[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #20348 [Metrics/Censorship analysis]: Kazakhstan blocking of vanilla Tor and obfs4, 2016-06
#20348: Kazakhstan blocking of vanilla Tor and obfs4, 2016-06
-----------------------------------------+--------------------------
Reporter: dcf | Owner:
Type: project | Status: reopened
Priority: Medium | Milestone:
Component: Metrics/Censorship analysis | Version:
Severity: Normal | Resolution:
Keywords: censorship block kz | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
-----------------------------------------+--------------------------
Comment (by dcf):
Here are Nmap scans of 92.63.88.128 and 92.62.192.41. 92.63.88.128 is the
server that blocked sites are redirected to (comment:145, comment:149) and
92.62.192.41 is the IP address to which 92.63.88.128 redirects when it
doesn't get the `?NTDzLZ` part.
* attachment:20161218-103025.nmap.gz
* attachment:20161218-103025.xml.gz
92.63.88.128 has two open ports: 22 and 80. SSH claims to be OpenSSH from
Debian. The best OS guess is Linux 3.
{{{
Nmap scan report for ip88-128.mwtv.lv (92.63.88.128)
Host is up, received user-set (0.38s latency).
Scanned at 2016-12-18 10:30:32 PST for 140s
Not shown: 543 filtered ports
Reason: 543 no-responses
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 6.7p1 Debian
5+deb8u3 (protocol 2.0)
80/tcp open http syn-ack nginx
|_http-methods: No Allow or Public header in OPTIONS response (status code
405)
|_http-title: Did not follow redirect to http://92.62.192.41
Device type: general purpose|firewall|terminal|WAP|security-misc|printer
|storage-misc|webcam
OS fingerprint not ideal because: Host distance (12 network hops) is
greater than five
Aggressive OS guesses: Linux 3.11 - 3.13 (94%), Linux 3.2 - 3.8 (91%),
Linux 3.12 (90%), Linux 2.6.32 (90%), IPFire firewall 2.11 (Linux 2.6.32)
(89%), Linux 2.6.18 - 2.6.22 (89%), IGEL UD3 thin client (Linux 2.6)
(89%), Linux 2.6.35 (89%), Linux 3.1 - 3.2 (89%), Linux 2.6.32 - 2.6.39
(88%)
Uptime guess: 3.529 days (since Wed Dec 14 21:51:44 2016)
Network Distance: 12 hops
TCP Sequence Prediction: Difficulty=254 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 291.51 ms 10.11.0.1
2 291.51 ms 185.120.77.1
3 294.56 ms telecom.gohost.kz (88.204.195.89)
4 316.18 ms 82.200.252.77
5 360.10 ms 92.47.151.204
6 361.46 ms 95.59.172.43
7 330.22 ms 95.59.172.19
8 363.46 ms mosc-mx-1.online.kz (92.47.145.110)
9 377.98 ms msk-ix2.lattelecom.lv (195.208.208.24)
10 378.19 ms 87.110.223.130
11 381.26 ms 91.90.249.194
12 370.74 ms ip88-128.mwtv.lv (92.63.88.128)
}}}
92.62.192.41 was completely non-responsive.
{{{
Nmap scan report for 92-62-192-41.customer.fuzion.dk (92.62.192.41)
Host is up, received user-set.
All 1000 scanned ports on 92-62-192-41.customer.fuzion.dk (92.62.192.41)
are filtered because of 1000 no-responses
Too many fingerprints match this host to give specific OS details
TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 291.51 ms 10.11.0.1
2 ...
3 ...
4 ...
5 ...
6 296.49 ms 95.59.172.35
7 314.09 ms ebg02.transtelecom.net (217.150.44.14)
8 ...
9 376.32 ms de-cix.ip.nianet.net (80.81.194.79)
10 422.49 ms 93.176.94.188
11 ...
12 ...
13 ...
14 ...
15 ...
16 ...
17 ...
18 ...
19 ...
20 ...
21 ...
22 ...
23 ...
24 ...
25 ...
26 ...
27 ...
28 ...
29 ...
30 ...
}}}
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20348#comment:167>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs