2

I understand how traceroute works, I give it a domain, it takes 3 packets, tries to go over intermediary servers to the end server. For instance -

[$] traceroute phoronix.com
    traceroute to phoronix.com (23.111.154.110), 30 hops max, 60 byte packets  

 1  gateway (192.168.1.1)  0.759 ms  1.181 ms  1.598 ms
 2  61.0.52.1 (61.0.52.1)  9.759 ms  15.932 ms  17.673 ms       
 3  218.248.164.106 (218.248.164.106)  20.431 ms  23.055 ms  25.810 ms
 4  218.248.235.161 (218.248.235.161)  56.832 ms  59.948 ms  62.170 ms
 5  218.248.235.162 (218.248.235.162)  64.490 ms *  70.113 ms
 6  * 218.248.178.42 (218.248.178.42)  74.185 ms *
 7  ix-pos-3-2.mcore3.LAA-Los-Angeles.as6453.net (216.6.84.153)  288.440 ms  338.163 ms ix-pos-3-0.mcore3.LAA-Los-Angeles.as6453.net (216.6.84.149)  247.309 ms
 8  if-xe-3-2-0-15.tcore2.LVW-Los-Angeles.as6453.net (64.86.252.85)  249.779 ms  253.608 ms  256.073 ms
 9  if-ae-6-20.tcore1.EQL-Los-Angeles.as6453.net (64.86.252.66)  264.612 ms  265.990 ms  269.466 ms
10  be3003.ccr41.lax05.atlas.cogentco.com (154.54.11.193)  271.767 ms  273.909 ms  277.114 ms
11  be3033.ccr22.lax01.atlas.cogentco.com (154.54.26.41)  279.672 ms be3032.ccr21.lax01.atlas.cogentco.com (154.54.31.53)  278.156 ms  281.060 ms
12  be2931.ccr21.phx02.atlas.cogentco.com (154.54.44.85)  295.825 ms be2932.ccr22.phx02.atlas.cogentco.com (154.54.45.161)  298.043 ms be2931.ccr21.phx02.atlas.cogentco.com (154.54.44.85)  300.382 ms
13  be2929.ccr21.elp01.atlas.cogentco.com (154.54.42.66)  246.302 ms  245.786 ms  252.709 ms
14  be2927.ccr41.iah01.atlas.cogentco.com (154.54.29.221)  264.252 ms  265.658 ms  268.376 ms
15  be2690.ccr42.atl01.atlas.cogentco.com (154.54.28.129)  293.106 ms be2687.ccr41.atl01.atlas.cogentco.com (154.54.28.69)  292.108 ms  294.465 ms
16  be2848.ccr41.atl04.atlas.cogentco.com (154.54.6.118)  293.523 ms be2847.ccr41.atl04.atlas.cogentco.com (154.54.6.102)  296.298 ms  298.876 ms
17  38.140.125.226 (38.140.125.226)  305.172 ms  309.067 ms  310.766 ms
18  10.254.0.90 (10.254.0.90)  317.569 ms  277.300 ms  277.377 ms
19  10.252.250.6 (10.252.250.6)  274.553 ms  275.082 ms  275.779 ms
20  10.252.250.66 (10.252.250.66)  274.110 ms  277.710 ms  279.409 ms
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *

Unfortunately though, the traceroute ends at a private IP block so we cannot get more details.

My understanding for traceroute is that it can be used by most people to figure out why they are not able to to a particular domain/IP . They are at least able to map some of the path that this instance took. Having a few runs not being able to get to a particular domain, you are in a better position to ask for help.

I do not understand what dnstraceroute brings to the table for a user. I tried to figure out the man-page as well as saw the official page .

I tried the following -

[$] sudo dnstraceroute --expert -C -e -t A -s 8.8.4.4 phoronix.com                                                                  
dnstraceroute DNS: 8.8.4.4:53, hostname: phoronix.com, rdatatype: A
1   gateway (192.168.1.1) 1 ms
2   61.0.52.1 (61.0.52.1) 11 ms
3   218.248.164.106 (218.248.164.106) 7 ms
4   218.248.235.161 (218.248.235.161) 43 ms
5   218.248.235.162 (218.248.235.162) 49 ms
6   72.14.205.109 (72.14.205.109) 41 ms
7   debian.org (149.20.4.15) 23 ms
8   debian.org (149.20.4.15) 19 ms
9   google-public-dns-b.google.com (8.8.4.4) 119 ms

=== Expert Hints ===
 [*] No expert hint available for this trace

Update - If I try -

[$] sudo dnstraceroute --expert -C -e -t A -s 23.111.154.110

dnstraceroute version 1.4

usage: dnstraceroute [-h] [-q] [-a] [-s server] [-p port] [-c count] [-t type] [-w wait] hostname
  -h  --help      Show this help
  -q  --quiet     Quiet
  -e  --expert    Print expert hints if available
  -a  --asn       Turn on AS# lookups for each hop encountered
  -s  --server    DNS server to use (default: first system resolver)
  -p  --port      DNS server port number (default: 53)
  -c  --count     Maximum number of hops (default: 30)
  -w  --wait      Maximum wait time for a reply (default: 5)
  -t  --type      DNS request record type (default: A)
  -C  --color     Print colorful output

The value/IP Address of phoronix was found using the usual culprit nslookup.

[$] nslookup phoronix.com                                                                                                           
Server:     192.168.1.1
Address:    192.168.1.1#53

Non-authoritative answer:
Name:   phoronix.com
Address: 23.111.154.110

Unfortunately, the server its traceroutes to is google and not phoronix.com. Either the documentation is wrong or my understanding of what the tool is supposed to tell is wrong.

Can somebody tell me where am I going wrong ?

  • I am not familiar with dnstraceroute, but it appears that it's tracing the route of a DNS request for the given host, and not the route to the host itself. – DopeGhoti Feb 16 '17 at 19:17
  • is it kind of reverse traceroute that is being tried or what ? I am trying to understand what is the problem being solved and how ? – shirish Feb 16 '17 at 19:33
1

dnstraceroute is just a traceroute to show the path your DNS request takes to get to its destination. I guess this tool is used to make sure your DNS traffic doesn't go anywhere it isn't supposed to and traceroute or nslookup don't support this kind of feature.

Adding the --expert parameter is supposed to provide hints to indicate a potential hijacking.

Unfortunately, the server its traceroutes to is google and not phoronix.com

sudo dnstraceroute --expert -C -e -t A -s 8.8.4.4 phoronix.com

It has to go back to google 8.8.4.4 is google's public DNS

  • I updated my query. I know that 8.8.4.4 is google's public DNS . I was wondering why the example tells that. I actually had tried using phoronix.com IP address taken/used from nslookup and seen that didn't work hence put up the question. – shirish Feb 16 '17 at 20:12
  • sudo dnstraceroute --expert -C -e -t A -s 23.111.154.110 This shouldn't work because you are using Phoronix's IP as a dns server and thereby providing no hostname for the command. I think this tool is meant to show you the path your dns request takes when it is supposed to go to x site with x dns server. dnstraceroute --expert -C -e -t A -s 8.8.4.4 23.111.154.110 should show you your request to phoronix when 8.8.4.4 is the dns server used. – Pythonic Feb 16 '17 at 20:29
  • umm... right, so how would a typical path be traced using dnstraceroute, could you share an example, using a mythical IP - say 61.0.171.255 as the host (dynamic IP) and 23.111.154.110 as the site to visit. – shirish Feb 16 '17 at 20:36
  • You would call the command as dnstraceroute --expert -a -s (DNS server of your choosing) 23.111.154.110. Your host ip doesn't matter to run the command, it would just look like gateway(61.0.171.255), some hops, dnsserver(8.8.8.8). – Pythonic Feb 16 '17 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.