ISP and Router Vendor Security Related Offering, DNS and Firewall for Security

firesong

firesong

Supremacy Member
Deluxe Member
Joined
Jan 17, 2001
Messages
8,604
Reaction score
4,588
ksw2010 said:
Tested from my BB somewhere in Jurong to ControlD looks not so bad, most likely the peering with their courterpath in HKG that latency is ~35-40ms. I dont think we can feel slowness by ocular with this latency unless compare the ping latency value.

C:\Users\>tracert controld.com

Tracing route to controld.com [147.185.34.1]
over a maximum of 30 hops:

1 1 ms <1 ms <1 ms 192.168.1.254
2 1 ms 1 ms 1 ms bb121-6-x-x.singnet.com.sg [121.6.x.x]
3 14 ms 1 ms 5 ms 165.21.193.234
4 2 ms 1 ms 1 ms 165.21.193.233
5 2 ms 3 ms 1 ms 165.21.139.169
6 2 ms 2 ms 2 ms 165.21.139.117
7 2 ms 1 ms 2 ms SN-SINQT1-BO403-ae1.singnet.com.sg [165.21.138.85]
8 35 ms 35 ms 35 ms ix-hge-0-0-0-9.ecore2.svq-singapore.as6453.net [180.87.98.85]
9 36 ms 36 ms * if-be-10-2.ecore2.esin4-singapore.as6453.net [180.87.107.1]
10 3 ms 2 ms 2 ms 180.87.108.163
11 3 ms 2 ms 2 ms ae-4.r22.sngpsi07.sg.bb.gin.ntt.net [129.250.5.61]
12 4 ms 2 ms 2 ms ae-0.a01.sngpsi07.sg.bb.gin.ntt.net [129.250.2.122]
13 * * * Request timed out.
14 * * * Request timed out.
15 38 ms 38 ms 38 ms controld-edge1-sin.anycast.net [43.245.49.200]
16 37 ms 36 ms 36 ms controld.com [147.185.34.1]

Trace complete.

C:\Users\>ping controld.com

Pinging controld.com [147.185.34.1] with 32 bytes of data:
Reply from 147.185.34.1: bytes=32 time=36ms TTL=49
Reply from 147.185.34.1: bytes=32 time=36ms TTL=49
Reply from 147.185.34.1: bytes=32 time=36ms TTL=49
Reply from 147.185.34.1: bytes=32 time=36ms TTL=49

Ping statistics for 147.185.34.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 36ms, Maximum = 36ms, Average = 36ms
Click to expand...
Might need to trace to the actual DNS servers rather than the website.

I had them on Smokeping, so I recall the dns roundtrip time was quite bad. If your DNS caching is aggressive, or if you always have to look up cos you access multiple new addresses, the whole internet experience will be quite bad.

ControlD for StarHub now is 4ms, which is a great timing. It's on par with Cloudflare for me.

1694745577776.png
 
X

xiaofan

High Supremacy Member
HWZ Insider
Joined
Sep 16, 2018
Messages
30,133
Reaction score
8,218
firesong said:
Might need to trace to the actual DNS servers rather than the website.

I had them on Smokeping, so I recall the dns roundtrip time was quite bad. If your DNS caching is aggressive, or if you always have to look up cos you access multiple new addresses, the whole internet experience will be quite bad.

ControlD for StarHub now is 4ms, which is a great timing. It's on par with Cloudflare for me.

View attachment 42114
Click to expand...

Indeed it is even worse when using mtr to family.freedns.controld.com.

Code: 
                                    My traceroute  [v0.93]
ubuntuct1 (192.168.50.5)                                                2023-09-15T10:55:34+0800
Keys:  Help   Display mode   Restart statistics   Order of fields   quit
                                                        Packets               Pings
 Host                                                 Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. 192.168.50.1                                       0.0%    25    0.8   0.8   0.7   1.1   0.1
 2. bb121-6-xx-254.singnet.com.sg                      0.0%    25    5.2   6.5   3.1  13.9   3.2
 3. 165.21.193.22                                      0.0%    25    3.1   3.9   2.8   8.7   1.5
 4. 165.21.193.21                                     28.0%    25    6.9   4.8   2.7  21.2   4.6
 5. 165.21.138.245                                     4.0%    25    3.0   5.8   2.8  22.6   4.8
 6. SN-SINQT1-BO403-ae1.singnet.com.sg                 0.0%    25    2.9   3.1   2.8   3.5   0.2
 7. 203.208.177.213                                    0.0%    25    3.1   3.5   2.9   5.2   0.5
 8. 203.208.149.25                                     0.0%    25    3.5   5.3   3.2  13.2   3.2
 9. 203.208.166.241                                    0.0%    25    3.8   4.9   3.2  21.1   3.6
10. 203.208.158.18                                     0.0%    25    3.4   3.8   3.2   9.9   1.3
11. 203.208.172.214                                    0.0%    25    3.3   3.5   3.1   4.4   0.3
12. xn-lhrcl1-bo706.ix.singtel.com                     0.0%    24    3.7   3.9   3.6   5.0   0.4
13. 203.208.171.229                                    0.0%    24   37.5  37.6  37.0  40.8   0.8
14. 203.208.154.14                                     0.0%    24   38.4  38.6  38.2  40.1   0.5
15. 63-217-237-125.static.pccwglobal.net               0.0%    24   39.1  39.0  38.6  39.2   0.2
16. hundredge0-5-0-1.br02.tok02.pccwbtn.net            0.0%    24   87.6  87.5  87.3  88.2   0.2
17. (waiting for reply)
18. (waiting for reply)
19. controld-edge2-tyo.anycast.net                     0.0%    24   85.1  85.0  84.9  85.3   0.1
20. freedns.controld.com                               0.0%    24   87.2  87.3  86.9  87.7   0.2

mtr to family.cloudflare-dns.com
Code: 
                                     My traceroute  [v0.93]
ubuntuct1 (192.168.50.5)                                                2023-09-15T10:59:42+0800
Keys:  Help   Display mode   Restart statistics   Order of fields   quit
                                                        Packets               Pings
 Host                                                 Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. 192.168.50.1                                       0.0%    10    0.7   0.7   0.6   0.8   0.1
 2. bb121-6-xx-254.singnet.com.sg                      0.0%    10    3.2   3.5   2.8   8.5   1.7
 3. 165.21.193.22                                      0.0%    10    3.6   3.5   3.3   3.9   0.2
 4. 165.21.193.21                                      0.0%    10    3.3   6.2   2.9  13.2   3.7
 5. 165.21.138.245                                     0.0%    10    3.3   3.8   2.8   8.5   1.7
 6. SN-SINQT1-BO403-ae1.singnet.com.sg                 0.0%    10    3.5   4.5   3.0  15.4   3.8
 7. ip-202-147-32-136.asianetcom.net                   0.0%    10   36.9  37.0  36.6  37.8   0.3
 8. unknown.telstraglobal.net                          0.0%    10   36.3  40.9  36.3  64.6   8.8
 9. 162.158.104.5                                      0.0%    10   38.7  38.6  36.7  51.7   4.7
10. 1.1.1.3                                            0.0%     9   38.2  38.2  38.0  38.5   0.1

mtr to Google DNS (dns.google)
Code: 
                                     My traceroute  [v0.93]
ubuntuct1 (192.168.50.5)                                                2023-09-15T11:01:36+0800
Keys:  Help   Display mode   Restart statistics   Order of fields   quit
                                                        Packets               Pings
 Host                                                 Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. 192.168.50.1                                       0.0%    31    0.9   0.8   0.7   0.9   0.1
 2. bb121-6-95-254.singnet.com.sg                      0.0%    30    2.7   4.6   2.7  44.9   7.6
 3. 165.21.193.22                                     10.3%    30   35.5  17.6   3.2  40.6  12.9
 4. 165.21.193.21                                      0.0%    30    3.0   4.7   2.8  13.8   3.0
 5. 165.21.138.245                                     3.3%    30    3.1   8.2   3.0  29.6   7.8
 6. SN-SINQT1-BO403-ae1.singnet.com.sg                 0.0%    30    3.1   4.5   2.9  21.7   4.4
 7. 203.208.177.213                                    0.0%    30    3.4   4.3   3.1  18.8   3.1
 8. 203.208.154.57                                     0.0%    30   13.1   8.4   3.2  27.1   7.3
 9. 72.14.210.137                                      0.0%    30    3.5   3.4   3.2   3.6   0.1
10. 142.250.56.51                                      0.0%    30    5.0   5.0   4.5   5.7   0.2
11. 142.251.52.49                                      0.0%    30    3.8   3.8   3.6   4.0   0.1
12. dns.google                                         0.0%    30    3.8   3.8   3.7   4.0   0.1
 
Last edited:
K

ksw2010

Member
Joined
Aug 28, 2010
Messages
298
Reaction score
47
firesong said:
Might need to trace to the actual DNS servers rather than the website.

I had them on Smokeping, so I recall the dns roundtrip time was quite bad. If your DNS caching is aggressive, or if you always have to look up cos you access multiple new addresses, the whole internet experience will be quite bad.

ControlD for StarHub now is 4ms, which is a great timing. It's on par with Cloudflare for me.

View attachment 42114
Click to expand...

Looks like ControlD is same with the website from my BB line ST. For Adguard: 94.140.14.14 seems the server located in Cyprus so not much different for all ISPs, OpenDNS is local so not see any difference.

tracert 76.76.2.4

Tracing route to p4.freedns.controld.com [76.76.2.4]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.1.254
2 22 ms 1 ms 1 ms bb121-6-x-x.singnet.com.sg [121.6.x.x]
3 2 ms 1 ms 1 ms 165.21.193.234
4 14 ms 1 ms 1 ms 165.21.193.233
5 2 ms 2 ms 2 ms 165.21.139.169
6 7 ms 4 ms 2 ms 165.21.139.117
7 2 ms 2 ms 5 ms SN-SINQT1-BO403-ae1.singnet.com.sg [165.21.138.85]
8 35 ms 35 ms 35 ms ix-hge-0-0-0-9.ecore2.svq-singapore.as6453.net [180.87.98.85]
9 37 ms 37 ms * if-be-10-2.ecore2.esin4-singapore.as6453.net [180.87.107.1]
10 3 ms 2 ms 2 ms 180.87.108.163
11 3 ms 4 ms 3 ms ae-5.r23.sngpsi07.sg.bb.gin.ntt.net [129.250.5.65]
12 4 ms 3 ms 8 ms ae-1.a01.sngpsi07.sg.bb.gin.ntt.net [129.250.2.240]
13 * * * Request timed out.
14 * * * Request timed out.
15 40 ms 39 ms 38 ms controld-edge1-sin.anycast.net [43.245.49.200]
16 39 ms 39 ms 39 ms p4.freedns.controld.com [76.76.2.4]

Trace complete.

tracert 76.76.10.4

Tracing route to s4.freedns.controld.com [76.76.10.4]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.1.254
2 2 ms 1 ms 1 ms bb121-6-x-x.singnet.com.sg [121.6.x.x]
3 * 2 ms 2 ms 165.21.193.234
4 2 ms 1 ms 1 ms 165.21.193.233
5 2 ms 2 ms 2 ms 165.21.139.169
6 14 ms 12 ms 4 ms 165.21.139.117
7 2 ms 2 ms 2 ms SN-SINQT1-BO403-ae1.singnet.com.sg [165.21.138.85]
8 35 ms 35 ms 35 ms ix-hge-0-0-0-9.ecore2.svq-singapore.as6453.net [180.87.98.85]
9 * * * Request timed out.
10 6 ms 7 ms 2 ms 180.87.108.163
11 3 ms 3 ms 3 ms ae-5.r23.sngpsi07.sg.bb.gin.ntt.net [129.250.5.65]
12 3 ms 3 ms 3 ms ae-1.a01.sngpsi07.sg.bb.gin.ntt.net [129.250.2.240]
13 * * * Request timed out.
14 * * * Request timed out.
15 38 ms 38 ms 38 ms controld-edge1-sin.anycast.net [43.245.49.200]
16 37 ms 37 ms 37 ms s4.freedns.controld.com [76.76.10.4]

Trace complete.
 
X

xiaofan

High Supremacy Member
HWZ Insider
Joined
Sep 16, 2018
Messages
30,133
Reaction score
8,218
ksw2010 said:
Looks like ControlD is same with the website from my BB line ST. For Adguard: 94.140.14.14 seems the server located in Cyprus so not much different for all ISPs, OpenDNS is similar.

tracert 76.76.2.4

Tracing route to p4.freedns.controld.com [76.76.2.4]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.1.254
2 22 ms 1 ms 1 ms bb121-6-x-x.singnet.com.sg [121.6.x.x]
3 2 ms 1 ms 1 ms 165.21.193.234
4 14 ms 1 ms 1 ms 165.21.193.233
5 2 ms 2 ms 2 ms 165.21.139.169
6 7 ms 4 ms 2 ms 165.21.139.117
7 2 ms 2 ms 5 ms SN-SINQT1-BO403-ae1.singnet.com.sg [165.21.138.85]
8 35 ms 35 ms 35 ms ix-hge-0-0-0-9.ecore2.svq-singapore.as6453.net [180.87.98.85]
9 37 ms 37 ms * if-be-10-2.ecore2.esin4-singapore.as6453.net [180.87.107.1]
10 3 ms 2 ms 2 ms 180.87.108.163
11 3 ms 4 ms 3 ms ae-5.r23.sngpsi07.sg.bb.gin.ntt.net [129.250.5.65]
12 4 ms 3 ms 8 ms ae-1.a01.sngpsi07.sg.bb.gin.ntt.net [129.250.2.240]
13 * * * Request timed out.
14 * * * Request timed out.
15 40 ms 39 ms 38 ms controld-edge1-sin.anycast.net [43.245.49.200]
16 39 ms 39 ms 39 ms p4.freedns.controld.com [76.76.2.4]

Trace complete.

tracert 76.76.10.4

Tracing route to s4.freedns.controld.com [76.76.10.4]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.1.254
2 2 ms 1 ms 1 ms bb121-6-x-x.singnet.com.sg [121.6.x.x]
3 * 2 ms 2 ms 165.21.193.234
4 2 ms 1 ms 1 ms 165.21.193.233
5 2 ms 2 ms 2 ms 165.21.139.169
6 14 ms 12 ms 4 ms 165.21.139.117
7 2 ms 2 ms 2 ms SN-SINQT1-BO403-ae1.singnet.com.sg [165.21.138.85]
8 35 ms 35 ms 35 ms ix-hge-0-0-0-9.ecore2.svq-singapore.as6453.net [180.87.98.85]
9 * * * Request timed out.
10 6 ms 7 ms 2 ms 180.87.108.163
11 3 ms 3 ms 3 ms ae-5.r23.sngpsi07.sg.bb.gin.ntt.net [129.250.5.65]
12 3 ms 3 ms 3 ms ae-1.a01.sngpsi07.sg.bb.gin.ntt.net [129.250.2.240]
13 * * * Request timed out.
14 * * * Request timed out.
15 38 ms 38 ms 38 ms controld-edge1-sin.anycast.net [43.245.49.200]
16 37 ms 37 ms 37 ms s4.freedns.controld.com [76.76.10.4]

Trace complete.
Click to expand...

Same results here when using p4.freedns.controld.com. So different ControlD DNS servers may perform differently.

Code: 
                                     My traceroute  [v0.93]
ubuntuct1 (192.168.50.5)                                                2023-09-15T11:08:47+0800
Keys:  Help   Display mode   Restart statistics   Order of fields   quit
                                                        Packets               Pings
 Host                                                 Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. 192.168.50.1                                       3.3%    30    0.8   0.8   0.7   1.0   0.1
 2. bb121-6-95-254.singnet.com.sg                      0.0%    30    3.4   8.3   3.3  56.6  10.7
 3. 165.21.193.22                                      0.0%    30    3.3   3.5   2.9   9.6   1.2
 4. 165.21.193.21                                      0.0%    30    5.8   4.3   2.5  16.1   3.0
 5. 165.21.138.245                                     0.0%    30    2.9   4.2   2.9  15.2   3.0
 6. SN-SINQT1-BO403-ae1.singnet.com.sg                 0.0%    30    2.9   3.1   2.7   4.1   0.3
 7. ix-hge-0-0-0-9.ecore2.svq-singapore.as6453.net     0.0%    30   38.7  38.6  38.4  39.0   0.1
 8. if-be-10-2.ecore2.esin4-singapore.as6453.net      89.7%    30   37.2  37.4  37.2  37.6   0.2
 9. 180.87.108.163                                     0.0%    30    3.6   3.7   3.4   4.7   0.2
10. ae-5.r23.sngpsi07.sg.bb.gin.ntt.net               96.6%    30    4.9   4.9   4.9   4.9   0.0
11. ae-1.a01.sngpsi07.sg.bb.gin.ntt.net                0.0%    30    3.9   4.9   3.6  18.1   3.0
12. (waiting for reply)
13. (waiting for reply)
14. controld-edge1-sin.anycast.net                     0.0%    29   44.5  44.6  44.0  47.0   0.5
15. freedns.controld.com                               0.0%    29   40.0  40.3  39.9  42.1   0.5
 
X

xiaofan

High Supremacy Member
HWZ Insider
Joined
Sep 16, 2018
Messages
30,133
Reaction score
8,218
Nice video from Lawrence Systems Youtube channel, he recommends Quad9.

You can use similar method to check your DNS server, including Pi-hole and Adguard Home.

Website link:
https://forums.lawrencesystems.com/...nextdns-and-adguard-dns-youtube-release/18910

Video:

(using NextDNS without account)


(update for NextDNS with account)

Bash script -- you can adapt to test the DNS server you are interested.
Code: 
#!/bin/bash                                                                                                                                                                                                
# Bulk DNS Lookup                                                                                                                                                                                          
# Generates a CSV of DNS lookups from a list of domains.
#
# File name/path of domain list:
domain_list='domains.txt' # One FQDN per line in file.
#
# IP address of the nameserver used for lookups:
ns1_ip='1.1.1.1' # Cloudflare
ns2_ip='9.9.9.9' # Quad9
ns3_ip='1.1.1.2' # Cloudflare Malware
ns4_ip='45.90.28.131' # NextDNS Free
ns5_ip='94.140.14.14' # Adguard Free
#
# Seconds to wait between lookups:
loop_wait='1' # Is set to 1 second.
 
echo "Domain name, $ns1_ip,$ns2_ip,$ns3_ip,$ns4_ip,$ns5_ip "; # Start CSV
for domain in `cat $domain_list` # Start looping through domains
do
    ip1=`dig @$ns1_ip +short $domain |tail -n1`; # IP address lookup DNS Server1
    ip2=`dig @$ns2_ip +short $domain |tail -n1`; # IP address lookup DNS server2
    ip3=`dig @$ns3_ip +short $domain |tail -n1`; # IP address lookup DNS server3
    ip4=`dig @$ns4_ip +short $domain |tail -n1`; # IP address lookup DNS server4
    ip5=`dig @$ns5_ip +short $domain |tail -n1`; # IP address lookup DNS server5
            echo -en "$domain,$ip1,$ip2,$ip3,$ip4,$ip5\n";
#    sleep $loop_wait # Pause before the next lookup to avoid flooding NS
done;

domain list generation:
1) First to download the file from Zonefiles
https://zonefiles.io/compromised-domain-list/ (this list is free)

2) sanitize the domain list file
Code: 
grep -E '^[a-zA-Z0-9-]+\.(com|net)$' compromised_domains_live.txt > domains.txt

domain list generation: other free methods.
Generate your own list using the free list out there.
 
Last edited:
X

xiaofan

High Supremacy Member
HWZ Insider
Joined
Sep 16, 2018
Messages
30,133
Reaction score
8,218
More info about Asus AIProtection Pro

Asus AIprotection:
https://www.asus.com/sg/content/aiprotection/
https://www.asus.com/sg/support/faq/1012070/

731e0919-a641-4691-b1cf-4a9a89b022cb.jpg


04d459e7-307e-4fa1-a331-055c372db1a1.jpg


Testing:
 
X

xiaofan

High Supremacy Member
HWZ Insider
Joined
Sep 16, 2018
Messages
30,133
Reaction score
8,218
Earlier discussions:
https://forums.hardwarezone.com.sg/...w-home-routers-comes-next-april-2021.6394786/

Singapore Cyber Security Labeling schemes
https://www.csa.gov.sg/our-programm...elling-schemes/cybersecurity-labelling-scheme

Level 4 consumer routers:

Singtel WG660242-ST WiFi 6 router
Singtel RT5703W-D171 WiFi 6 router
Singtel WE620242-ST Mesh Extender
Singtel AP5690W-D171 Mesh Extender
Asus RT-AX82U
Asus TUF-AX5400
Asus TUF-AX3000
Asus ZenWiFi XD6
Asus RT-AX58U
Asus RT-AX88U
Asus ROG GT-AX11000
Googel Nest WiFi
 
B

bert64

Senior Member
Joined
Jan 20, 2020
Messages
1,025
Reaction score
535
firesong said:
Might need to trace to the actual DNS servers rather than the website.

I had them on Smokeping, so I recall the dns roundtrip time was quite bad. If your DNS caching is aggressive, or if you always have to look up cos you access multiple new addresses, the whole internet experience will be quite bad.

ControlD for StarHub now is 4ms, which is a great timing. It's on par with Cloudflare for me.

View attachment 42114
Click to expand...
All of these DNS resolvers also have IPv6, have you compared latency to the v6 addresses?
For instance from here to google:

$ ping -c 3 dns.google PING dns.google (2001:4860:4860::8888) 56 data bytes 64 bytes from dns.google (2001:4860:4860::8888): icmp_seq=1 ttl=118 time=2.96 ms 64 bytes from dns.google (2001:4860:4860::8888): icmp_seq=2 ttl=118 time=2.94 ms 64 bytes from dns.google (2001:4860:4860::8888): icmp_seq=3 ttl=118 time=2.99 ms --- dns.google ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 2.939/2.964/2.994/0.022 ms $ ping -4 -c 3 dns.google PING dns.google (8.8.4.4) 56(84) bytes of data. 64 bytes from dns.google (8.8.4.4): icmp_seq=1 ttl=110 time=16.8 ms 64 bytes from dns.google (8.8.4.4): icmp_seq=2 ttl=110 time=16.8 ms 64 bytes from dns.google (8.8.4.4): icmp_seq=3 ttl=110 time=16.8 ms --- dns.google ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 16.775/16.809/16.841/0.027 ms
 
B

bert64

Senior Member
Joined
Jan 20, 2020
Messages
1,025
Reaction score
535
xiaofan said:
More info about Asus AIProtection Pro

Asus AIprotection:
https://www.asus.com/sg/content/aiprotection/
https://www.asus.com/sg/support/faq/1012070/

731e0919-a641-4691-b1cf-4a9a89b022cb.jpg


04d459e7-307e-4fa1-a331-055c372db1a1.jpg


Testing:
Click to expand...


Domain classification is common on corporate networks and has been for many years... They also tend to block classifications such as "gambling" and "porn" etc.
It's of little practical use from a security standpoint because there are many ways to bypass it. Don't let it lure you into a false sense of security:
  • Compromised but otherwise legitimate sites are often used to host malware.
  • Domains don't lose their classification when they expire, you can re-register an expired domain and inherit its classification.
  • Organised groups will farm domains - eg register a domain and host a legitimate looking site for a few months so it receives a classification.
  • There are many shared domains where users can host arbitrary content - eg azure webhosting, cloudfront, amazonaws.com, akamai etc.
  • There are plenty of legitimate services which are used to host various forms of malicious content - eg pastebin, github etc.
  • Malware can bypass DNS and connect directly to an IP.
  • Malware can try to bypass your system DNS resolvers and directly use public ones.
  • By the time a domain has been classified as malicious, the attackers have already finished their campaign and moved on to a new one.
  • Malware can use domain fronting.
DNS filtering like this is more useful for ad blocking really. If you want to make a dent in malicious traffic you'd need to block outbound by default and force everything through an ssl intercepting proxy - most users wouldn't put up with the overhead or inconvenience caused by this.
 
Mach3.2

Mach3.2

Great Supremacy Member
HWZ Insider
Joined
Apr 8, 2011
Messages
72,402
Reaction score
2,458
bert64 said:
All of these DNS resolvers also have IPv6, have you compared latency to the v6 addresses?
Click to expand...
About the same for Google and Cloudflare DNS.

Bash: 
mtr -w -c 20 -b -i 1 2001:4860:4860::8888
Start: 2024-06-06T20:24:45+0800
HOST: pfSense                                          Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- 0.0.4.7.1.0.4.2.ip6.arpa (2401:7400:c000:3::)   0.0%    20    2.6   2.8   1.9  10.4   1.8
  2.|-- 0.0.4.7.1.0.4.2.ip6.arpa (2401:7400:800:2a::)   0.0%    20    2.6   4.8   2.2  22.3   4.7
  3.|-- 0.0.4.7.1.0.4.2.ip6.arpa (2401:7400:800:2a::1)  0.0%    20    2.8   3.6   2.2  15.6   2.9
  4.|-- 2401:7400:0:8::1                                0.0%    20    3.2   7.2   3.1  22.5   5.9
  5.|-- 2001:4860:1:1::1a4c                             0.0%    20    3.4   3.3   2.9   3.7   0.2
  6.|-- 2404:6800:80e6::1                               0.0%    20    2.4   2.9   2.4   3.2   0.3
  7.|-- dns.google (2001:4860:4860::8888)               0.0%    20    3.1   2.9   2.4   3.3   0.2

mtr -w -c 20 -b -i 1 8.8.8.8
Start: 2024-06-06T20:25:26+0800
HOST: pfSense                                             Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- 1.192.199.112.unknown.m1.com.sg (112.199.192.1)    0.0%    20    2.6   2.5   1.6   2.7   0.2
  2.|-- 204.246.65.202.unknown.m1.com.sg (202.65.246.204)  0.0%    20    3.7   4.5   1.7  11.9   3.8
  3.|-- 205.246.65.202.unknown.m1.com.sg (202.65.246.205)  0.0%    20    2.2   2.8   1.7   7.0   1.4
  4.|-- 159.245.65.202.unknown.m1.com.sg (202.65.245.159)  0.0%    20    2.7   6.3   2.0  18.2   6.1
  5.|-- 72.14.222.186                                      0.0%    20    2.9   2.8   2.4   3.2   0.2
  6.|-- 142.250.56.83                                      0.0%    20    2.7   2.8   2.1   3.4   0.3
  7.|-- 72.14.232.101                                      0.0%    20    3.2   3.4   3.0   3.9   0.3
  8.|-- dns.google (8.8.8.8)                               0.0%    20    2.4   2.6   2.2   2.9   0.2
Bash: 
mtr -w -c 20 -b -i 1 1.1.1.1
Start: 2024-06-06T20:29:11+0800
HOST: pfSense                                             Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- 1.192.199.112.unknown.m1.com.sg (112.199.192.1)    0.0%    20    2.0   2.9   2.0   9.5   1.6
  2.|-- 204.246.65.202.unknown.m1.com.sg (202.65.246.204)  0.0%    20    2.6   2.8   2.1   6.7   1.0
  3.|-- 205.246.65.202.unknown.m1.com.sg (202.65.246.205)  0.0%    20    2.4   2.8   1.6   7.7   1.3
  4.|-- 37.246.65.202.unknown.m1.com.sg (202.65.246.37)    0.0%    20    3.4   3.4   2.8   4.5   0.5
  5.|-- 134.246.65.202.unknown.m1.com.sg (202.65.246.134)  0.0%    20    2.7   3.3   2.3  10.6   1.7
  6.|-- 162.158.160.220                                    0.0%    20    3.9   8.3   3.5  27.6   6.8
  7.|-- 162.158.160.165                                   85.0%    20    3.2   3.5   3.2   3.8   0.3
  8.|-- one.one.one.one (1.1.1.1)                          0.0%    20    3.0   3.2   2.5   3.5   0.2

mtr -w -c 20 -b -i 1 2606:4700:4700::1111
Start: 2024-06-06T20:29:41+0800
HOST: pfSense                                          Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- 0.0.4.7.1.0.4.2.ip6.arpa (2401:7400:c000:3::)   0.0%    20    2.8   3.1   1.9   7.0   1.5
  2.|-- 0.0.4.7.1.0.4.2.ip6.arpa (2401:7400:800:2a::)   0.0%    20    2.3   3.4   1.6  12.2   2.9
  3.|-- 0.0.4.7.1.0.4.2.ip6.arpa (2401:7400:800:2a::1)  0.0%    20    3.0   3.6   2.5  14.8   2.7
  4.|-- 2401:7400:0:1::                                 0.0%    20    3.0   3.6   2.5  11.7   2.1
  5.|-- 2401:7400:0:6::1                                0.0%    20    2.6   3.1   2.6   3.4   0.2
  6.|-- 2400:cb00:35:200::194                           0.0%    20    7.6  10.6   3.3  36.4  10.9
  7.|-- 2400:cb00:497:3::                               0.0%    20   10.0   8.4   2.7  37.7   8.4
  8.|-- one.one.one.one (2606:4700:4700::1111)          0.0%    20    3.1   3.2   2.5   3.5   0.2
 
X

xiaofan

High Supremacy Member
HWZ Insider
Joined
Sep 16, 2018
Messages
30,133
Reaction score
8,218
Last edited:
X

xiaofan

High Supremacy Member
HWZ Insider
Joined
Sep 16, 2018
Messages
30,133
Reaction score
8,218
IPv6 vs IPv4 for Google DNS, no differences for Singtel (native IPv6).

Bash: 
PS C:\work\speedtest> ping dns.google.com

Pinging dns.google.com [2001:4860:4860::8888] with 32 bytes of data:
Reply from 2001:4860:4860::8888: time=4ms
Reply from 2001:4860:4860::8888: time=4ms
Reply from 2001:4860:4860::8888: time=6ms
Reply from 2001:4860:4860::8888: time=6ms

Ping statistics for 2001:4860:4860::8888:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 4ms, Maximum = 6ms, Average = 5ms

PS C:\work\speedtest> ping -4 dns.google.com

Pinging dns.google.com [8.8.4.4] with 32 bytes of data:
Reply from 8.8.4.4: bytes=32 time=3ms TTL=114
Reply from 8.8.4.4: bytes=32 time=4ms TTL=114
Reply from 8.8.4.4: bytes=32 time=4ms TTL=114
Reply from 8.8.4.4: bytes=32 time=6ms TTL=114

Ping statistics for 8.8.4.4:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 3ms, Maximum = 6ms, Average = 4ms
 
X

xiaofan

High Supremacy Member
HWZ Insider
Joined
Sep 16, 2018
Messages
30,133
Reaction score
8,218
IPv6 is also much worse with Cloudflare family DNS (1.1.1.2 and 1.1.1.3). I believe this is a specific issue for Singtel. M1/Starhub should be fine.
https://blog.cloudflare.com/introducing-1-1-1-1-for-families

1) 1.1.1.3 Malware and Adult Content blocking
Bash: 
PS C:\work\speedtest> ping -6 family.cloudflare-dns.com

Pinging family.cloudflare-dns.com [2606:4700:4700::1113] with 32 bytes of data:
Reply from 2606:4700:4700::1113: time=193ms
Reply from 2606:4700:4700::1113: time=261ms
Reply from 2606:4700:4700::1113: time=268ms
Request timed out.

Ping statistics for 2606:4700:4700::1113:
    Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
    Minimum = 193ms, Maximum = 268ms, Average = 240ms

PS C:\work\speedtest> ping -4 family.cloudflare-dns.com

Pinging family.cloudflare-dns.com [1.0.0.3] with 32 bytes of data:
Reply from 1.0.0.3: bytes=32 time=4ms TTL=54
Reply from 1.0.0.3: bytes=32 time=6ms TTL=54
Reply from 1.0.0.3: bytes=32 time=6ms TTL=54
Reply from 1.0.0.3: bytes=32 time=6ms TTL=54

Ping statistics for 1.0.0.3:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 4ms, Maximum = 6ms, Average = 5ms

2) 1.1.1.2 Malware Blocking Only
Bash: 
PS C:\work\speedtest> ping 1.1.1.2

Pinging 1.1.1.2 with 32 bytes of data:
Reply from 1.1.1.2: bytes=32 time=4ms TTL=54
Reply from 1.1.1.2: bytes=32 time=4ms TTL=54
Reply from 1.1.1.2: bytes=32 time=4ms TTL=54
Reply from 1.1.1.2: bytes=32 time=7ms TTL=54

Ping statistics for 1.1.1.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 4ms, Maximum = 7ms, Average = 4ms
PS C:\work\speedtest> ping 2606:4700:4700::1112

Pinging 2606:4700:4700::1112 with 32 bytes of data:
Reply from 2606:4700:4700::1112: time=240ms
Reply from 2606:4700:4700::1112: time=248ms
Reply from 2606:4700:4700::1112: time=191ms
Reply from 2606:4700:4700::1112: time=267ms

Ping statistics for 2606:4700:4700::1112:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 191ms, Maximum = 267ms, Average = 236ms
 
Last edited:
X

xiaofan

High Supremacy Member
HWZ Insider
Joined
Sep 16, 2018
Messages
30,133
Reaction score
8,218
No issues with Quad9 -- no difference between IPv6 and IPv4.

Bash: 
PS C:\work\speedtest> ping 9.9.9.9

Pinging 9.9.9.9 with 32 bytes of data:
Reply from 9.9.9.9: bytes=32 time=3ms TTL=54
Reply from 9.9.9.9: bytes=32 time=5ms TTL=54
Reply from 9.9.9.9: bytes=32 time=6ms TTL=54
Reply from 9.9.9.9: bytes=32 time=4ms TTL=54

Ping statistics for 9.9.9.9:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 3ms, Maximum = 6ms, Average = 4ms

PS C:\work\speedtest> ping 2620:fe::fe

Pinging 2620:fe::fe with 32 bytes of data:
Reply from 2620:fe::fe: time=5ms
Reply from 2620:fe::fe: time=5ms
Reply from 2620:fe::fe: time=4ms
Reply from 2620:fe::fe: time=4ms

Ping statistics for 2620:fe::fe:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 4ms, Maximum = 5ms, Average = 4ms
 
X

xiaofan

High Supremacy Member
HWZ Insider
Joined
Sep 16, 2018
Messages
30,133
Reaction score
8,218
OpenDNS only has IPv4 for FamilyShield. No issues for Singtel as the latency is good.
https://www.opendns.com/setupguide/#familyshield

Bash: 
PS C:\work\speedtest> ping 208.67.222.123

Pinging 208.67.222.123 with 32 bytes of data:
Reply from 208.67.222.123: bytes=32 time=5ms TTL=54
Reply from 208.67.222.123: bytes=32 time=4ms TTL=54
Reply from 208.67.222.123: bytes=32 time=3ms TTL=54
Reply from 208.67.222.123: bytes=32 time=4ms TTL=54

Ping statistics for 208.67.222.123:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 3ms, Maximum = 5ms, Average = 4ms
PS C:\work\speedtest> ping 208.67.220.123

Pinging 208.67.220.123 with 32 bytes of data:
Reply from 208.67.220.123: bytes=32 time=5ms TTL=54
Reply from 208.67.220.123: bytes=32 time=5ms TTL=54
Reply from 208.67.220.123: bytes=32 time=6ms TTL=54
Reply from 208.67.220.123: bytes=32 time=6ms TTL=54

Ping statistics for 208.67.220.123:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 5ms, Maximum = 6ms, Average = 5ms
 
X

xiaofan

High Supremacy Member
HWZ Insider
Joined
Sep 16, 2018
Messages
30,133
Reaction score
8,218
For Adgurad public DNS, Singtel IPv6 is also much worst than IPv4.

Bash: 
PS C:\work\speedtest> ping -4 dns.adguard-dns.com

Pinging dns.adguard-dns.com [94.140.15.15] with 32 bytes of data:
Reply from 94.140.15.15: bytes=32 time=80ms TTL=54
Reply from 94.140.15.15: bytes=32 time=79ms TTL=54
Reply from 94.140.15.15: bytes=32 time=80ms TTL=54
Reply from 94.140.15.15: bytes=32 time=82ms TTL=54

Ping statistics for 94.140.15.15:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 79ms, Maximum = 82ms, Average = 80ms
PS C:\work\speedtest> ping -6 dns.adguard-dns.com

Pinging dns.adguard-dns.com [2a10:50c0::ad1:ff] with 32 bytes of data:
Reply from 2a10:50c0::ad1:ff: time=337ms
Reply from 2a10:50c0::ad1:ff: time=343ms
Reply from 2a10:50c0::ad1:ff: time=309ms
Reply from 2a10:50c0::ad1:ff: time=346ms

Ping statistics for 2a10:50c0::ad1:ff:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 309ms, Maximum = 346ms, Average = 333ms
 
FinalTidus

FinalTidus

High Supremacy Member
Joined
Dec 8, 2004
Messages
35,062
Reaction score
1,154
Hi guys.

I am on Whizzcomms. Which dns should I use to have best performance and high level of security?
 
You must log in or register to reply here.
Important Forum Advisory Note
This forum is moderated by volunteer moderators who will react only to members' feedback on posts. Moderators are not employees or representatives of HWZ. Forum members and moderators are responsible for their own posts.

Please refer to our Community Guidelines and Standards, Terms of Service and Member T&Cs for more information.
Top