What does “dig .” actually query and where are those IPs coming from?
Out of curiosity, I entered dig . today. To my surprise, I got an IP:
$ dig .
; <<>> DiG 9.10.3-P4-Ubuntu <<>> .
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45964
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;. IN A
;; ANSWER SECTION:
. 291 IN A 172.217.23.174
;; Query time: 150 msec
;; SERVER: 10.0.0.138#53(10.0.0.138)
;; WHEN: Fri Feb 22 18:03:53 STD 2019
;; MSG SIZE rcvd: 33
Now, this IP seems to belong to Google, and http://172.217.23.174/ actually redirects to http://www.google.com/.
However, trying this repeatedly gave me different IPs: 52.95.34.225 (Amazon), 157.240.1.13 (Facebook), 52.114.128.9 (Microsoft), 23.195.9.143 (Akamai), and others... (this actually reads like the who-is-who of Internet companies!)
Googling each of them never revealed anything special other than the organization they belong to.
So, now I'm even more curious: Where are these IPs coming from? And what does dig . actually do? It seems to query the "DNS root" which, as I understand, shouldn't have random A records...
dns dig
asked Feb 22 at 16:13
CherryDTCherryDT
31518
add a comment |
Out of curiosity, I entered dig . today. To my surprise, I got an IP:
$ dig .
; <<>> DiG 9.10.3-P4-Ubuntu <<>> .
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45964
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;. IN A
;; ANSWER SECTION:
. 291 IN A 172.217.23.174
;; Query time: 150 msec
;; SERVER: 10.0.0.138#53(10.0.0.138)
;; WHEN: Fri Feb 22 18:03:53 STD 2019
;; MSG SIZE rcvd: 33
Now, this IP seems to belong to Google, and http://172.217.23.174/ actually redirects to http://www.google.com/.
However, trying this repeatedly gave me different IPs: 52.95.34.225 (Amazon), 157.240.1.13 (Facebook), 52.114.128.9 (Microsoft), 23.195.9.143 (Akamai), and others... (this actually reads like the who-is-who of Internet companies!)
Googling each of them never revealed anything special other than the organization they belong to.
So, now I'm even more curious: Where are these IPs coming from? And what does dig . actually do? It seems to query the "DNS root" which, as I understand, shouldn't have random A records...
dns dig
asked Feb 22 at 16:13
CherryDTCherryDT
31518
add a comment |
Out of curiosity, I entered dig . today. To my surprise, I got an IP:
$ dig .
; <<>> DiG 9.10.3-P4-Ubuntu <<>> .
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45964
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;. IN A
;; ANSWER SECTION:
. 291 IN A 172.217.23.174
;; Query time: 150 msec
;; SERVER: 10.0.0.138#53(10.0.0.138)
;; WHEN: Fri Feb 22 18:03:53 STD 2019
;; MSG SIZE rcvd: 33
Now, this IP seems to belong to Google, and http://172.217.23.174/ actually redirects to http://www.google.com/.
However, trying this repeatedly gave me different IPs: 52.95.34.225 (Amazon), 157.240.1.13 (Facebook), 52.114.128.9 (Microsoft), 23.195.9.143 (Akamai), and others... (this actually reads like the who-is-who of Internet companies!)
Googling each of them never revealed anything special other than the organization they belong to.
So, now I'm even more curious: Where are these IPs coming from? And what does dig . actually do? It seems to query the "DNS root" which, as I understand, shouldn't have random A records...
dns dig
asked Feb 22 at 16:13
CherryDTCherryDT
31518
Out of curiosity, I entered dig . today. To my surprise, I got an IP:
$ dig .
; <<>> DiG 9.10.3-P4-Ubuntu <<>> .
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45964
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;. IN A
;; ANSWER SECTION:
. 291 IN A 172.217.23.174
;; Query time: 150 msec
;; SERVER: 10.0.0.138#53(10.0.0.138)
;; WHEN: Fri Feb 22 18:03:53 STD 2019
;; MSG SIZE rcvd: 33
Now, this IP seems to belong to Google, and http://172.217.23.174/ actually redirects to http://www.google.com/.
However, trying this repeatedly gave me different IPs: 52.95.34.225 (Amazon), 157.240.1.13 (Facebook), 52.114.128.9 (Microsoft), 23.195.9.143 (Akamai), and others... (this actually reads like the who-is-who of Internet companies!)
Googling each of them never revealed anything special other than the organization they belong to.
So, now I'm even more curious: Where are these IPs coming from? And what does dig . actually do? It seems to query the "DNS root" which, as I understand, shouldn't have random A records...
dns dig
dns dig
asked Feb 22 at 16:13
CherryDTCherryDT
31518
asked Feb 22 at 16:13
CherryDTCherryDT
31518
edited Feb 24 at 22:22
CherryDT
asked Feb 22 at 16:13
CherryDTCherryDT
31518
asked Feb 22 at 16:13
CherryDTCherryDT
31518
asked Feb 22 at 16:13
CherryDTCherryDT
31518
31518
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Yes, . refers to the DNS "root". Yes, . is not supposed to have any record types other than NS and SOA (plus DNSSEC-related RRSIG/DNSKEY if you query with the +dnssec option).
So in this case, you're sending the queries to 10.0.0.138 (which is a private address in your LAN), and it's sending you completley made-up replies. You should investigate who owns that host on your LAN, and why it's configured as your DNS server to begin with.
(Interestingly, it still includes the ad (authenticated data) flag, implying that it had DNSSEC-verified the records before responding, which is just more lies and a reminder to not trust the 'ad' flag.)
answered Feb 22 at 19:30
grawitygrawity
242k37510567
10.0.0.138is the DSL router and it appears to be a NetGear Genie VEGN2610. It didn't occur to me that the router could be lying to me. Interesting bug, I wonder where it gets those IPs from and if this has any security implications.
– CherryDT
Feb 24 at 22:20
1
Further tests showed that this gives a copy of the answer of the last DNS query. Not interesting security-wise though since I could simply sniff the query packet from the network.
– CherryDT
Feb 24 at 22:27
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1408532%2fwhat-does-dig-actually-query-and-where-are-those-ips-coming-from%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Yes, . refers to the DNS "root". Yes, . is not supposed to have any record types other than NS and SOA (plus DNSSEC-related RRSIG/DNSKEY if you query with the +dnssec option).
So in this case, you're sending the queries to 10.0.0.138 (which is a private address in your LAN), and it's sending you completley made-up replies. You should investigate who owns that host on your LAN, and why it's configured as your DNS server to begin with.
(Interestingly, it still includes the ad (authenticated data) flag, implying that it had DNSSEC-verified the records before responding, which is just more lies and a reminder to not trust the 'ad' flag.)
answered Feb 22 at 19:30
grawitygrawity
242k37510567
10.0.0.138is the DSL router and it appears to be a NetGear Genie VEGN2610. It didn't occur to me that the router could be lying to me. Interesting bug, I wonder where it gets those IPs from and if this has any security implications.
– CherryDT
Feb 24 at 22:20
1
Further tests showed that this gives a copy of the answer of the last DNS query. Not interesting security-wise though since I could simply sniff the query packet from the network.
– CherryDT
Feb 24 at 22:27
add a comment |
Yes, . refers to the DNS "root". Yes, . is not supposed to have any record types other than NS and SOA (plus DNSSEC-related RRSIG/DNSKEY if you query with the +dnssec option).
So in this case, you're sending the queries to 10.0.0.138 (which is a private address in your LAN), and it's sending you completley made-up replies. You should investigate who owns that host on your LAN, and why it's configured as your DNS server to begin with.
(Interestingly, it still includes the ad (authenticated data) flag, implying that it had DNSSEC-verified the records before responding, which is just more lies and a reminder to not trust the 'ad' flag.)
answered Feb 22 at 19:30
grawitygrawity
242k37510567
10.0.0.138is the DSL router and it appears to be a NetGear Genie VEGN2610. It didn't occur to me that the router could be lying to me. Interesting bug, I wonder where it gets those IPs from and if this has any security implications.
– CherryDT
Feb 24 at 22:20
1
Further tests showed that this gives a copy of the answer of the last DNS query. Not interesting security-wise though since I could simply sniff the query packet from the network.
– CherryDT
Feb 24 at 22:27
add a comment |
Yes, . refers to the DNS "root". Yes, . is not supposed to have any record types other than NS and SOA (plus DNSSEC-related RRSIG/DNSKEY if you query with the +dnssec option).
So in this case, you're sending the queries to 10.0.0.138 (which is a private address in your LAN), and it's sending you completley made-up replies. You should investigate who owns that host on your LAN, and why it's configured as your DNS server to begin with.
(Interestingly, it still includes the ad (authenticated data) flag, implying that it had DNSSEC-verified the records before responding, which is just more lies and a reminder to not trust the 'ad' flag.)
answered Feb 22 at 19:30
grawitygrawity
242k37510567
Yes, . refers to the DNS "root". Yes, . is not supposed to have any record types other than NS and SOA (plus DNSSEC-related RRSIG/DNSKEY if you query with the +dnssec option).
So in this case, you're sending the queries to 10.0.0.138 (which is a private address in your LAN), and it's sending you completley made-up replies. You should investigate who owns that host on your LAN, and why it's configured as your DNS server to begin with.
(Interestingly, it still includes the ad (authenticated data) flag, implying that it had DNSSEC-verified the records before responding, which is just more lies and a reminder to not trust the 'ad' flag.)
answered Feb 22 at 19:30
grawitygrawity
242k37510567
edited Feb 22 at 19:43
answered Feb 22 at 19:30
grawitygrawity
242k37510567
answered Feb 22 at 19:30
grawitygrawity
242k37510567
answered Feb 22 at 19:30
grawitygrawity
242k37510567
242k37510567
10.0.0.138is the DSL router and it appears to be a NetGear Genie VEGN2610. It didn't occur to me that the router could be lying to me. Interesting bug, I wonder where it gets those IPs from and if this has any security implications.
– CherryDT
Feb 24 at 22:20
1
Further tests showed that this gives a copy of the answer of the last DNS query. Not interesting security-wise though since I could simply sniff the query packet from the network.
– CherryDT
Feb 24 at 22:27
add a comment |
10.0.0.138is the DSL router and it appears to be a NetGear Genie VEGN2610. It didn't occur to me that the router could be lying to me. Interesting bug, I wonder where it gets those IPs from and if this has any security implications.
– CherryDT
Feb 24 at 22:20
1
Further tests showed that this gives a copy of the answer of the last DNS query. Not interesting security-wise though since I could simply sniff the query packet from the network.
– CherryDT
Feb 24 at 22:27
10.0.0.138 is the DSL router and it appears to be a NetGear Genie VEGN2610. It didn't occur to me that the router could be lying to me. Interesting bug, I wonder where it gets those IPs from and if this has any security implications.– CherryDT
Feb 24 at 22:20
10.0.0.138 is the DSL router and it appears to be a NetGear Genie VEGN2610. It didn't occur to me that the router could be lying to me. Interesting bug, I wonder where it gets those IPs from and if this has any security implications.– CherryDT
Feb 24 at 22:20
1
1
Further tests showed that this gives a copy of the answer of the last DNS query. Not interesting security-wise though since I could simply sniff the query packet from the network.
– CherryDT
Feb 24 at 22:27
Further tests showed that this gives a copy of the answer of the last DNS query. Not interesting security-wise though since I could simply sniff the query packet from the network.
– CherryDT
Feb 24 at 22:27
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1408532%2fwhat-does-dig-actually-query-and-where-are-those-ips-coming-from%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
