The predictable IP address sequences of one type of GFW DNS injector

One type of GFW DNS injector (identified by response flags 0x8400 when query RD=0) uses ordered, cyclic IP address pools. By probing at approximately 100–500 queries per second with a fixed UDP 4-tuple, the complete ordered pool can be recovered: for torproject.org this yields 592 IPv4 addresses and 30 IPv6 addresses. The same pool is documented in Appendix A of the Wallbleed (NDSS 2025) paper for the domain 4.tt.

§Collect DNS responses / §Infer the IP address ordering deployment dns-poisoningpacket-injection cn

Analysis of a June 2025 dataset using DBSCAN clustering confirmed a heterogeneous injector deployment: individual source ports are routed to processes that are either ~100% cyclic or ~100% random-order, with an estimated ratio of approximately 6 cyclic processes to 1 non-linear process. Despite the difference in IP-selection logic, the cyclic and non-linear injectors show virtually identical DNS answer TTL distributions, indicating shared codebase with diverged IP-selection modules rather than entirely separate systems.

mcrmck comment 2025-06-21 evaluation dns-poisoning cn

The GFW DNS injector runs as multiple parallel processes that share the same IP address pool but each maintain an independent incrementing counter. Load balancing to these processes is 4-tuple hash-based (src IP, dst IP, src port, dst port), so a fixed source port is routed deterministically to one process. Probing with variable source ports revealed 3 distinct linear sequences in March 2025, growing to 5 or more by June 2025.

§Visualization (variable source ports) / wkrp comment 2025-06-03 deployment dns-poisoning cn

Between March 26 and June 3, 2025, the GFW cyclic injector's IPv4 pool for torproject.org shrank from 592 to 591 addresses (the IP 162.125.82.7 was removed), and the observable number of load-balanced process sequences increased from 3 to 5. These changes occurred without altering the fundamental cyclic structure or pool membership of the remaining addresses, demonstrating that the injector infrastructure undergoes incremental updates while preserving its core mechanism.

wkrp comment 2025-06-03 (pool diff and process count) evaluation dns-poisoning cn

Two distinct GFW DNS injector types respond to blocked domains simultaneously, returning duplicate responses per query. They are distinguishable by DNS response flags: the cyclic-ordering injector sets flags 0x8400 (AA bit) when query RD=0, while the second injector sets 0x8180. They also differ in DNS parser behavior: the 0x8180 injector responds to queries using an embedded literal dot (0x2e label separator), while the cyclic injector does not—reversing a behavior documented in the Wallbleed paper.

§Filter DNS responses / wkrp comment on two injector types detection dns-poisoningpacket-injection cn