[dns-operations] Odd behaviour of DNS queries in PRC (facebook, youtube & twitter)

Mauricio Vergara Ereche mave at nic.cl
Thu Mar 25 14:36:30 UTC 2010

On Thursday 25 March 2010 10:28:16 Stephane Bortzmeyer wrote:
> On Thu, Mar 25, 2010 at 09:38:49AM +0800,
>  Xiaodong Lee <lee at cnnic.cn> wrote
>  a message of 19 lines which said:
> > As the local host of the mirror site of I root server which was
> > agreed by I root server administrator, and also as the ".CN"
> > registry which is one of the members of DNS community, we wanna
> > clarify that CNNIC never did any interceptions
> Nobody said it was you. It could be the ISP's IGP which was hacked to
> direct queries to a rogue and unofficial copy of I-root.

<hat "personal">
I second Stephane and previous Bert's opinion.

With my first post I was never implying that I-root managers or the co-
operator from that node was doing anything wrong or suspicious about it. My 
intention was to notice this behavior and check if anyone else was seeing 
something similar.

I know personally a few of the people from Autonomica/Netnod and I'm sure they 
do the best (and even more than that) to accomplish an outstanding job.

> From Bert's traceroute, I would say that some sort of dport-specific

Today, we haven't seen the issue arise again.
The traces show us that we're not hitting the server in China. Maybe routes 
changed in the middle or the node is down.

Mauricio Vergara Ereche                 User #188365 counter.li.org
DNS Admin NIC Chile                             mave [@] nic [.] cl
Miraflores 222 piso 14, Santiago CHILE                +56 2 9407710
Codigo Postal: 832-0198                           http://www.nic.cl
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.dns-oarc.net/pipermail/dns-operations/attachments/20100325/debae7af/attachment.bin>

More information about the dns-operations mailing list