<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Apr 29, 2014 at 1:52 PM, Warren Kumari <span dir="ltr"><<a href="mailto:warren@kumari.net" target="_blank">warren@kumari.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="">On Tue, Apr 29, 2014 at 4:45 PM, Xun Fan <<a href="mailto:xunfan@isi.edu">xunfan@isi.edu</a>> wrote:<br>
> China has it's own root nodes is confirmed long ago, we published that in<br>
> our paper <a href="https://ant.isi.edu/blog/?p=362" target="_blank">https://ant.isi.edu/blog/?p=362</a><br>
<br>
</div>Yup, believe me, I'm fully aware of that (and have read this, and many<br>
other papers, have done some of my own testing on a number of trips to<br>
Beijing, etc) -- unfortunately while I was there I didn't think to<br>
test NSID / hostname.bind / <a href="http://IDENTITY.L.ROOT-SERVERS.ORG" target="_blank">IDENTITY.L.ROOT-SERVERS.ORG</a>, etc<br>
responses to see how convincing a lie^w optimization the servers<br>
provide.<br></blockquote><div> </div><div>Oh, sure, I totally agree NSID/hostname.bind etc. will be very helpful.</div><div> </div><div>My experience is that if these query hit a masquerading root node, you</div><div>mostly won't get an answer, by either no ANSWER section or empty string </div>
<div>in ANSWER section.</div><div><br></div><div>And another thing is the masquerading node is not always there. Sometimes</div><div>our query hit the real root node and everything is correct (NSID, hostname.bind, etc.).</div>
<div>But we didn't collect data continuously, so we don't know the exact pattern.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class=""><br>
><br>
> Just pinged H-root from CERNET of China:<br>
> $ ping <a href="http://h.root-servers.net" target="_blank">h.root-servers.net</a><br>
> PING <a href="http://h.root-servers.net" target="_blank">h.root-servers.net</a> (128.63.2.53) 56(84) bytes of data.<br>
> 64 bytes from <a href="http://128.63.2.53" target="_blank">128.63.2.53</a>: icmp_seq=1 ttl=55 time=9.63 ms<br>
> 64 bytes from <a href="http://128.63.2.53" target="_blank">128.63.2.53</a>: icmp_seq=2 ttl=55 time=9.56 ms<br>
><br>
> 9ms is faster than the speed of light, given the two H-root sites are both<br>
> in US and the ping source is in Shanghai.<br>
><br>
> For the failure in China telecom, one possible explanation is that somehow<br>
> the route to the "Chinese H-root" doesn't propagate to some server in China<br>
> telecom, while the GFW has already started to drop packets from real H-root.<br>
<br>
<br>
</div>Yup.<br>
<div class=""><div class="h5">W<br>
<br>
><br>
><br>
> On Tue, Apr 29, 2014 at 12:15 PM, Warren Kumari <<a href="mailto:warren@kumari.net">warren@kumari.net</a>> wrote:<br>
>><br>
>> On Tue, Apr 29, 2014 at 2:18 PM, bert hubert <<a href="mailto:bert.hubert@netherlabs.nl">bert.hubert@netherlabs.nl</a>><br>
>> wrote:<br>
>> ><br>
>> > On 29 Apr 2014, at 20:55, Emmanuel Thierry <<a href="mailto:ml@sekil.fr">ml@sekil.fr</a>> wrote:<br>
>> ><br>
>> >><br>
>> >> What we may observe from tests is that some dns servers failed without<br>
>> >> an obvious connectivity problem (ping is OK). As a consequence, i think it<br>
>> >> would be really interesting to test for instance with an arbitrary dns<br>
>> >> server and see whether it fails or not.<br>
>> >><br>
>> ><br>
>> > Even root-servers that are down have been known to respond as observed<br>
>> > from China. Sometimes within less milliseconds than it takes to reach the<br>
>> > border.<br>
>> ><br>
>> > It is not internet as ‘we’ know it there.<br>
>><br>
>> What would be interesting to see would be nsid, hostname.bind, etc<br>
>> from the NS to *do* resolve.<br>
>> E.g:<br>
>><br>
>> dig -4 @<a href="http://l.root-servers.net" target="_blank">l.root-servers.net</a> hostname.bind CH TXT<br>
>> dig -4 @<a href="http://l.root-servers.net" target="_blank">l.root-servers.net</a> . SOA +nsid<br>
>><br>
>> W<br>
>><br>
>><br>
>> ><br>
>> > Bert<br>
>> ><br>
>> > _______________________________________________<br>
>> > dns-operations mailing list<br>
>> > <a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>
>> > <a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
>> > dns-jobs mailing list<br>
>> > <a href="https://lists.dns-oarc.net/mailman/listinfo/dns-jobs" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</a><br>
>> _______________________________________________<br>
>> dns-operations mailing list<br>
>> <a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>
>> <a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
>> dns-jobs mailing list<br>
>> <a href="https://lists.dns-oarc.net/mailman/listinfo/dns-jobs" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</a><br>
><br>
><br>
</div></div></blockquote></div><br></div></div>