cancel
Showing results for 
Search instead for 
Did you mean: 

Plusnet Google DNS hijacking

DocEmmettBrown
Hooked
Posts: 5
Thanks: 1
Registered: ‎22-08-2016

Plusnet Google DNS hijacking

Hi,

 

I just realized today Plusnet is hijacking all Google traffic towards Plusnet servers, even if you use alternative DNS. Has anybody else noticed this, and/or can Plusnet explain the reason for this?

PLUSNET DEFAULT DNS

 

root@router:~# nslookup www.google.co.uk
Server: (null)
Address 1: ::1
Address 2: 127.0.0.1 localhost

Name: www.google.co.uk
Address 1: 2a00:1450:4009:802::2003 lhr25s07-in-x03.1e100.net
Address 2: 212.56.71.114 plusnet-lcy4.plus.net
Address 3: 212.56.71.94 plusnet-lcy4.plus.net
Address 4: 212.56.71.99 plusnet-lcy4.plus.net
Address 5: 212.56.71.98 plusnet-lcy4.plus.net
Address 6: 212.56.71.88 plusnet-lcy4.plus.net
Address 7: 212.56.71.123 plusnet-lcy4.plus.net
Address 8: 212.56.71.118 plusnet-lcy4.plus.net
Address 9: 212.56.71.104 plusnet-lcy4.plus.net
Address 10: 212.56.71.93 plusnet-lcy4.plus.net
Address 11: 212.56.71.103 plusnet-lcy4.plus.net
Address 12: 212.56.71.113 plusnet-lcy4.plus.net
Address 13: 212.56.71.89 plusnet-lcy4.plus.net
Address 14: 212.56.71.109 plusnet-lcy4.plus.net
Address 15: 212.56.71.84 plusnet-lcy4.plus.net
Address 16: 212.56.71.119 plusnet-lcy4.plus.net
Address 17: 212.56.71.108 plusnet-lcy4.plus.net

 

 

USING GOOGLE'S DNS SERVER

 


root@router:~# nslookup www.google.co.uk 8.8.8.8
Server: 8.8.8.8
Address 1: 8.8.8.8 google-public-dns-a.google.com

Name: www.google.co.uk
Address 1: 2a00:1450:4009:80a::2003 lhr35s02-in-x03.1e100.net
Address 2: 212.56.71.49 plusnet-lcy3.plus.net
Address 3: 212.56.71.54 plusnet-lcy3.plus.net
Address 4: 212.56.71.40 plusnet-lcy3.plus.net
Address 5: 212.56.71.29 plusnet-lcy3.plus.net
Address 6: 212.56.71.59 plusnet-lcy3.plus.net
Address 7: 212.56.71.25 plusnet-lcy3.plus.net
Address 8: 212.56.71.34 plusnet-lcy3.plus.net
Address 9: 212.56.71.30 plusnet-lcy3.plus.net
Address 10: 212.56.71.39 plusnet-lcy3.plus.net
Address 11: 212.56.71.50 plusnet-lcy3.plus.net
Address 12: 212.56.71.24 plusnet-lcy3.plus.net
Address 13: 212.56.71.20 plusnet-lcy3.plus.net
Address 14: 212.56.71.45 plusnet-lcy3.plus.net
Address 15: 212.56.71.55 plusnet-lcy3.plus.net
Address 16: 212.56.71.44 plusnet-lcy3.plus.net
Address 17: 212.56.71.35 plusnet-lcy3.plus.net

 

Thanks

8 REPLIES
Community Veteran
Posts: 26,739
Thanks: 952
Fixes: 10
Registered: ‎10-04-2007

Re: Plusnet Google DNS hijacking

Why do you see that as an issue? Unless that is that you want poorer performance by not using the local caches of Google.

jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£13/month)
Mobile: iD mobile (£4/month)
DocEmmettBrown
Hooked
Posts: 5
Thanks: 1
Registered: ‎22-08-2016

Re: Plusnet Google DNS hijacking

I see that as a security concern. Google certainly has no issues of latency or does not need caching from the provider side, Google's own LHR datacenter is fast enough and have no issue at all on other providers which are way bigger than Plusnet.

But in this way Plusnet can potentially collect search queries, which I do not agree upon.

So I would like some sort of explanation, as even if I wanted to use any other DNS service, Plusnet rewrites the packet through DPI which violates network neutrality. This looks to me a breach of contract.

DocEmmettBrown
Hooked
Posts: 5
Thanks: 1
Registered: ‎22-08-2016

Re: Plusnet Google DNS hijacking

They could simply cache through Plusnet's own DNS servers, but I don't see any reason to rewrite the content of DNS queries/replies from/to 8.8.8.8.

While I do understand Plusnet has to comply with the law, and can and will block access to unlawful or malicious websites, I don't see why they should prevent me from using a perfectly legitimate service which is Google's 8.8.8.8 DNS.
This is shoving down our throat a local Google cache rather then offering us the possibility to opt in or out through DNS servers.

Community Veteran
Posts: 38,460
Thanks: 1,031
Fixes: 62
Registered: ‎15-06-2007

Re: Plusnet Google DNS hijacking

DocEmmettBrown
Hooked
Posts: 5
Thanks: 1
Registered: ‎22-08-2016

Re: Plusnet Google DNS hijacking

Well, with this clarification (being remotely managed by Google) it sounds a bit better, which is exactly what I asked in the first place: a clarification.

It might have come sooner rather than a "why do you want to know" question Smiley

Community Veteran
Posts: 38,460
Thanks: 1,031
Fixes: 62
Registered: ‎15-06-2007

Re: Plusnet Google DNS hijacking

it might have come sooner if you had bothered to use Google to find out which is what I did

DocEmmettBrown
Hooked
Posts: 5
Thanks: 1
Registered: ‎22-08-2016

Re: Plusnet Google DNS hijacking

To be fair, I did it, and couldn't find anything. And proceded to next step: asking on my provider's forum.

You're surely smarter than me, congratulations. Certainly I am getting quite an arrogant treatment over here, thank god I am moving away from Plusnet.

So long, and thanks for all the fish.

Bye.

Andrue
Pro
Posts: 775
Thanks: 90
Fixes: 1
Registered: ‎12-01-2015

Re: Plusnet Google DNS hijacking


DocEmmettBrown wrote:

But in this way Plusnet can potentially collect search queries, which I do not agree upon.

Eh?

I very much doubt that PN records the information that you are suggesting. They have very little to gain from it and frankly I doubt they even have the technical ability to make use of such information.

 

Google on the other hand is nothing more than a company that acquires and analyzes such information. They have spent years creating some of the best information gathering and processing systems ever invented.

The idea of someone using Google services being worried about what PlusNet might record is missing a major point by a country mile Smiley