Re: re:72.14.207.104
From: Newsbox (nospam_for_me_please_at_thanks.invalid)
Date: 07/21/05
- Next message: John Thompson: "Re: Help can It spy on me during work"
- Previous message: Unruh: "Re: Help can It spy on me during work"
- In reply to: bfisher: "re:72.14.207.104"
- Next in thread: Newsbox: "Re: re:72.14.207.104"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 20 Jul 2005 20:30:52 -0400
On Wed, 20 Jul 2005 15:39:45 +0000, bfisher wrote:
>>
>> It appears that where I am, DNS for google.com resolves to
> 216.239.39.99,
>> both from my ISP's DNS servers and from GOOGLE's (and consistently).
> So
>> when my browser sends a get to 216.239.39.99, and the firewall sees
> an ACK
>> from 72.14.207.104, perhaps the firewall is doing exactly what it
> is
>> supposed to do by LOGging and DROPping that ACK packet. When I put
>> "216.239.39.99" into the location bar everything works beautifully.
> But
>> when I put in "google.com" it times out, and I get hits from
> 72.14.207.104.
>>
>
> I too was having the exact same trouble.... pinging google.com from
> the pc would reply with a 216.239.39.99 address but the browser would
> time out when trying to find google.ca or google.com.
> After many a sleepless night I found on my LEAF router (which runs
> shorewall firewall) that it has a norfc1918 filtering option in it...
> but default it would block all traffic from the IP address range of
> 72.0.0.0 /5 as this was a reserved range. Google must have
> purchased a small block of these IPs recently (72.14.207.0) After I
> removed that entry and restarted the firewall I was able to get to
> google.com.
> A quick search on the web reveals that these IPs have something to do
> with a google web accelerator. Even though it isn't installed on my
> PC, some how the browser(IE 6.0) still wants to goto the
> 72.14.207.104 IP, even though my DNS servers are showing the
> 216.239.39.99.
>
> regards,
> Brian
Thanks for the input. Apparently, what you are seeing is not exactly what
I am seeing, and neither is necessarily the same as I was seeing on 6/14.
Note that we are not the only ones seeing "strangeness" on google. See
this:
http://isc.sans.org/diary.php?date=2005-07-19
and today's entry (which after today might be):
http://isc.sans.org/diary.php?date=2005-07-20
The various issues seem to be browser specific, and there is mention of
involvement of javascripts. From previous experiences, I believe there
may be many subtle (and maybe not-so-subtle) differences among different
platforms, browsers, and javascript implementations, especially when
compared to Microsoft and IE "standards".
I have captured raw traffic with ethereal and studied to for clues, but
unfortunately my understanding is limited. On 6/14 I was directed by DNS
to the 216.239.39.99 address, but did not connect to it. Today I connect
to that address and get some limited traffic that does not display a page,
and the browser times out. I'm only seeing this kind of strangeness on
google. I have ruled out local firewall/connection issues. It may indeed
have something to do with their "web accelerator" or possibly some other
javascript they are serving. However, it does somehow seem to be
completely confined to google.
If someone wanted to try to analyze javascript code pulled out of a
captured HTTP packet I could try another capture and post a packet or two.
On the other hand I have no reason to believe they are sending me
anything different that what they are sending anyone else. So probably
anyone interested could look for h/h-self.
"Google isn't talkin'"
Best wishes.
- Next message: John Thompson: "Re: Help can It spy on me during work"
- Previous message: Unruh: "Re: Help can It spy on me during work"
- In reply to: bfisher: "re:72.14.207.104"
- Next in thread: Newsbox: "Re: re:72.14.207.104"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
