尝试利用 IP.TTL 确定 DNS 污染发生的位置

dns_ttl.sh

#!/bin/bash
# Weisi Dai <weisi@cmu.edu>
#
# Usage: bash dns_ttl.sh 8.8.8.8
#
# Dependencies: mtr dig iptables bc

DOMAIN=twitter.com
DNS=$1

TRACEROUTEFILE=`mktemp`
MANGLETEMPFILE=`mktemp`

iptables-save -t mangle > $MANGLETEMPFILE

mtr $DNS -c 1 -l -n | grep '^h' | cut -b 3- > $TRACEROUTEFILE

INITTTL=$(tail -n 1 $TRACEROUTEFILE | cut -d ' ' -f 1)

for TTL in `seq $INITTTL -1 1`; do

    iptables-restore <<EOF
*mangle
-A POSTROUTING -d $DNS/32 -p udp -m udp --dport 53 -j TTL --ttl-set $TTL
COMMIT
EOF

    if dig +time=1 +tries=2 +short $DOMAIN @${DNS} 1>/dev/null 2>&1; then
        :
    else
        grep "^$(echo $TTL + 1 | bc)" $TRACEROUTEFILE
        break
    fi

done

iptables-restore $MANGLETEMPFILE

rm $TRACEROUTEFILE $MANGLETEMPFILE