[dns-operations] Odd behaviour of DNS queries in PRC (facebook, youtube & twitter)

[Mauricio Vergara Ereche]

On Thursday 25 March 2010 10:28:16 Stephane Bortzmeyer wrote:
> On Thu, Mar 25, 2010 at 09:38:49AM +0800,
>  Xiaodong Lee <lee at cnnic.cn> wrote
> 
>  a message of 19 lines which said:
> > As the local host of the mirror site of I root server which was
> > agreed by I root server administrator, and also as the ".CN"
> > registry which is one of the members of DNS community, we wanna
> > clarify that CNNIC never did any interceptions
> 
> Nobody said it was you. It could be the ISP's IGP which was hacked to
> direct queries to a rogue and unofficial copy of I-root.
> 

<hat "personal">
I second Stephane and previous Bert's opinion.

With my first post I was never implying that I-root managers or the co-
operator from that node was doing anything wrong or suspicious about it. My 
intention was to notice this behavior and check if anyone else was seeing 
something similar.

I know personally a few of the people from Autonomica/Netnod and I'm sure they 
do the best (and even more than that) to accomplish an outstanding job.
</hat>

> From Bert's traceroute, I would say that some sort of dport-specific
> 

Today, we haven't seen the issue arise again.
The traces show us that we're not hitting the server in China. Maybe routes 
changed in the middle or the node is down.

-- 
Mauricio Vergara Ereche                 User #188365 counter.li.org
DNS Admin NIC Chile                             mave [@] nic [.] cl
Miraflores 222 piso 14, Santiago CHILE                +56 2 9407710
Codigo Postal: 832-0198                           http://www.nic.cl
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20100325/debae7af/attachment.sig>