Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

8
  • 11
    I don't think this is related to anycast but works even without out. ISP can re-route any traffic which passes through their network, no matter if anycast or not. And even DNS servers on normal unicast addresses can serve different replies based on the source IP address (and thus geolocation) of the client. Commented Aug 14, 2018 at 16:09
  • 14
    I'm not sure why you reply in what I consider a not really friendly and constructive way. Anyway, I only pointed out that anycast is not needed for intercepting DNS or giving different answers to different clients, simple unicast is sufficient both for re-routing and for giving client-specific replies. And that's why I think that focusing only on anycast like you do is wrong. Commented Aug 14, 2018 at 17:21
  • 4
    @JdeBP there are no attacks being made &no one is suggesting that you are in any way incorrect about the function of anycast. Your phrasing at the very start of your answer seems to indicate that you see this entirely as a Google/anycast issue. The only suggestion being made is that the effect that the OP is seeing does not have to be the result of anycast routing. The same thing could happen with unicast, too (see your link Aryan et al.). Yes, the effect the OP is seeing could be because of anycast and Google's bespoke DNS results. But not only that. Commented Aug 15, 2018 at 9:24
  • 3
    I think you can safely assume that your phrasing is not as clear as you wanted it to be. "in part" appears to be in reference to the OP's confusion, not that anycast is part of the issue. Secondly, the way you have set up your answer, the 3 scenarios appear to be coupled with anycast. You might need to take a second edit to the question to make sure that the ideas you wanted to be separate are more clearly so. I, as a completely 3rd party, and trying to find support in your answer for what you mean to say, had a lot of trouble. Commented Aug 15, 2018 at 11:44
  • 2
    I also think the text about Anycast is a distraction. A BGP hijack (if that's what this were, but it isn't) would work whether the destination server is unicast or anycast. It is far more likely that the ISP is directly intercepting all outbound DNS traffic to a server under their control. Commented Aug 15, 2018 at 13:18