News for hackers. Stuff that matters.

A comment on DNS servers that offer privacy and filtering.

Re:DNS servers that offer privacy and filtering by palijer on Wednesday February 06, 2019 @07:29AM (#19094574)
DNS servers should not be used as "internet connectivity tests" by pinging them. They are not maintained as ICMP test servers, and that is not their purpose. While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests.

Pinging DNS servers is a shitty inconclusive test for internet connectivity, or SLA measurements etc etc.

[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by prepend on Wednesday February 06, 2019 @07:49AM (#19094674)
But a great test for “am I getting out to the net” that’s ok to have a low specificity.

So it is not smart to make a lot of decisions based on “ping 1.1” timing out, it is so quick it’s a good first step in trying to debug a network issue.

[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by emilfihlman on Wednesday February 06, 2019 @04:52PM (#19100432)
>DNS servers should not be used as "internet connectivity tests" by pinging them.

Not true.

>They are not maintained as ICMP test servers, and that is not their purpose.

Irrelevant.

>While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests.

8.8.8.8 and 1.1.1.1 and all the major ones don't care.

Pinging DNS servers is highly productive and easy. There is nothing bad with using them as internet connectivity tests or SLA measurements.

[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by johnchristopher on Wednesday February 06, 2019 @07:32AM (#19094585)
So, what should we ping for testing Internet connectivity ?
[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by teddyh on Wednesday February 06, 2019 @07:38AM (#19094614)
There’s ping.sunet.se as maintained by the Swedish University Network (i.e. the network connecting Swedish Universities; there is no single “Swedish University”).
[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by snazz on Wednesday February 06, 2019 @07:44AM (#19094652)
The advantage of pinging IPs is that you don’t have to have a working DNS setup to test your connection. If DNS does work, then your connection probably works, too.
[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by 1_player on Wednesday February 06, 2019 @08:27AM (#19094869)
In this case one should run "ping -n", otherwise ping will hang trying to resolve the IP into an hostname, if the DNS is misbehaving or not responding.
[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by sathackr on Wednesday February 06, 2019 @11:05AM (#19096237)
what default(included in OS) ping utility tries to reverse-lookup an address before pinging, and hangs if it can't.

I've never observed this in any version of Windows nor Linux.

[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by tinus_hn on Wednesday February 06, 2019 @07:51AM (#19094693)
You are better off using traceroute to one of these addresses, you should at least get some route outside of your own network.
[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by bluejekyll on Wednesday February 06, 2019 @08:09AM (#19094781)
Traceroute uses ICMP as well, and may send more packets then ping. It works by setting the TTL on the ICMP packet, which is the number of route hops to traverse before the packet is dropped. Routers are supposed to ( this can be disabled, and is why you get * * * sometimes) respond with a TTL expired. So it starts with a TTL of 1, and then increments by 1 after each hop is discovered (or no response in some timeout).
[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by detaro on Wednesday February 06, 2019 @09:00AM (#19095072)
On unixes, traceroute typically uses UDP by default (nowadays, ICMP is often an option, as are TCP SYN packets). Windows' tracert uses ICMP.

I believe this is because you need root privileges/special capabilities to send ICMP packets.

[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by bluejekyll on Wednesday February 06, 2019 @09:32AM (#19095296)
Yes. I wasn’t perfectly clear there. You’re correct for the initial src packet, the TTL exceeded response is ICMP, I think always.
[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by tinus_hn on Wednesday February 06, 2019 @01:29PM (#19098080)
The important difference is that you can trust no host on the internet to actually respond to pings, especially not machines prone to receive DOS attacks, like public DNS resolvers. Traceroute is for testing connectivity, ping is an archaic test to see if a machine is running.
[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by res0nat0r on Wednesday February 06, 2019 @11:12AM (#19096330)
I just ping google.com when I need a quick sanity check.
[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by FreeFull on Wednesday February 06, 2019 @11:38AM (#19096634)
Which doesn't help if your DNS isn't working
[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by blakesterz on Wednesday February 06, 2019 @07:33AM (#19094587)
I've used the thing [0] from grc.com, is there other ways that are reliable as well?

https://www.grc.com/dns/benchmark.htm

[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by YouKnowBetter on Thursday February 07, 2019 @10:51AM (#19105918)
I'm more often in need of CLI that does that for me and have grown used to:

https://github.com/cleanbrowsing/dnsperftest

[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by ickwabe on Wednesday February 06, 2019 @10:05AM (#19095585)
I use this as well. Found it very helpful.
[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by wahern on Wednesday February 06, 2019 @01:00PM (#19097723)
Please, for the love of all that is holy, stop blocking ICMP! It's needed for things like Path MTU Discovery. With the increasing use of VPNs and tunnels (IPSec, Wireguard, GRE, etc) PMTUD is more important than ever.

At a minimum, any node on the internet routing or serving traffic needs to keep ICMP open. If you're running a DNS server, ICMP should be working.

[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by bluedino on Wednesday February 06, 2019 @08:53AM (#19095030)
https://groups.google.com/d/msg/public-dns-discuss/p1o62SJEl...

TL;DR: At the risk of repeating myself: Google Public DNS is a Domain Name System service, not an ICMP network testing service.

[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by Pheide1j on Wednesday February 06, 2019 @01:22PM (#19097988)
you can just set a lower TTL and get a response from a hop somewhere in your ISP's net.
[ Parent | on HN ]
Re:DNS servers that offer privacy and filtering by agumonkey on Wednesday February 06, 2019 @01:17PM (#19097922)
are there known ICMP test servers ?
[ Parent | on HN ]