(please redirect my question to relevant stack site, if I am in wrong place, however here I feel guaranteed to get help)
When playing with traceroute command I want to be sure I am not connecting to virtual host that may be dynamically mapped to a number of geographically dispersed servers(since it does not make much sense to track packets jumping from continents).
So more precisely with concrete example: how to prove with help of nslookup -querytype=NS google.com that google may redirect me to different servers across the world. I tried IPconfig locator for all values returned by nslookup, it always returns same location: California Mountain View.
It seems I don't understand something really important in here. Thanks.
update: tried nslook up from australian server, all the ip adresses still point to same location..
You cannot prove the location of any host. At the very best you can make an educated guess.
Geolocation databases are a big list of IP addresses and where the machines hosting those addresses are believed to be located. But they are just a guess and even the best of them are only 90% accurate to the state/regional level, meaning 10% of the addresses are someplace completely different. I use MaxMind because they have a fairly accurate free version and their commercial versions are not too expensive. They also have a free web-form where you can do 25 lookups per day.
You can use tools like traceroute to see some of the machines between you and your destination. Sometimes they have geographic locations in their DNS names. Sometimes their IP addresses will be listed in Geolocation databases. However, not all routers respond, many segments are virtualized and so their hops/routers are invisible, and firewalls may block the trace before it completes.
DNS databases list the address of the organization who owns an address or domain. DNS names themselves can be anything anyone wants, so even they contain geolocation information, there is no reason to believe it is true. In particular, a router might have a DNS name indicating the destination its connecting to, or even the administrative office responsible for it, and not the physical location of the device itself.
The IP address you are talking to can forward anything it wants to anywhere else it wants and there's absolutely no way you can detect that. So you can only follow the trail up to a point.
To make a good guess for the location of a host, look-up its IP address in a geolocation database, then run a traceroute and look-up the IP address of the last router before the destination. That will get you as close as you can.
Related
A bit of a weird situation that I haven't come across. Note: it's not really a problem and I'm just really asking this out of interest.
My friend switched to a new ISP (same ISP as me, he lives one city over) and they just installed the new router today. He asked for my IP to join my teamspeak server which is temporarily being hosted on my local machine. He's joined it before many times without issue. He said it's not working today.
I told him to ping me, no response. I pinged him, also no response. At this point I was confused since I had never come across this situation before (maybe it's common, I'm no networking expert though). I ran a tracert and told him to do the same, mine reached a domain which was prefixed with his city name and his reached a domain prefixed with my city name, both timed out before actually reaching the destination IP.
At this point we decided to just use Discord instead and assumed this problem would resolve itself, I tried one last thing. I ssh'd into my work development server located in London and did a trace to both IPs. My IP traced fine and his IP timed out.
All I can think of is that routing tables for his new router aren't properly set up yet, my knowledge on networking doesn't really extend beyond this! I'm really just interested in what's going on here and would love an answer from a networking expert!
ICMP protocol might be disabled or blocked at any hop along the way, which would disrupt tracert.
Given that you tried pinging from two different endpoints to his PC could indicate that the ICMP blocking is happening somewhere closer to his endpoint.
With regards to the teamspeak connection, his new router might not be configured to allow the appropriate ports through. All home routers have different ways of configuring port-forwarding, but I'd check documentation there.
Is it possible for someone to track a dynamic IP address, if so what would it take and how would it manifest?
Would the person doing so be able to log every change in your ip range and eventually end up with the whole set of ip's you are able to have?
Is it possible to make my dynamic ip change in a different pattern, say in a more extreme way, making it harder for someone to trace it as described above? Is it possible to encrypt it somehow, and also all other information such as hardware MAC's / Inet MAC etc. everything.
The answer is yes and no.
In most cases only your service provider (and law enforcement) will have a log of all IPs you had and start/end times of each lease. You basically can't do anything to prevent this because they need to be able to identify you as their customer with a valid contract. This is usually done via MAC address of CPE equipment you get from service provider or by some login credentials (for PPPoE for example). There is no such thing as encrypting the IP and changing your MAC address would not prevent service provider from identifying you. For someone else there is no reliable way to track you. The closest thing they can find is the scope (or scopes) from which dynamic IP addresses are issued.
At the other hand, when you mix the technology and psychology, every one of us leaves the unique fingerprint when browsing the web. If you examine the combination of software someone uses, their traffic patterns (amount of traffic, sites they visit, activity during the day), their behavior and style of writing, etc, you can not just link them to some IP address but make a distinction between different users behind the same IP address. Anyway collecting this data is really hard which makes it improbable, especially if we are talking about ordinary internet users.
Assuming that the IP address that the domain is mapped to is known, are there any advantages to using this known IP address rather than using the domain? What makes the trace routing decision? Because DNS servers translate the domain names to IP addresses I am compelled to say that using an IP address is quicker, albeit unnoticeable. However, because DNS servers process these requests at a high volume and presumably cache the most popular sites I am also compelled to say that a DNS server might know the fastest route to the server which would result in the domain being slightly quicker. I understand that when I am asking which may be faster this quantification may be at the nanosecond or microsecond scale.
Technically, yes. At least the first time. The first time your computer asks the internet "Where is this domain name located?" and some machine out there responds with its IP address.
However, when it gets this response back it keeps a copy (called caching) so it doesn't have to ask again for a while (these things CAN change, but rarely do)
So, if your computer currently has the IP cached, then they are equal. If you don't currently have it IP is faster, but only for the first time in a few days and only a few seconds
As for the question of how the fastest route is picked. There are several routing protocols, most of which take into account several different factors including load on a connection, bandwidth, latency, jitter, and distance. Several others are also possible. Long story short is that the routers of the internet are constantly telling each other that such and such link is down or I just got a new address connected and they have algorithms that the routers run to figure out which way is best.
N.B. A side note is that IP wont always give you access to a certain website: take for instance a site hosted on a hosting service. They rarely have their own specific IP address, but instead requests for lots of different sites could come into one IP. In this case the domain name being requested is used to determine which site to return to the requester
Both of the examples that you gave are correct. Inputting an IP address directly will bypass the need for a DNS lookup, but the advantage you gain by doing this could be pointless if you use an IP address to a popular website which brings you halfway around the world instead of to a server nearby. Ultimately, you wouldn't benefit enough to make it worth your while, especially since your computer will cache the response you receive from the DNS lookup, making the difference 0.
This question was answered pretty well by #PsychoData but I think there's a few things worth noting and restating here:
When using IP, you bypass DNS which will save you the DNS resolution time on the first call until the TTL (Time To Live) expires. TTL is usually 1 hour. The difference is usually not worth noticing in most applications. If you're only making one call, you won't notice the milliseconds delay. If you make multiple calls, all calls after the first won't have the delay.
When entering a name vs IP you can be calling several different Networking daemons including NetBIOS (\ServerX), DNS FQDN (\ServerX.domain.com), DNS Shortname (\ServerX which MAY get automatically lengthened or guessed to the FQDN \ServerX.domain.com by your OS or DNS server)
Microsoft has two primary Authentication Mechanisms in play with SMB shares: NTLMv2 (NTLMv1 and CHAP are insecure) and Kerberos. Depending on lots of configurations on your client, the server, and the authentication server (Active Directory if in play) and the way you called the name, you may get one or the other. Kerberos is generally faster than NTLMv2, at least for repeated calls, as it gets and keeps an authentication token and doesn't need to reauthenticate via password hash each time.
NetBIOS uses different ports than DNS which can play into network latency due to ACLs/routers/Firewalls.
NetBIOS can actually give you a different answer than DNS because it's a different resolution system. Generally the first PC to boot on a subnet will act as the NetBIOS server and a new server can randomly declare itself to the network as the new NetBIOS master. Also \FileShareServer.domain.com wouldn't come back in a NetBIOS lookup as it's not the machine name (ServerX) but a DNS alias.
There's probably even more that I'm missing here but I think you get the idea that a lot of factors can be in play here.
Here is my situation. I am part of a project creating a P2P charity website, where users connect and can give money to one another. Because of the nature of the site, we know scammers are going to be rampant. We have several preventative measure ideas, and one idea that came up was tying an IP address to the user's account. The reason for this would be to be able to detect when someone from the same IP address creates several accounts.
Would this be reliable? Why, or why not? I have been googling and found many conflicting ideas on the subject. Thanks for any help you can give.
No, it is not reliable. Because:
Residential customers who aren't specifically paying for a static IP address will often see their addresses change frequently. I'm on AT&T DSL and I see my IP address change roughly twice per month on average
People legitimately sharing an internet connection, whether they're using different workstations in the same office with a T1 line, or they're all connected to the same Wi-fi hotspot at Starbucks, will all have the same IP address.
Related to the above, people who are mobile, such as people who use laptops to connect to Wi-fi at coffee shops, airports, hotels, etc, will have a different IP address for each location they visit.
Even people who stay in one place with a static IP address can spoof your system by using a proxy server or a proxy tool like Tor. This makes IP restrictions trivial to bypass.
No.
Many connections are behind NAT (One public gateway IP address for many people), or use DHCP (frequently changed IP addresses).
An IP address is one of the worst ways of identifying a user.
There is a dicussion board I am part of that bans sock puppets ( that is, multiple accounts by the same user ). They have no means of automatically detecting them, becasue there is no means of definitively identifying them. IP addresses are captured, because they can be used to help identify sock puppets, but I know that the process of identifying these is laborious, manual, and error-prone.
This is only undertaken when there is suspicion that someone is using sock puppets for malicious or disruptive purposes. In your case, there is no real answer other than careful and manual monitoring of usage habits, using the information that you gather about users to attempt to identify suspicious habits. But you also have to accept that 80% of sock puppets will go undetected, and do what you can to warn other users of the possibility.
Your bigger issue, incidentally, may be Munchausen by Internet which we were also caught by.
No, not least because:
IP Addresses can change over time, thanks to DHCP leases expiring.
People access websites from many different locations including home, work, coffee shops, etc.
When behind a NAT firewall or a proxy server, many people can share the same IP address.
Will you have many people registering who are entitled to receive money? I'd suggest a manual verification process using real people if at all possible. If nothing else, you can claim to be exercising due diligence if there's a human involved.
No: for example, any company proxy will only have one external IP address, so everyone registering from within the network will appear to have the same IP address.
Recent legal case perhaps worth reading up on : http://yro.slashdot.org/story/11/05/03/2020205/An-IP-Address-Does-Not-Point-To-a-Person-Judge-Rules
Totally unreliable...
Somebody on dial-up will have a different IP address every time they "dial-up".
DSL users will have a different IP address every time they reset or reconnect their account unless they pay for a static IP.
Many users on a particular LAN will be sharing one public IP address.
A particular user can login from home, work, public hotspot and have a different IP from each location.
I do development for an ASP service, and we have recently went through a required 3rd party security audit to obtain status allowing us to host data for a certain government agency. So if I may share some of the information I gleaned turning the trainings, perhaps it would help.
First, IP addresses can be used to assist in what you are trying to accomplish, but they are definately not good by themselves. An example would be the wireless at McDonalds. Everyone at McDonalds is connected to the same wireless and are using the same public IP address through a NAT, which translates from a local address (i.e. 192.168.0.xxx) to a public address for all computers located behind it. The NAT keeps entries so it knows what traffic is allowed to come back into the network, and which computer it is going to.
We found that a good security measure is to use an encrypted session key that is included with all GET/POST submits. That session key contains a GUID which is a lookup to the current session. So even if someone breaks your session encryption, they still need to guess at a GUID in order to find a valid session. On top of that, by tracking IP addresses, if it changes suddenly, we can immediately invalidate the session (we also have whitelisting in case someone is load balancing multiple internet lines, which can cause the IP to change frequently). A cookie can also be used in place of the IP address tracking, as two people behind the same NAT can potentially hijack each other if they can find a way to steal the other person's session key.
Encrypted cookies are also a good way to enforce security. But make sure you are using a framework that is tried and tested, as they have already closed the known vulnerabilities for you. Believe it or not, our security company told us that .NET has emerged as one of the top secure frameworks that they know of. I almost fell out of my chair when I heard that.
Personally I don't think it'll be reliable.
The main reason will be for those using a shared IP. That includes most users connecting from inside a business and home users connecting through the same WIFI hub.
It's more than likely for multiple users to be coming to your site with the same IP address.
Adding to that the fact that IP addresses change over time and you're already losing track of your users.
It's also worth remembering that oftentimes multiple users will be using the same physical computer. Are you wanting to have only one member of a household able to signup etc?
It could be somewhat useful as part of a defense-in-depth approach, but I wouldn't call it "reliable".
If you want to identify users, you can use a cookie. One solution uses a combination of cookies, local storage, flash, and other state information that can be stored in a browser: http://samy.pl/evercookie/
Nothing is 100% reliable. These cookies can be erased by a determined user, or in some browsers with one click. Ultimately, in many countries outside of the USA, a user has the right not to be tracked.
As an alternative for the future: New Intel® Business Processors Deliver Leading Security, Manageability and Performance
As long as the connection between the browser and the CPU isn't interviened which I believe there is more risk of with a browser than a desktop application.
I am interested to know how the DNS requests to political sites differ in different countries.
I need to know how I can send a DNS query to a remote computer, let say, in China. Then, I want to compare the results to US. The goal of the experiment is to get a hand-on experience on the concept about DNS poison. I feel my lectures so theoretical.
How can you compare DNS requests between China and US, such that I can investigate DNS poisoning?
This depends a bit on how the queries are being altered. If the server is giving different results based on your locality, then asking it directly will not be of any use. If you're queries are being poisoned by a caching server in between, these methods might help.
If you have shell accounts in different parts of the world you can perform a simple test.
I'm using 'dig', which is available on most *nix systems. If you're running Windows you might want to search for an alternative in this list of DNS tools
To find the responsible DNS servers
dig ns domain-in-question.com #the.dns.server.you.want.to.use
To get the IP addres for the hostname
dig a host.domain-in-question.com #the.dns.server.you.want.to.use
(You can skip the #.. part to run with your current server)
I recommend trying both of these from different parts of the world to see if the server itself is giving different results or if the caching servers on the way there are being poisoned.
Also, searching for 'how to poison dns' gave me a number of practical results.
You can just use nslookup (the server command lets you specify the DNS server to ask)
Try this web tool:
http://www.kloth.net/services/dig.php
As for learning about DNS poisoning, every computer has settings for which DNS server to trust, and so on. If one of them in a chain is compromised, every computer downstream will receive bad information.
If the remote servers are correctly configured, they won't let you interrogate them.
Any recursive resolver should be configured to only provide answers to the clients its intended to serve.