Level 3 are now hijacking failed DNS requests for ad revenue on 4.2.2.x

Re:Level 3 are now hijacking failed DNS requests for ad reve... by skrause on Saturday January 25, 2014 @03:22AM (#7120263)

Can everyone else reproduce this problem? People from different locations and ISPs should try it.

I'm not a Level 3 customer in a any way and I'm on a German VDSL connection provided by Deutsche Telekom. And here the Level 3 resolvers still return normal NXDOMAIN answers:

  ; <<>> DiG 9.8.3-P1 <<>> thisprobablydoesntexist.com @4.2.2.2
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 44948
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

[ Parent | on HN ]

Re:Level 3 are now hijacking failed DNS requests for ad reve... by dsl on Saturday January 25, 2014 @07:54AM (#7120656)

Lots of well meaning kids go and setup Level 3 resolvers on grandma's home network, then the ISP has to deal with support calls when someone elses DNS servers go down.

As a result quite a number of networks "hijack" 4.2.2.0/24 and route it locally to their own resolvers.

[ Parent | on HN ]

Re:Level 3 are now hijacking failed DNS requests for ad reve... by pyre on Saturday January 25, 2014 @12:47PM (#7121502)

On the flipside, when the local ISP's DNS goes down, many a time will the support person have no knowledge of it, and run you thought the "do you own a computer? did you turn it off and on again?" spiel.

You act as if most ISP support actually admits to problems on their own network and/or that troubleshooters have access to this information.

[ Parent | on HN ]

Re:Level 3 are now hijacking failed DNS requests for ad reve... by ds9 on Saturday January 25, 2014 @11:38AM (#7121216)

How can one detect whether this is happening?

[ Parent | on HN ]

Re:Level 3 are now hijacking failed DNS requests for ad reve... by sexmonad on Saturday January 25, 2014 @12:51PM (#7121528)

I'm not sure if it's a certain way to tell, but try running a traceroute. If your traffic seems to go into Level3's network, that's a good sign that it's not getting rerouted.

Here's what I see from my DigitalOcean droplet.

root@derpy:~# traceroute -I 4.2.2.1 traceroute to 4.2.2.1 (4.2.2.1), 30 hops max, 60 byte packets 1 198.199.122.1 (198.199.122.1) 12.055 ms 12.123 ms 12.314 ms 2 xe-10-3-3-100.edge3.Newark1.Level3.net (4.28.6.69) 0.948 ms 0.959 ms 0.959 ms 3 ae-31-51.ebr1.Newark1.Level3.net (4.69.156.30) 1.396 ms 1.477 ms 1.478 ms 4 ae-10-10.ebr2.NewYork1.Level3.net (4.69.132.97) 1.530 ms 1.630 ms 1.659 ms 5 ae-62-62.csw1.NewYork1.Level3.net (4.69.148.34) 1.465 ms ae-82-82.csw3.NewYork1.Level3.net (4.69.148.42) 1.464 ms ae-62-62.csw1.NewYork1.Level3.net (4.69.148.34) 1.390 ms 6 ae-1-60.edge2.NewYork1.Level3.net (4.69.155.16) 1.363 ms 1.389 ms 1.395 ms 7 a.resolvers.level3.net (4.2.2.1) 1.456 ms 1.466 ms 1.421 ms

[ Parent | on HN ]

Re:Level 3 are now hijacking failed DNS requests for ad reve... by nwh on Saturday January 25, 2014 @04:44AM (#7120377)

I can not replicate from Australia.

    ; <<>> DiG 9.8.3-P1 <<>> nxdomain.horse @4.2.2.
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58067
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

[ Parent | on HN ]

Re:Level 3 are now hijacking failed DNS requests for ad reve... by bjackman on Saturday January 25, 2014 @06:51AM (#7120566)

Not sure if I'm misunderstanding this but my ISP (Virgin Media - not recommended, by the way) has always done this.. I assumed all ISPs did that?

[ Parent | on HN ]

Re:Level 3 are now hijacking failed DNS requests for ad reve... by Angostura on Saturday January 25, 2014 @03:10PM (#7122160)

If you're in the UK and using Virgin you can opt out. Link on the error page, ISTR

[ Parent | on HN ]