Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: International DNS compromise?
From: "Troy" <tjk () tksoft com>
Date: Fri, 6 Aug 2004 13:36:04 -0700 (PDT)

Caching DNS (i.e. doing transparent proxying for DNS) means 
that the ISP intercepts all DNS traffic. The caching you refer
to only applies when users are using the ISP's name servers.

I don't know of any ISP who would be intercepting DNS queries.

When you use nslookup and specify a server, the query is sent directly
to the server you specify, not the name server of your ISP.

Cheers,


Troy



On Thu, 5 Aug 2004 10:49:39 -0700 (PDT), Troy <tjk () tksoft com> wrote:
It's probably the ISP you are using.
They are intercepting DNS requests and returning their
own replies. It could be something malicious, but it could
just as well be the ISP saving bandwidth by caching DNS queries.

I have never heard of an ISP which does not cache (Bind does by
default) DNS queries. If they did not, their DNS servers would be
constantly hitting the root servers, which would be horribly
inconsiderate.

If they cache DNS queries they probably cache www queries as
well. 

See my last comment.

...D



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]