1

Init:

  1. For user anonymous configured transpared proxy.
  2. Wireshark sniffing lo...
  3. Trying to use console network-tools torified.

anonymous@kali:/tmp$ time strace -s6000 -t -f dig facebookcorewwwi.onion > dig.strace 2>&1

  • pastebin.com/it1tk8jQ - visible in wireshark.

anonymous@kali:/tmp$ time strace -s6000 -t -f host facebookcorewwwi.onion > host.strace 2>&1

  • pastebin.com/EgWWsM55 - not visible.

anonymous@kali:/tmp$ time strace -s6000 -t -f wget -O - facebookcorewwwi.onion > wget.strace 2>&1

  • pastebin.com/cB1dSHDd - not visible. (Optional, just for being)

Means, only dig given valid IP-Address from VirtualAddrNetwork from torrc:

VirtualAddrNetwork 172.16.0.0/12 # private network 10.x.x.x is not available
AutomapHostsOnResolve 1

Other tools hanged. Retried to reconnect to DNS-servers couple of times, thereafter broke with connection timed out; no servers could be reached or something like that.

However, I did not seen anything in Wireshark. Only dig was highlighted with specified DNS request redirected by iptables to loop-back interface 53 port.

What is strange, both dig and host are using the same functions with the same flags:

dig:

[pid 10713] 06:41:58 sendmsg(20, {msg_name(16)={sa_family=AF_INET, 
sin_port=htons(53), sin_addr=inet_addr("10.99.248.2")}, msg_iov(1)=[{"<\331\1 
\0\1\0\0\0\0\0\1\20facebookcorewwwi\5onion\0\0\1\0\1\0\0)\20\0\0\0\0\0\0\0", 51}],
msg_controllen=0, msg_flags=0}, 0) = 51

host:

[pid 10394] 06:41:38 sendmsg(20, {msg_name(16)={sa_family=AF_INET, 
sin_port=htons(53), sin_addr=inet_addr("10.99.248.2")}, msg_iov(1)=[{"9\307\1
\0\0\1\0\0\0\0\0\0\20facebookcorewwwi\5onion\0\0\1\0\1", 40}],
msg_controllen=0, msg_flags=0}, 0 <unfinished ...>

Only payloads are little bit different.

My question is about this pastebined logs: Where is this place in log which is wrong for host and right for dig???? Because I'm not seeing anything. bind, sendmsg, socket, etc - everything seems are equivalent.

Why does dig working, resolving onion domain into ip address but host, wget, nslookup, chromium... and other doesn't? Most of mysterium with onion domains only. Every other domains are resolving successfully and highlighted on lo side in Wireshark successfully by any network-tool or even chromium...

Probably, it is because dig is most robust tool to resolve ip addr, then what is wrong with other? Why are they not so smart?

  • Likely entirely unrelated to dig or host, since both work under normal circumstances. Review the rest of your setup, at a guess I'd suspect iptables is setup wrong. – cacahuatl Sep 1 '16 at 1:29
1

If you're using a standard setup with local DNS server located on your very PC - it caches the response locally inside the server, so no second request is made. If you have more questions - feel free to ask!

  • You are right! After I have changed /etc/resolv.conf to nameserver 127.0.0.1 - everything is fine for onion domains. Thx. – overuser Sep 1 '16 at 2:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.