.175.255.255 netname: TR-TELEKOM-960902 descr: Turk Telekomunikasyon Anonim Sirketi in that case, each ISP is probably running their own standalone servers.
- erhanerdogan 13y ago
  Nope, this is not an ISP. Turk Telekom is stated-owned broadband internet (infrastructure) company. All of the ISPs are having the same peering. I checked your link through TTNet. We also have Superonline and Smile as main ISPs.
  - ardacinar 13y ago
    Turk Telekom is not state-owned, not for the last 8 years or so.
    - morsch 13y ago
      Details courtesy of Wikipedia: Privatized in 2005. "55% of the shares of Turk Telekom belongs to Oger Telekomünikasyon A.Ş. and 30% of the shares belongs to Undersecretariat of Treasure of Turkey. The remaining 15% of shares has been offered to the public." Oger Telekom is apparently 100% privately owned by the Hariri family. So, still 30% state owned. As one point of reference, the German government still holds 15% directly plus 17% indirectly of Deutsche Telekom. France and Orange (nee France Telecom) are similar.
jlgaddis 13y ago
Would you mind posting a traceroute to 8.8.8.8? I'm curious as to the "how", e.g. if they're announcing the IP/subnet into BGP or (assuming traffic flows through them) if they're just transparently redirecting (DNAT, in effect) it to their own DNS servers.
- gkya 13y ago
  traceroute to 208.67.222.222 (208.67.222.222), 30 hops max, 60 byte packets 1 192.168.1.1 (192.168.1.1) 2.525 ms 3.372 ms 8.410 ms 2 78.180.240.1.dynamic.ttnet.com.tr (78.180.240.1) 26.861 ms 28.677 ms 30.683 ms 3 81.212.78.13.static.turktelekom.com.tr (81.212.78.13) 32.834 ms 33.887 ms 34.726 ms 4 gayrettepe-t2-3-gayrettepe-t3-5.turktelekom.com.tr.205.212.81.in-addr.arpa (81.212.205.105) 36.738 ms 37.718 ms 39.747 ms 5 ulus-t2-3-gayrettepe-t2-3.turktelekom.com.tr.204.212.81.in-addr.arpa (81.212.204.205) 48.947 ms 49.867 ms 51.937 ms 6 ulus-t3-4-ulus-t2-3.turktelekom.com.tr.204.212.81.in-addr.arpa (81.212.204.149) 56.001 ms 27.122 ms 29.496 ms 7 * * * ... 30 * * * 8.8.8.8 gives similar (indeed identical if I've good eye-diff skills) output.
  - jlgaddis 13y ago
    Thanks, I found a TT LG in the meantime. Interestingly enough, it throws an error ("Please enter a valid IPv4/IPv6 address!") when I ask it for the routes it has for 8.8.4.0/24 or 8.8.8.0/24. If I ask for 8.8.33.0/24 (the "closest" subnet I see in my own BGP tables), it responds normally.
    - askbjoernhansen 13y ago
      It'd be easier for them to announce the /32, I'd think.
      - jlgaddis 13y ago
        Right, I'm sure they are (they pretty much have to, unless they want to make it harder on themselves)... there's no reason they'd need to filter the /24s out, unless they're afraid that maybe Google would start using other IPs in the same /24 to help the Turks bypass it or something.

y0ghur7_xxx 13y ago

> http://whatsmyresolver.stdlib.net/ http://whatsmyresolver.stdlib.net/ I didn't know this could be done. I am using powerdns on my own server at home, and it displays correctly my ip address. Can you give me some pointers to understand how this works?

jlgaddis 13y ago
Disclaimer: I don't know with absolute certainly that this is correct but based on a quick look at the page and what I already know I think it's probably correct. Look at the the source for that page and you'll see: <script language="javascript" src="http://whatsmyresolver.stdlib.net/resolver/"></script> When your browser loads that, it'll return a reference to a resource with a unique hostname. Open that URL in your browser, for example, and you'll likely see something like the following in the address bar (this is what I received, with a few characters changed): http://e9v4ftan41uv2676ycdcl1a504pupav2lp7hinqlffonpuk7wk87p9cd42oy4.nonce.stdlib.net/resolver/ Thus, your browser will do a DNS lookup for that hostname. Because that URL is unique to you, the DNS server knows that it is you making the DNS request. It makes a note of what IP address the request came from and returns that to you as the IP of your resolver. Similar to you, I have a pair of resolvers running here at home and I am returned the IP address of one of them.
- y0ghur7_xxx 13y ago
  Thank you
- colmmacc 13y ago
  You can be certain now, that's exactly how it works!

ryzvonusef 13y ago

Hey, OP, I'm from Pakistan, but I thought you might like some comparative info, esp. since we are blocking youtube too. ---- Your resolver's source IP1 is: 58.27.204.243 1: Technically it's at least one of your resolver's IPv4 source addresses. ---- Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Users\>tracert 8.8.8.8 Tracing route to google-public-dns-a.google.com [8.8.8.8] over a maximum of 30 hops: 1 2 ms 1 ms 3 ms 192.168.0.1 2 59 ms 64 ms 69 ms 10.204.0.1 3 77 ms 99 ms * 58-27-174-122.wateen.net [58.27.174.122] 4 75 ms 84 ms 44 ms 58-27-174-65.wateen.net [58.27.174.65] 5 75 ms 78 ms 59 ms 58-27-180-190.wateen.net [58.27.180.190] 6 66 ms 63 ms 63 ms 58-27-174-26.wateen.net [58.27.174.26] 7 95 ms 104 ms 125 ms tw130-static117.tw1.com [119.63.130.117] 8 90 ms 104 ms 114 ms tw255-static233.tw1.com [110.93.255.233] 9 200 ms 219 ms 209 ms 72.14.222.151 10 229 ms 194 ms 225 ms 72.14.235.67 11 215 ms 228 ms 229 ms 72.14.232.78 12 194 ms 224 ms 224 ms 209.85.254.116 13 * * * Request timed out. 14 225 ms 234 ms 224 ms google-public-dns-a.google.com [8.8.8.8] Trace complete. ----