Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare's new DNS attracting 'gigabits per second' of rubbish

zdnet.com

Post reply on HN
Print view View original

81–90 of 206 posts

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#81

Post by pyvpx »

walrus01 wrote: post #77
eastdakota wrote: post #43

Earlier quoted context omitted.

No. We have a lot of capacity. A lot.

For ordinary singlehomed users who don't get the "a lot". As an example cloudflare has 40Gbps of capacity to the SIX in Seattle. I would guess that they also have direct, at minimum, 10Gbps PNI peering sessions with other huge ISPs in the Pacific Northwest which never see the SIX fabric. So probably add another 20 individual 10GbE circuits at bare minimum to that 40 figure. All of which helps spread the traffic load…

https://peeringdb.com/net/4224

that's just the public stuff!

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#82

Post by walrus01 »

pyvpx wrote: post #81
walrus01 wrote: post #77

Earlier quoted context omitted.

For ordinary singlehomed users who don't get the "a lot". As an example cloudflare has 40Gbps of capacity to the SIX in Seattle. I would guess that they also have direct, at minimum, 10Gbps PNI peering sessions with other huge ISPs in the Pacific Northwest which never see the SIX fabric. So probably add another 20 individual 10GbE circuits at bare minimum to that 40 figure. All of which helps spread the traffic load…

https://peeringdb.com/net/4224 that's just the public stuff!

For huge entities like this and other top 5 CDNs it makes me wonder how many full time staff positions are dedicated to buying rack space, power and crossconnect in major colo facilities worldwide. How many contract law experts, telecom real estate analysts, etc. That before you even get into things like experts in Japanese contract law. Just for rack, power and facilities at layer one of the osi model before any networking happens.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#83

Post by pyvpx »

cjg wrote: post #72
walrus01 wrote: post #66

Earlier quoted context omitted.

I have no idea where you get the idea there is a finite amount of bandwidth available. It is not coal or molybdenum. ISPs are continually being expanded.

Just because it is expanding, doesn't mean it isn't finite. The current bandwidth is finite. The future bandwidth is finite. Even if we use all the resources available to us, expanding at the speed of light to capture those resources, it's still finite.

IPv6 address space is also finite. but a handful of /64s is a paltry slice of it all.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#84

Post by [deleted] »

ChuckMcM wrote: post #4

I've seen some of the papers where people look at big chunks of unused address space and watch the probes etc. It is really quite amazing. Once I screwed myself royally by accidentally turning RIP on for the upstream side of my router (connected to the cable modem) and it advertised 192.168/16 which Comcast accepted and started routing random stuff from the local exchange to my router. It was pretty funny talking to…

[deleted]

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#85

Post by lumisota »

walrus01 wrote: post #56
IntelMiner wrote: post #53

Earlier quoted context omitted.

As an ex-Comcast employee. Seeing stuff like that happen really doesn't surprise me When Comcast first rolled out that data cap nation wide, I started prodding at it one night out of morbid curiosity Turned out that it would silently slurp all HTTP traffic! Once you hit some arbitrary measurement (EG: 50%) it'll immediately start hijacking all HTTP websites you visit and inject a ton of Javascript to put a message ov…

And people wonder why https everywhere is such a necessity now. It should not be necessary to treat your last mile ISP as a hostile entity , but sadly, it often is.

Your last mile ISP is almost certainly a hostile entity, but HTTPS alone isn't going to save you [0].

[0]: www.cs.umd.edu/class/fall2017/cmsc818O/papers/tangled-mass.pdf

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#86

Post by Sami_Lehtinen »

If your ISP doesn't support IPv6, just try sending RA packets upstream and see what happens. If they're doing it wrong using blacklist instead of whitelist, then it might well leak. It's good to notice, that this doesn't affect IPv4 networking in any way.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#87

Post by klez »

jakobegger wrote: post #80

From a marketing point of view, I think it was a brilliant move from Cloudflare to get the 1.1.1.1 address. Clearly better than 8.8.8.8! But from a user perspective, why couldn't they have just let that address be... So many things are going to break just because Cloudflare wants a pretty IP. Sure, the things that break were using a hack, but in my opinion that doesn't automatically make it okay to break it. Now I'm…

example.com (and other example.*) is reserved for documentation purposes, i.e. you can't buy it.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#88

Post by nextgens »

lathiat wrote: post #73
nextgens wrote: post #45

Earlier quoted context omitted.

Are you aware that your public resolvers are actively breaking DNS-based GeoIP (striping EDNS0-ECN and not using source IPs geo-localized as the requester would be)? and if so, what is the rationale for it?

Yeah I tested it out and switched back, it made performance to Twitch in particular quite bad for me. I don't get that issue with Google DNS though.

Google's take good care of it... and they explain precisely what they do on the topic...

https://developers.google.com/speed/public-dns/docs/ecs

https://developers.google.com/speed/public-dns/faq#locations (when EDNS0/ECS isn't supported)

The tin foil hat brigade might suggest that this is deliberate to ensure that only what's served by cloudflare gets to be fast...

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#89

Post by ptaipale »

jakobegger wrote: post #80

From a marketing point of view, I think it was a brilliant move from Cloudflare to get the 1.1.1.1 address. Clearly better than 8.8.8.8! But from a user perspective, why couldn't they have just let that address be... So many things are going to break just because Cloudflare wants a pretty IP. Sure, the things that break were using a hack, but in my opinion that doesn't automatically make it okay to break it. Now I'm…

8.8.8.8 goes pretty well in the Chinese market. (8 being a popular number.) I think 1.1.1.1 is not such a hit.

Re: Cloudflare's new DNS attracting 'gigabits per second' of rubbish

#90

Post by keeperofdakeys »

jakobegger wrote: post #76
icebraining wrote: post #48

Earlier quoted context omitted.

That means they're intercepting requests to 8.8.8.8 (even if only before login), probably because of its popularity. It's a shame we still have to use these hacks to login; there's a solution for that in RFC7710 (which sends the captive portal information in DHCP), but who knows if and when it'll be adopted by most hotspots. https://tools.ietf.org/html/rfc7710

I thought the way these Wifi hotspots worked was that they intercepted all DNS traffic? How else would they work with legacy systems? Modern OSes detect these login pages by making a DNS lookup of a known domain, eg. macOS/iOS lookup "captive.apple.com", and if the answer is not in the 17.0.0.0/8 subnet they know someone is intercepting DNS and show the Wifi login window.

A lot of captive portals use HTTP interception/redirection, returning a 30X status instead of the expected 204 status.
Post reply on HN