<div dir="ltr">TPG host a google cache - which is served from TPG IP Space. 8.8.8.8 is using the EDNS Client Subnet option and determining that their cache is the best spot for you.<span style="font-family:arial,sans-serif;font-size:13px"> 139.130.4.4 is probably doing the same.</span><div><br></div><div>-Tom</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 24, 2014 at 10:33 AM, Donal <span dir="ltr"><<a href="mailto:irldexter@podomere.com" target="_blank">irldexter@podomere.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
Short version: TPG IPs serving Google content: <a href="http://203.219.219.108" target="_blank">http://203.219.219.108</a> and dig'ing at 8.8.8.8 from our TPG CE's result in these non-Google IPs for <a href="http://google.com" target="_blank">google.com</a>, <a href="http://gstatic.com" target="_blank">gstatic.com</a> A records etc? Is this an official edge?<br>
<br>
>From a TPG fibre connection (utilising another wholesale primary carrier) we were also seeing responses from Uneeda [139.130.4.4] with a CNAME saying '<a href="http://blocked.domain.gstatic.com" target="_blank">blocked.domain.gstatic.com</a>' resolving to home [127.0.0.1] for about 2 hours+ essentially blackholing '<a href="http://ssl.gstatic.com" target="_blank">ssl.gstatic.com</a>' traffic (as per others on this list) -> thus much associated SSL/TLS related account management mechanisms for Google services (affecting Google Mail domain account management and Google Drive permissions as an example!). TPG noted a peering issue between TPG <- PIPE -> Google but this doesn't directly explain the CNAME/A record responses being different (especially when asking 139.130.4.4 locally).. unless there was some conflation of multiple issues and/or blacklisting?<br>
<br>
The funny thing was though that a dig @<a href="http://8.8.8.8" target="_blank">8.8.8.8</a> from the TPG client edge for '<a href="http://ssl.gstatic.com" target="_blank">ssl.gstatic.com</a>' results in the response A records being from a TPG prefix and not a Google AS'/prefix range which worries me. Albeit Telstra is now returning the correct A records (and always was internationally), it is only when sourcing DNS requests from inside TPG ranges that we had issues on multiple client sites and the below is friek'ing me out.<br>
<br>
An example DIG @ Fri Oct 24 16:01:39 EST 2014 to 8.8.8.8 for '<a href="http://ssl.gstatic.com" target="_blank">ssl.gstatic.com</a>' resulted in the below TPG A records:<br>
<br>
<a href="http://ssl.gstatic.com" target="_blank">ssl.gstatic.com</a>. 219 IN A 203.219.219.99<br>
<a href="http://ssl.gstatic.com" target="_blank">ssl.gstatic.com</a>. 219 IN A 203.219.219.108<br>
<a href="http://ssl.gstatic.com" target="_blank">ssl.gstatic.com</a>. 219 IN A 203.219.219.89<br>
… and lots more...<br>
<br>
Currently @11.20pm AEST the response from "8.8.8.8" @ a TPG CE IP range is:<br>
<br>
;; ANSWER SECTION:<br>
<a href="http://ssl.gstatic.com" target="_blank">ssl.gstatic.com</a>. 299 IN A 220.244.223.35<br>
<a href="http://ssl.gstatic.com" target="_blank">ssl.gstatic.com</a>. 299 IN A 220.244.223.49<br>
<a href="http://ssl.gstatic.com" target="_blank">ssl.gstatic.com</a>. 299 IN A 220.244.223.38<br>
… and lots more...<br>
<br>
Whereupon tracerouting 8.8.8.8 from the customer site does go deep in to Google AS territory… but...<br>
<br>
laptop$ whois -h <a href="http://whois.cymru.com" target="_blank">whois.cymru.com</a> " -v 203.219.219.99"<br>
AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name<br>
7545 | 203.219.219.99 | <a href="http://203.219.219.0/24" target="_blank">203.219.219.0/24</a> | AU | apnic | 2003-03-11 | TPG-INTERNET-AP TPG Telecom Limited,AU<br>
<br>
laptop$ whois -h <a href="http://whois.cymru.com" target="_blank">whois.cymru.com</a> " -v 220.244.223.35"<br>
AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name<br>
7545 | 220.244.223.35 | <a href="http://220.244.223.0/24" target="_blank">220.244.223.0/24</a> | AU | apnic | 2003-06-18 | TPG-INTERNET-AP TPG Telecom Limited,AU<br>
<br>
I find it vary hard to believe that Google's 8.8.8.8 was returning TPG A records and keep leaning towards someone mangling DNS along the way (or trying to do SSL offload/MITM)… anyone got a simpler explanation like an official egde that's not well documented?<br>
<br>
Note: The certificate served by these IPs is valid, different expiry dates than elsewhere for the same content but still GeoTrust listed for *.<a href="http://google.com" target="_blank">google.com</a> (as opposed to<br>
<br>
The IP "203.219.219.108" for example, serves Google.com content even from Germany… and RADB confirms the IP as TPG origin AS AS7545 …? This can't be an official edge right?<br>
<br>
--<br>
Humble regards,<br>
<br>
Donal @podomere<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</blockquote></div><br></div>