Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1.1.1.1: Fast, privacy-first consumer DNS service

blog.cloudflare.com

Post reply on HN
Print view View original

641–650 of 695 posts

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#641

Post by luochen1990 »

chrissnell wrote: post #317
cleanbrowsing wrote: post #299

And look at these ping times: CloudFlare Google DNS Quad9 OpenDNS NewYork 2 msec 1 msec 2 msec 19 msec Toronto 2 msec 28 msec 17 msec 27 msec Atlanta 1 msec 2 msec 1 msec 19 msec Dallas 1 msec 9 msec 1 msec 7 msec San Francisco 3 msec 21 msec 15 msec 20 msec London 1 msec 12 msec 1 msec 14 msec Amsterdam 2 msec 6 msec 1 msec 6 msec Frankfurt 1 msec 9 msec 2 msec 9 msec Tokyo 2 msec 2 msec 81 msec 77 msec Singapore 2…

Where are you testing from? I'm going to guess: a datacenter. Residential customers won't see anything this fast. I'm in a small town in Kansas, connected by 1 Gbit ATT fiber. I'm getting ~26ms to 1.1.1.1 and ~19ms to my private DNS resolver that I host in a datacenter in Dallas. Google DNS comes in around 19ms. I suspect that Cloudflare and Google DNS both have POPs in Dallas, which accounts for the similar numbers…

HangZhou:

  Pinging 1.1.1.1 with 32 bytes of data:
  Reply from 1.1.1.1: bytes=32 time=1ms TTL=128
  Reply from 1.1.1.1: bytes=32 time=1ms TTL=128
  Reply from 1.1.1.1: bytes=32 time=1ms TTL=128
  Reply from 1.1.1.1: bytes=32 time=2ms TTL=128

  Pinging 8.8.8.8 with 32 bytes of data:
  Reply from 8.8.8.8: bytes=32 time=91ms TTL=37
  Request timed out.
  Reply from 8.8.8.8: bytes=32 time=66ms TTL=37
  Request timed out.

  Pinging 1.0.0.1 with 32 bytes of data:
  Reply from 1.0.0.1: bytes=32 time=146ms TTL=50
  Reply from 1.0.0.1: bytes=32 time=144ms TTL=50
  Reply from 1.0.0.1: bytes=32 time=142ms TTL=50
  Reply from 1.0.0.1: bytes=32 time=140ms TTL=50

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#642

Post by sashametro »

DesertBattery wrote: post #615
jlgaddis wrote: post #539

Earlier quoted context omitted.

Are you in .ru? You might direct your questions at your ISP instead as it appears that someone may be intercepting your DNS requests. ---- To elaborate a bit, the differences in the (74.125.x.x) IP addresses being returned is somewhat normal and would usually be attributed to simple load balancing (as d33 pointed out). That is, 8.8.8.8 is actually a load balancer with several servers (including 74.125.46.8, 74.125.46…

I have static public /32. My ISP intercepting DNS traffic for censorship purposes. But i strongly doubt that this traffic is forwarded somewhere. [user@v-fed-1 ~]$ dig txt o-o.myaddr.test.l.google.com @8.8.8.8 +short "173.194.98.4" "edns0-client-subnet 94.181.44.185/32" [user@v-fed-1 ~]$ dig txt o-o.myaddr.test.l.google.com @8.8.8.8 +short "173.194.98.4" "edns0-client-subnet 94.181.44.185/32" [user@v-fed-1 ~]$ dig tx…

If you run those commands without the +short you will see that the TTL values for those responses are less than 59 (which for Google Public DNS, indicates they are cached, and explaining why the IP addresses shown are not yours).

The o-o.myaddr.l.google.com domain is a feature of Google's authoritative name servers (ns[14].google.com) and not of 8.8.8.8. You can send similar queries through 1.1.1.1 (where you will see that there is no EDNS Client Subnet data provided, improving the privacy of your DNS but potentially returning less accurate answers, as Google's authoritative servers do not have your IP subnet, but only the IP address of the CloudFlare resolver forwarding your query.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#643

Post by DesertBattery »

sashametro wrote: post #642
DesertBattery wrote: post #615

Earlier quoted context omitted.

I have static public /32. My ISP intercepting DNS traffic for censorship purposes. But i strongly doubt that this traffic is forwarded somewhere. [user@v-fed-1 ~]$ dig txt o-o.myaddr.test.l.google.com @8.8.8.8 +short "173.194.98.4" "edns0-client-subnet 94.181.44.185/32" [user@v-fed-1 ~]$ dig txt o-o.myaddr.test.l.google.com @8.8.8.8 +short "173.194.98.4" "edns0-client-subnet 94.181.44.185/32" [user@v-fed-1 ~]$ dig tx…

If you run those commands without the +short you will see that the TTL values for those responses are less than 59 (which for Google Public DNS, indicates they are cached, and explaining why the IP addresses shown are not yours). The o-o.myaddr.l.google.com domain is a feature of Google's authoritative name servers (ns[14].google.com) and not of 8.8.8.8. You can send similar queries through 1.1.1.1 (where you will se…

Aren't o-o.myaddr.l.google.com is intended for troubleshooting and should show correct ECS? o-o.myaddr.test.l.google.com always show correct ECS.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#644

Post by finnh »

chisleu wrote: post #135
tux3 wrote: post #122

Earlier quoted context omitted.

You can also use the decimal value of the IP, without the dots: https://16843009

You can also sing that number to the tune of the famous 8675309 song with very little robato.

I just upvoted you, bc (a) funny and (b) TIL a new word (rubato).

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#645

Post by kim0 »

driverdan wrote: post #351

Here's how to use it with DNS-over-HTTPS on OS X / MacOS: brew install dnscrypt-proxy Change line 25 in /usr/local/etc/dnscrypt-proxy.toml to server_names = ['cloudflare'] sudo brew services restart dnscrypt-proxy Then change your DNS server to 127.0.0.1 (run Network pref panel, unlock, Advanced, DNS)

Thanks! That setup breaks everytime I'm behind a captive portal (hotel) .. any work around that except changing it manually and back?!

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#646

Post by rootusrootus »

dingo_bat wrote: post #564
rootusrootus wrote: post #560

Earlier quoted context omitted.

Unless you tell it not to, ping will try a reverse lookup on the IP you are pinging in order to display that to you in the output. It's a good idea to keep that in mind when you ping something, especially if you notice the first ping is abnormally slow.

That reverse lookup time is not counted in the first ping.

Perhaps that depends on operating system. In the 30 years I have been using ping on Linux, the reverse lookup time is absolutely included in the first ping time.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#647

Post by 2bluesc »

jlgaddis wrote: post #375

EDIT: Looks like this might be an issue w/ my AT&T-provided CPE, sorry! (more details at the bottom) From my vantage point, 1.1.1.1 is inaccessible, while 1.0.0.1 seems to work just fine. Comments on the blog post blame this on "various reasons" but, at least in my case, this seems to be a Cloudflare issue: $ ping -c 5 -q 1.0.0.1 PING 1.0.0.1 (1.0.0.1) 56(84) bytes of data. --- 1.0.0.1 ping statistics --- 5 packets t…

> When pinging 1.1.1.1 from my (pfSense-based) router sitting directly behind the modem, however, no replies come back from the modem to the router (confirmed via pcap on the upstream-facing interface).

Your upstream diagnosis seems to suggest otherwise, but perhaps you have an issue with using pfBlockerNG? If you're using pfSense with pfBlockerNG + DNSBL IP rules, it populates empty firewall alias files with 1.1.1.1 which was falsely assumed to be unused.

Review your aliases and pfBlockerNG alerts. If you see it dropped there, disable the firewall rule option on DNSBL, see screenshot [0]

Additional brief discussion on reddit [1] with comments from the pfBlockerNG author.

[0] https://i.imgur.com/u5q5SP2.png

[1] https://www.reddit.com/r/PFSENSE/comments/88wg6g/issue_with_...

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#648

Post by fwgwgwgch »

pdkl95 wrote: post #148
fwgwgwgch wrote: post #89

Earlier quoted context omitted.

AFAIK the only data is domain name, record and the incoming ip. I don't care if they store the first two. Do you have any actual points against or are you just trying to nitpick? And do you have anything better?

> the only data is domain name, record and the incoming ip Other data that can be logged: - timestamp - this can be very revealing when correlated with other datasets.j - ASN - can sometimes act like fingerprint on it's own, and assists in correlating other data (e.g. the timestamp) - any identifiable variation in the structure or behavior between different DNS resolver implementations. See nmap's "-O" option that de…

Good answer. Thanks.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#649

Post by feelin_googley »

eastdakota wrote: post #626
feelin_googley wrote: post #586

Earlier quoted context omitted.

"... a crappy data sharing service." Do you mean OpenDNS?

No. I mean most businesses that are based on sharing data. They are low margin and not very interesting. I was thinking about businesses like Axicom when I wrote the comment. Have a ton of respect for David Ulevitch and the whole OpenDNS team. While OpenDNS started with an ad-supported business model, they've completely pivoted away from that. Now that they're part of Cisco, I believe their nearly exclusive revenue s…

What I meant was sharing not browsing data but DNS lookup data.

As always, too easy to be misunderstood in comments like these.

Re: 1.1.1.1: Fast, privacy-first consumer DNS service

#650

Post by jlgaddis »

jmuguy wrote: post #402
__david__ wrote: post #369

Earlier quoted context omitted.

My AT&T fiber is blocking 1.1.1.1, too. But 1.0.0.1 is working.

Same, ATT Fiber in Charlotte NC

Which AT&T modem do you have? I'm seeing this w/ 5268AC, trying to find others that are affected as well.
Post reply on HN