The Dutch court ordered ISPs Ziggo and xs4all to block client’s access to thepiratebay.org and associated domain names and IP addresses. How exactly do these ISPs implement the block?
DNS filtering
The normal DNS response to resolving thepiratebay.org using an unfiltered DNS resolver (and omitting the MX records) is:
$ host thepiratebay.org
thepiratebay.org has address 194.71.107.15
Using the default Ziggo DNS resolver this now gives:
$ host thepiratebay.org
thepiratebay.org has address 212.54.32.19
Using the xs4all DNS resolvers, the response is:
$ host thepiratebay.org
thepiratebay.org has address 194.109.6.92
thepiratebay.org has IPv6 address 2001:888:0:18::80
So the IP address of thepiratebay.org has been replaced with an IP address controlled by the ISP. On the Ziggo IP address the following message is shown:
xs4all chose to display a more informative message:
IP filtering
Besides various domain level bans, the court also ordered the blocking of 3 specific IP addresses. This seems logical because otherwise new DNS records pointing to thepiratebay.org IP address would probably pop-up faster than plaintiff BREIN would be able to add them to the block list. From a Ziggo connection, the traceroute to an unblocked IP address looks like this:
Tracing the path to 194.71.107.14 on TCP port 80 (http), 30 hops max 1 10.10.10.10 1.033 ms 0.323 ms 0.322 ms 2 * 53563a01.cm-6-7a.dynamic.ziggo.nl (83.86.58.1) 7.521 ms 7.774 ms 3 gv-rc0052-ds102-vl202.core.as9143.net (213.51.161.161) 7.657 ms 8.891 ms 7.943 ms 4 gv-rc0011-cr102-ae12-0.core.as9143.net (213.51.158.251) 7.859 ms 9.467 ms 7.554 ms 5 asd-tr0409-cr101-ae8-0.core.as9143.net (213.51.158.26) 10.406 ms 7.016 ms 8.157 ms 6 xe-8-0-1.edge4.amsterdam1.level3.net (212.72.40.173) 38.330 ms 15.699 ms 12.082 ms 7 4.68.110.198 10.337 ms 10.172 ms 8.879 ms 8 te3-2-10g.ar1.snv2.gblx.net (67.16.139.82) 151.346 ms 152.009 ms 154.799 ms 9 xe-1-0-1.cr1.sfo1.us.nlayer.net (69.22.153.205) 152.695 ms 156.498 ms 152.759 ms 10 as40475.ge-0-2-1.cr1.sfo1.us.nlayer.net (69.22.153.90) 152.918 ms 154.384 ms 164.536 ms 11 ge-0-1-0.ro4.sjc01 (208.83.220.46) 170.319 ms 165.839 ms 169.114 ms 12 ge-0-0.cal-cr-0.srstubes.net (74.116.251.2) 168.702 ms 171.355 ms 167.281 ms 13 ge-0-4.sth3-core-1.srstubes.net (194.68.0.194) 179.128 ms 180.895 ms 179.933 ms 14 ge-1-2.sth4-dr-1.srstubes.net (194.68.0.166) 180.699 ms 183.876 ms 180.785 ms 15 ge-0-1.moria-cr-1.piratpartiet.net (194.68.0.146) 179.694 ms 179.994 ms 183.420 ms 16 * * *
A traceroute to a blocked IP address looks like this:
Tracing the path to 194.71.107.15 on TCP port 80 (http), 30 hops max 1 10.10.10.10 0.414 ms 0.331 ms 0.318 ms 2 53563a01.cm-6-7a.dynamic.ziggo.nl (83.86.58.1) 48.198 ms * * 3 gv-rc0052-ds102-vl204.core.as9143.net (213.51.165.33) 13.757 ms 17.851 ms 7.605 ms 4 * * * 5 * * *
So it looks like the IP block is in effect on the Ziggo core router gv-rc0011-cr102-ae12-0.core.as9143.net.
From xs4all a unblocked trace looks like:
Tracing the path to 194.71.107.14 on TCP port 80 (www), 30 hops max 1 124.ae0.xr3.3d12.xs4all.net (194.109.21.13) 0.473 ms 0.313 ms 0.242 ms 2 nl-asd-dc2-ice-ir01.kpn.net (139.156.201.90) 11.780 ms 5.290 ms 11.953 ms 3 nl-asd-dc2-ias-csg01-ge-5-2-0.kpn.net (139.156.113.103) 0.373 ms 0.404 ms 0.367 ms 4 * * * 5 ae3-60g.cr1.ams2.nl.nlayer.net (69.22.139.238) 80.351 ms 80.317 ms 80.271 ms 6 xe-5-3-0.cr1.lhr1.uk.nlayer.net (69.22.142.94) 7.086 ms 7.045 ms 7.034 ms 7 xe-11-3-1.cr1.nyc3.us.nlayer.net (69.22.142.132) 80.444 ms 80.434 ms 80.466 ms 8 ae2-70g.cr1.ewr1.us.nlayer.net (69.31.95.145) 80.811 ms 80.803 ms 80.864 ms 9 xe-5-0-0.cr1.ord1.us.nlayer.net (69.22.142.74) 95.314 ms 95.363 ms 96.473 ms 10 xe-1-2-0.cr1.slc1.us.nlayer.net (69.22.142.102) 133.934 ms 132.688 ms 133.005 ms 11 xe-2-0-1.cr1.sfo1.us.nlayer.net (69.22.142.97) 146.579 ms 146.584 ms 146.568 ms 12 as40475.ge-0-2-1.cr1.sfo1.us.nlayer.net (69.22.153.90) 144.234 ms 144.108 ms 144.151 ms 13 ge-0-1-0.ro4.sjc01 (208.83.220.46) 143.621 ms 143.520 ms 143.585 ms 14 ge-0-0.cal-cr-0.srstubes.net (74.116.251.2) 143.196 ms 143.176 ms 143.300 ms 15 ge-1.sthix.srstubes.net (192.121.80.164) 171.578 ms 171.738 ms 171.557 ms 16 ge-1-2.sth4-dr-1.srstubes.net (194.68.0.166) 172.213 ms 175.003 ms 172.384 ms 17 sthix-ge-0-2.moria-cr-1.piratpartiet.net (192.121.80.181) 171.678 ms 171.728 ms 171.847 ms 18 * * *
and a trace to a blocked IP address:
Tracing the path to 194.71.107.15 on TCP port 80 (www), 30 hops max 1 * * * 2 * * *
I only have an xs4all shell account (no ADSL connection), but it seems the IP block is done quite early in the network. This is most likely to not affect other KPN owned ISPs.
Effectiveness
So is this an effective block to prevent the use of thepiratebay.org website? It is what the court ordered, and maybe it will stop a casual user. However, it is rather trivial to bypass. By using a proxy or VPN to a non-filtering ISP it is very easy to still get access to the site. There are also a number of mirrors/proxy sites that are still accessible. BREIN is allowed by the court to add to the blocklist as they see fit, so we will see how long they will survive. Some examples:
xs4all has an up-to-date list of which domains are being blocked.
Je al eens afgevraagd waarom een verbinding tussen Nederland en Zweden over niet minder dan 6 hops in de USA loopt?
Doe eens een traceroute naar een “gewone” site in Zweden en je ziet meteen het verschil.
Good question. Even from coloclue.net (Dutch hoster) the traffic goes via the USA (hop 10-13):
From xs4all these are the AS numbers involved:
xs4all AS3265
kpn AS286
nlayer AS4436
apliedops AS40475
srstubes AS50066
piratepartiet AS51040
It seems that Applied Operations, LLC AS40475 is advertising 194.71.107.0/24 while that makes no sense at all. A traceroute from xs4all to 194.68.0.166 or 194.14.56.2 (1 hop before thepiratebay.org) goes straight to Sweden:
Other people have noticed as well.
It seems like someone in the USA is very interested to see all the traffic to thepiratebay.org. Who could that be?
Trace from a XS4ALL DSL customer.
traceroute to 194.71.107.15 (194.71.107.15), 30 hops max, 40 byte packets
1 10.0.0.138 2.352 ms 14.941 ms 14.923 ms
2 194.109.5.227 29.589 ms 29.571 ms 29.558 ms
3 * * *
@Mark: yes, thepiratebay.org is blocked by DNS so it resolves to a local address now. You can traceroute to 194.71.107.14 (unused address owned by thepiratebay) to see the actual trace.
Zelfs als het verkeer volgens GeoIP in -ZWEDEN- zit (109.105.98.33) gaat het eerst via de US. Vanaf 145.100.98.4 (UvA-Master-SNE-NET):
traceroute to http://www.thepiratebay.se (194.71.107.15), 30 hops max, 40 byte packets
(redacted)
(redacted)
3 AE3.1664.JNR01.Asd002A.surf.net (145.145.19.190) 0.375 ms 0.367 ms 0.351 ms
4 AE1.500.JNR02.Asd001A.surf.net (145.145.80.73) 0.499 ms 0.513 ms 0.570 ms
5 nl-sar.nordu.net (109.105.98.33) 0.440 ms 0.449 ms 0.432 ms
6 us-man.nordu.net (109.105.97.45) 83.463 ms 83.214 ms us-man.nordu.net (109.105.97.69) 82.463 ms
7 * * *
8 ae1-70g.cr1.ewr1.us.nlayer.net (69.31.95.173) 75.948 ms 75.945 ms 95.937 ms
9 xe-5-0-0.cr1.ord1.us.nlayer.net (69.22.142.74) 131.697 ms 131.281 ms 130.193 ms
10 xe-0-0-0.cr1.slc1.us.nlayer.net (69.22.142.102) 130.982 ms 130.240 ms 130.857 ms
11 xe-2-3-1.cr1.sfo1.us.nlayer.net (69.22.142.97) 154.846 ms 152.883 ms 154.782 ms
12 as40475.ge-0-2-1.cr1.sfo1.us.nlayer.net (69.22.153.90) 154.982 ms 147.887 ms 147.898 ms
13 ge-0-1-0.ro4.sjc01 (208.83.220.46) 156.235 ms 156.326 ms 163.399 ms
14 ge-0-0.cal-cr-0.srstubes.net (74.116.251.2) 163.205 ms 155.998 ms 156.031 ms
15 ge-0-4.sth3-core-1.srstubes.net (194.68.0.194) 170.403 ms 170.655 ms 170.356 ms
From a corporate, non-xs4all kpn connection:
4 1 ms 1 ms <1 ms static.kpn.net [193.###]
5 8 ms 8 ms 8 ms nl-rt-dc2-ias-arg37.kpn.net [62.12.4.74]
6 10 ms 10 ms 14 ms nl-rt-dc2-zsi-sg01-xe-1-3-0.kpn.net [139.156.113.152]
7 10 ms 9 ms 10 ms nl-asd-dc2-zsi-sg01-ae0.kpn.net [139.156.112.32]
8 20 ms 11 ms 24 ms 139.156.222.65
9 12 ms 12 ms 12 ms ams-ix.ae1.cr1.ams2.nl.nlayer.net [195.69.145.219]
10 11 ms 10 ms 10 ms ae3-60g.cr1.ams2.nl.nlayer.net [69.22.139.238]
11 17 ms 17 ms 17 ms xe-5-3-0.cr1.lhr1.uk.nlayer.net [69.22.142.94]
12 92 ms 90 ms 91 ms xe-11-3-1.cr1.nyc3.us.nlayer.net [69.22.142.132]
13 90 ms 95 ms 98 ms ae2-70g.cr1.ewr1.us.nlayer.net [69.31.95.145]
14 110 ms 110 ms 110 ms xe-5-0-0.cr1.ord1.us.nlayer.net [69.22.142.74]
15 169 ms 210 ms 163 ms xe-0-0-0.cr1.slc1.us.nlayer.net [69.22.142.102]
16 162 ms 162 ms 162 ms xe-2-3-1.cr1.sfo1.us.nlayer.net [69.22.142.97]
17 163 ms 162 ms 162 ms as40475.ge-0-2-1.cr1.sfo1.us.nlayer.net [69.22.153.90]
18 169 ms 164 ms 164 ms ge-0-1-0.ro4.sjc01 [208.83.220.46]
19 164 ms 163 ms 336 ms ge-0-0.cal-cr-0.srstubes.net [74.116.251.2]
20 188 ms 187 ms 187 ms ge-0-4.sth3-core-1.srstubes.net [194.68.0.194]
21 186 ms 185 ms 188 ms ge-1-2.sth4-dr-1.srstubes.net [194.68.0.166]
22 185 ms 185 ms 185 ms ge-0-1.moria-cr-1.piratpartiet.net [194.68.0.146]
23 188 ms 187 ms 188 ms thepiratebay.piratpartiet.se [194.14.56.2]
Probably just a coincidence that the most popular website hosted by AppliedOps is causes.com:
Sean Parker Founder and Chairman
Sean Parker, Chairman and Founder of Causes, is an entrepreneur with a record of launching genre-defining companies that reinvent ways to spread information online. In 1999, at the age of 19, Sean co-founded Napster with Shawn Fanning and changed how people think about and share music. In 2001, Sean co-founded Plaxo, pioneering viral engineering technology for updating contact information. Sean served as Plaxo’s president until 2004, around which time he joined with Mark Zuckerberg to launch the online social network Facebook. Sean was the founding president of Facebook from 2004-2005, again turning a technology start-up into an industry giant. Sean is also a Managing Partner of venture capital firm Founders Fund, where he looks for and supports this spirit of innovation in up-and-coming developers.
http://www.causes.com/team
What’s worse:
It looks like one of the switches at AMS-IX is very very close (ahum) to the relay over the ocean and ONLY for the piratepay blocks. Now, that would be really unacceptable if they are cooperating with these kind of activities. There’s also a timing missmatch, btw. Plz confirm.
It looks like the problem is with PORTLANE AS42708 not advertising 194.71.107.0/24 anymore. They should because SRSTUBES AS50066 is announcing it to them. Why is Portlane blocking thepiratebay.org address range? Maybe it has to do with this court case.
So, basically, while thepiratebay.org website still seems to be hosted in Sweden, their only local (2nd tier) uplink provider Port Lane is not announcing their IP block. So the only option to get to their site is via the USA route APPLIEDOPS AS40475 is offering.
I’m using Opera on my Ziggo account with turbo enabled.
No PirateBay block here. 🙂