[as112-ops] Discovering more AS112 nodes

[William F. Maton]

On Mon, 19 Sep 2011, Wessels, Duane wrote:

>
> On Sep 14, 2011, at 6:25 AM, William F. Maton wrote:
>
>> 	In starting this in July and now returning to it, I noted that it
>> would have been nice if there were DNS looking lgasses lying around - short of prodding open-recursive DNS servers on the Internet and asking them about the AS112 records to trace unknown nodes.  (I found one doing a quick search.)  Perhaps there's a trusted, existing effort that does this already and I can have the query piggybacked on it.
>
> I can give you a (longish) list of open resolvers if you like.

Duane,
 	Much appreciated.  Over the weekend I wrote a script (nothing 
fancy, nor does it dump into a database) to try lookups against these open 
resolvers to see what they think is the neareast AS112 server to each of 
them.  The script is still running, but the results so far are somewhat 
disturbing:

1)  All global research networks (except grnet) send RFC1918 lookups all
     the way to the Ottawa node.

2)  On a lark, I asked them about DNS implmentation version.  Wow, lot's
     of old versions, possibly vulnerable.

As I said, I'm still waiting for the script to finish, perhaps in several 
days, before I have enough raw data to use to create an idea of where 
these nodes live and infer routing patterns surrounding them.  But it 
already seems to reinforce the case for more of these nodes, especially on 
the advanced reasearch networks.

I also happen to have a long-neglected database of ip-to-country listings 
and a cache of whois data.  I might be able to produce a useful map from 
the whole mess, we'll see.

BTW, in light of the recent IETF DNSOP discussions, such a method and 
tool can be used to infer f.root-servers.net and other DNS anycast 
locations - if the info found in

Thanks,

wfms