Get used upsream DNS server - Page 1
Forum section: electronics / projects

author: hamdi.tn
author_rank: Frequent Contributor
timestamp: October 14, 2017, 10:03:40 am
content: Hi everyone,i had a strange question from a customer designing some IOT stuff, where he need to get the used DNS in the router, so the one assigned by the ISP. Am not a network specialist but as far as i know, units connected in local network with the DHCP server of the router will never know about this DNS, they don't care about it anyway, for that most of the time DNS address is the same as Gateway address.However when using an access point , so no DHCP server in it , local machine will actually get a DNS server affected by WAN, so no problem there.He's using a Ti wifi module now and he's 100% sure he has this capability, using simple commercially available normal router.How crazy this sound.

author: jaycee
author_rank: Regular Contributor
timestamp: October 14, 2017, 10:20:08 am
content: Unless the user has manually specified DNS server addresses, it comes from the DHCP server. When the client initially connects and does not have an IP address yet, it sends out a broadcast message. A DHCP server on the network segment hears this and replies, offering an IP address and other connection settings, including DNS servers.https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#DHCP_discovery

author: madires
author_rank: Super Contributor
timestamp: October 14, 2017, 12:04:52 pm
content: Usually the router runs a DNS resolver and forwards all DNS requests to the ISP's resolvers provided via PPP, DHCPv6 or local configuration. And the router's DHCP server advertises its local LAN address as nameserver. In most cases you can also configure specific nameservers in case you run dedicated local nameservers or prefer some other resolvers. Then the DHCP server would advertise those. For IPv6 there are also router advertisements which can include nameservers. Maybe there's some obscure router which doesn't run a local resolver and simply advertises the ISP's resolvers via DHCP, but that's very uncommon.

author: jaycee
author_rank: Regular Contributor
timestamp: October 14, 2017, 02:57:55 pm
content: This is true, most routers are effectively a DNS proxy server. I don't think there's any good way to discover whats actually answering the DNS requests.

author: rbm
author_rank: Regular Contributor
timestamp: October 14, 2017, 05:00:58 pm
content: Just program the IoT device with the IP for one of the free DNS servers on the net. It then becomes independent of the particular configuration of the DHCP server answering the request, but only dependant upon the availability and reliability of the chosen DNS server.

author: madires
author_rank: Super Contributor
timestamp: October 14, 2017, 06:25:18 pm
content: The SOHO router runs acachingresolver for a reason. Using a public resolver as default is a very poor design.

author: xani
author_rank: Frequent Contributor
timestamp: October 14, 2017, 06:43:36 pm
content: Quote from: madires on October 14, 2017, 06:25:18 pmThe "reason" is not the caching. Some even do not do caching (like if router is cheap and they can't spare its tiny RAM for caching), that's just secondary benefitThe "reason" is that this way you can have local host names that are resolvable from your own LAN network without having to own any domain

author: madires
author_rank: Super Contributor
timestamp: October 14, 2017, 06:53:50 pm
content: When you start running resolvers for large networks you'll understand. BTW, even cheap SOHO routers still got enough RAM left for bufferbloat

author: ejeffrey
author_rank: Super Contributor
timestamp: October 14, 2017, 07:08:51 pm
content: Local caching nameservers are completely unimportant for SOHO networks. The ISP DNS is pretty close, the clients already do at least an OK job of caching, and there aren't enough devices where it really matters to share cache between them. Its not like you have a large corporate office or university with 10k+ nodes trying to share a small upstream link. Its totally fine to have every device on a SOHO network use the upstream ISP DNS or even one of the public DNS servers (if you want to bypass your ISPs DNS hijacking).The primary reason that SOHO routers have local DNS servers is exactly what xani said: to allow local name resolution.There is no general way to "discover" the upstream DNS server if the local router is running a DNS proxy. There is also no need. If you don't need to support local name resolution provided by the SOHO routers DNS proxy just use one of the public DNS servers. An IoT device should have a negligible DNS load anyway.

author: hamdi.tn
author_rank: Frequent Contributor
timestamp: October 14, 2017, 07:32:15 pm
content: Thank you all for your answers, and for confirming that their is no need and no way to determine ISP DNS through a router.

author: PA0PBZ
author_rank: Super Contributor
timestamp: October 14, 2017, 07:41:46 pm
content: Quote from: hamdi.tn on October 14, 2017, 07:32:15 pmBasically, yes that is the correct conclusion. However, I'm still wondering what 'problem' your customer is trying to solve?

author: madires
author_rank: Super Contributor
timestamp: October 14, 2017, 08:17:59 pm
content: Quote from: ejeffrey on October 14, 2017, 07:08:51 pmOk, let's try another idea. Imagine you're the ISP and each of your customers has about 5 to 10 devices in need for DNS. What is the impact on your caching resolvers when the CPEs don't run a local caching resolver?

author: PA0PBZ
author_rank: Super Contributor
timestamp: October 14, 2017, 08:22:04 pm
content: Quote from: madires on October 14, 2017, 08:17:59 pmSince most devices already locally cache dns lookups what is the chance that another local device is going to do a dns lookup for the same url? Or to answer your question: very little impact.

author: madires
author_rank: Super Contributor
timestamp: October 14, 2017, 08:37:26 pm
content: For example, have you checked how many DNS requests are generated by your web browser for an average news webpage? There are tons of third party URLs for ads, tracking and analytics. Or take the ubiquitouswww.google.com. The impact on the ISP's caching resolvers is much larger than you might think.

author: PA0PBZ
author_rank: Super Contributor
timestamp: October 14, 2017, 09:19:08 pm
content: Quote from: madires on October 14, 2017, 08:37:26 pmSince you are talking about a web browser let's forget iot for a moment and assume windows. Just open a cmd prompt and type ipconfig /displaydns and look at all the locally cached url's. I agree that there's a lot of requests but they all get cached locally as you can see so caching them at the router will not have a big advantage.

author: rstofer
author_rank: Super Contributor
timestamp: October 14, 2017, 09:30:30 pm
content: You can get your IPV4 and/or IPV6 IP address by googling for 'whats my ip address'. This will only return your external IP address because the Internet can't get to your non-routable internal address.ORhttp://test-ipv6.com/Since my router does the NAT thing, every machine seems to have the same IPV4 address. However, the IPV6 address is different between the two machines I just tested. I wasn't expecting that...

author: xani
author_rank: Frequent Contributor
timestamp: October 15, 2017, 12:49:58 am
content: Quote from: madires on October 14, 2017, 06:53:50 pmIt so happens that I DO which is why I called you on your ignorance. And we're talking about home network, with MAYBE 5-10 devices (my home network is at barely 50% hitrate).Caching benefits are almost negligible in such small network. Why ? because most devices will request different addresses and browsers do caching on their own anyway. It might benefit shitty iot devices a bit but then you shave off maybe 100ms for something that's not time criticalQuoteWell my cheap SOHO router doesn't cache. My previous cheap SOHO router also did not cache. Did you actually checkedany?

author: Marco
author_rank: Super Contributor
timestamp: October 15, 2017, 01:52:53 am
content: To go back to the original question, read the DNS query RFCs. Dig and dnstracer utilities can get the entire chain of DNS servers, so obviously the protocol allows for it. Get the chain, the first server not on an internal IP range is the ISP one.It's crazy to think any IoT device does this, but it's certainly possible.

author: Old Don
author_rank: Regular Contributor
timestamp: October 15, 2017, 03:38:36 am
content: He could download and runDNS Benchmarksoftware to see if there's better DNS servers vs. his ISP's.

author: cdev
author_rank: Super Contributor
timestamp: October 15, 2017, 04:57:25 am
content: Quote from: rstofer on October 14, 2017, 09:30:30 pmThats what ipv6 does...

author: xani
author_rank: Frequent Contributor
timestamp: October 15, 2017, 11:17:51 am
content: And there are ways to leak IPv4 one. For examplehttps://www.perfect-privacy.com/webrtc-leaktest/

author: madires
author_rank: Super Contributor
timestamp: October 15, 2017, 11:21:08 am
content: Quote from: PA0PBZ on October 14, 2017, 09:19:08 pmAnd now please check several web pages and compare the third party URLs. A lot of them belong to the same companies/services. So each PC/laptop/tablet/smartphone in your home network has to deal with those while browsing the internet. Each client has to resolve that common set of domains. That way multiple DNS requests for the same domains are created.

author: madires
author_rank: Super Contributor
timestamp: October 15, 2017, 12:05:39 pm
content: Quote from: xani on October 15, 2017, 12:49:58 amPlease see my response to PA0PBZ. There's more overlapping than you might think. I fully agree that from a SOHO point of view those few DNS requests don't matter much and most users won't care about a few ms delay when using the ISP's resolver. But it matters for the ISP, because he has to deploy and operate more resolvers. If you got bad luck your ISP doesn't care much about that and has very poorly performing resolvers. So it's your problem again.Quote from: xani on October 15, 2017, 12:49:58 amMy cheap router at home allows me to disable or enable caching and also to set the cache size.

author: xani
author_rank: Frequent Contributor
timestamp: October 15, 2017, 01:23:07 pm
content: I tend to avoid ISP servers in general. For comparison, my ISP does around 20ms faster on cache hit and ~70-100ms slower on cache miss compared to google, and there are of course those ISPs that do scummy things like DNS rewriting.For IoT I'd just do "use DHCP DNS server as primary, 8.8.8.8 as fallback" if I'm contacting only external URLs.For internal URLs (say for example your device have a configurable logging destination, or just have option for local controller) it is a bit more complicated as you can't just use any external DNS because then no internal one will work. But then it's really the admin of device problem to provide stable DNS

author: cdev
author_rank: Super Contributor
timestamp: October 15, 2017, 01:51:08 pm
content: There are many problems with various actors hijacking DNS. It's a means of censorship.Also, TLS connections are being hijacked by man in the middle attacks enabled by a few large companies hardware.A takeover of operating system internals is occurring too. For example "s*****d"

author: cdev
author_rank: Super Contributor
timestamp: October 15, 2017, 01:53:36 pm
content: 8.8.8.8 is Google. You trust Google more than you trust your ISP provided DNS?Quote from: xani on October 15, 2017, 01:23:07 pm

author: madires
author_rank: Super Contributor
timestamp: October 15, 2017, 02:15:45 pm
content: Quote from: xani on October 15, 2017, 01:23:07 pmThe lightweight dnsmasq, which is used by a lot of devices, supports request forwarding for specific domains

author: Monkeh
author_rank: Super Contributor
timestamp: October 15, 2017, 02:17:33 pm
content: Quote from: cdev on October 15, 2017, 01:53:36 pm... than the average consumer ISP? Fuck, yes.

author: madires
author_rank: Super Contributor
timestamp: October 15, 2017, 02:34:31 pm
content: If I would be a really bad ISP playing games with DNS I'd also forward all DNS traffic for 8.8.8.8 to my resolvers

author: cdev
author_rank: Super Contributor
timestamp: October 15, 2017, 04:06:52 pm
content: You can set up your own caching internal DNS server for your own machines that looks to the root DNS servers for all the top level domains, validating all the returned queries with DNSSEC."unbound" for example lets you do that.Quote from: madires on October 15, 2017, 02:34:31 pm

author: xani
author_rank: Frequent Contributor
timestamp: October 15, 2017, 04:55:12 pm
content: Well Google is probably using the data from 8.8.8.8 to do all sorts of interesting analysis but I doubt they will maliciously rewriting itQuote from: madires on October 15, 2017, 02:15:45 pmdnsmasq is really a great swiss-army-knife for home or small networks. Later versions even support TFTP serving so you can boot-from-network using only dnsmasq

author: DimitriP
author_rank: Super Contributor
timestamp: October 15, 2017, 08:09:20 pm
content: Quote from: Monkeh on October 15, 2017, 02:17:33 pmAnyone that tried to explain to their ISP that although the modem has an internet connection, can ping out using IP addresses but the ISP's DNS is not resolving names:A) UnderstandsB) No longer relies on the ISP's DNS

author: hamdi.tn
author_rank: Frequent Contributor
timestamp: October 15, 2017, 09:46:19 pm
content: Quote from: DimitriP on October 15, 2017, 08:09:20 pmI just checked my upstream DNS server at home and it's 8.8.8.8. So my ISP is giving this as a primary DNS server and the secondary is a local Tunisian server property of what called "Tunisian Internet Agency" i certainly trust google more than i trust this Agency.