Google going Double Dutch ?

Discussion in 'Internet, Connectivity and Communications' started by Jakamoko, Aug 26, 2005.

  1. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    OK, maybe it's just me, but ....

    I just opened Google in IE - and I get the DUTCH site -http://www.google.nl/ :blink

    Open it in Firefox (default browser, Google set to homepage) - Google UK comes up.

    Back to IE, check Internet Options - yup, set to use http://www.google.com/, yet still it's Dutch.

    WTF ?????????? :eek:
     
    Certifications: MCP, A+, Network+
    WIP: Clarity
  2. tripwire45
    Honorary Member

    tripwire45 Zettabyte Poster

    13,493
    180
    287
    No problems here in the U.S. It's www.google.com in both Firefox and IE here.
     
    Certifications: A+ and Network+
  3. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    Reply to a ping of www.google.com:
    Code:
    Microsoft Windows XP [Version 5.1.2600]
    (C) Copyright 1985-2001 Microsoft Corp.
    
    C:\Documents and Settings\Gavin>ping www.google.com
    
    Pinging www.l.google.com [216.239.59.103] with 32 bytes of data:
    
    Reply from 216.239.59.103: bytes=32 time=72ms TTL=240
    Reply from 216.239.59.103: bytes=32 time=67ms TTL=240
    Reply from 216.239.59.103: bytes=32 time=61ms TTL=240
    Reply from 216.239.59.103: bytes=32 time=66ms TTL=240
    
    Ping statistics for 216.239.59.103:
    	Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
    	Minimum = 61ms, Maximum = 72ms, Average = 66ms
    Do you get the same, Trip ?


    EDIT:

    Also, a trace route:

    Code:
    08/26/05 21:16:02 Fast traceroute www.google.com
    Trace www.google.com (216.239.59.103) ...
     1 212.74.111.150   36ms   45ms   31ms  TTL:  0  (lo0.lns-26.fm4.milt.as9105.net ok)
     2 80.40.255.193	41ms   48ms   33ms  TTL:  0  (vlan31.switch4-mk.as9105.net probable bogus rDNS: No DNS)
     3 212.74.108.54	41ms   37ms   37ms  TTL:  0  (ge1-2-2.mk0.as9105.net ok)
     4 212.74.108.10	46ms   40ms   41ms  TTL:  0  (pos3-0.lon10.as9105.net ok)
     5 213.200.77.73	54ms   30ms   41ms  TTL:  0  (so-5-0-0.lon12.ip.tiscali.net probable bogus rDNS: No DNS)
    6 213.200.78.34	46ms 32ms 32ms TTL: 0 (gi14-0-997.loncr3.London.opentransit.net probable bogus rDNS: No DNS)
     7 193.251.249.82   56ms   57ms  129ms  TTL:  0  (google-1.GW.opentransit.net ok)
     8 216.239.46.173   54ms   55ms   61ms  TTL:  0  (No rDNS)
     9 216.239.49.254   62ms   70ms   63ms  TTL:  0  (No rDNS)
    10 216.239.49.114   66ms   62ms   65ms  TTL:  0  (No rDNS)
    11 216.239.59.103 68ms 65ms 69ms TTL:240 (No rDNS)												 
       
     
    Certifications: MCP, A+, Network+
    WIP: Clarity
  4. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    For those who doubt:

    [​IMG]



    [​IMG]
     
    Certifications: MCP, A+, Network+
    WIP: Clarity
  5. tripwire45
    Honorary Member

    tripwire45 Zettabyte Poster

    13,493
    180
    287
    Different results. Here's ping:
    Code:
    Microsoft Windows XP [Version 5.1.2600]
    (C) Copyright 1985-2001 Microsoft Corp.
    
    C:\Documents and Settings\JMPYLES>ping www.google.com
    
    Pinging www.l.google.com [66.102.7.99] with 32 bytes of data:
    
    Reply from 66.102.7.99: bytes=32 time=29ms TTL=242
    Reply from 66.102.7.99: bytes=32 time=29ms TTL=242
    Reply from 66.102.7.99: bytes=32 time=29ms TTL=242
    Reply from 66.102.7.99: bytes=32 time=29ms TTL=242
    
    Ping statistics for 66.102.7.99:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 29ms, Maximum = 29ms, Average = 29ms
    
    C:\Documents and Settings\JMPYLES>
    And tracert:

    Code:
    Microsoft Windows XP [Version 5.1.2600]
    (C) Copyright 1985-2001 Microsoft Corp.
    
    C:\Documents and Settings\JMPYLES>tracert www.google.com
    
    Tracing route to www.l.google.com [66.102.7.104]
    over a maximum of 30 hops:
    
      1    <1 ms    <1 ms    <1 ms  192.168.1.1
      2    18 ms     3 ms    14 ms  s11-1-0-25--0.gw01.bois.eli.net [216.190.144.89]
    
      3     3 ms     3 ms     3 ms  srp2-0.cr01.bois.eli.net [208.186.20.193]
      4    12 ms    11 ms    12 ms  so-0-0-0--0.cr02.slkc.eli.net [207.173.114.66]
      5    12 ms    12 ms    12 ms  so-7-0-0--0.cr01.slkc.eli.net [207.173.115.241]
    
      6    24 ms    24 ms    24 ms  p10-0.cr01.rcrd.eli.net [207.173.114.9]
      7    25 ms    25 ms    25 ms  srp3-0.cr02.rcrd.eli.net [208.186.20.242]
      8    28 ms    28 ms    28 ms  p9-0.cr01.sntd.eli.net [207.173.114.57]
      9    28 ms    28 ms    29 ms  so-0-0-0--0.er01.plal.eli.net [207.173.114.138]
    
     10    52 ms    29 ms    29 ms  core2-1-1-0.pao.net.google.com [198.32.176.31]
     11    30 ms    29 ms    29 ms  66.249.94.14
     12    29 ms    29 ms    29 ms  216.239.47.146
     13    31 ms    31 ms    31 ms  216.239.49.150
     14    29 ms    29 ms    30 ms  66.102.7.104
    
    Trace complete.
    
    C:\Documents and Settings\JMPYLES>
    The only thing I can think of is that some root DNS server on your side of the pond hiccuped. :blink
     
    Certifications: A+ and Network+
  6. Weemez

    Weemez Kilobyte Poster

    372
    1
    0
    I'm getting the UK site Gav.
     
    Certifications: HNC Computing A+ N+ ICND1
    WIP: ICND2
  7. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    Yup - I suspect a seriously shagged DNS server somewhere here. Interestingly, we have been having some bizarre scenarios at work the last 3 days, where certain users with certain ISPs (predominantly Demon) haven't been able to "see" our network, and therefore think all their sites and services are down ...until you point them through a proxy to show them we are still alive.

    Doesn't answer my Google question though ....:blink
     
    Certifications: MCP, A+, Network+
    WIP: Clarity
  8. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    Kev, are you pointing at google.com or .co.uk ? Note, I'm specifically pointing at .com, but if I type .co.uk, it works fine.
     
    Certifications: MCP, A+, Network+
    WIP: Clarity
  9. Weemez

    Weemez Kilobyte Poster

    372
    1
    0
    I did both Gav, with the same results, both UK mate.
     
    Certifications: HNC Computing A+ N+ ICND1
    WIP: ICND2
  10. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    Hmm, if I go through a proxy (Anonymouse ) I get the UK site from the .com address, aka normal.

    Guess Tiscali's DNS maybe be playing up ?
     
    Certifications: MCP, A+, Network+
    WIP: Clarity
  11. ffreeloader

    ffreeloader Terabyte Poster

    3,661
    106
    167
    That would be my guess too. I'd flush the dns cache on your workstation, and if you have a dns server on your lan I'd flush the cache on it too. There is a vulnerability out there right now for any Windows dns server that forwards to a Bind server (9 I think). The Windows dns server is vulnerable to being poisoned through the Bind server. I'm not sure of how it works as I haven't read up on it, but know it's out there.

    I had this problem not too long ago. I was having problems with my ISP's DNS servers being extremely slow so I pointed mine to liquidweb's dns servers and I started getting sent to some gay web site every time I tried to go to the cnet download site. It took me a while to figure out what was happening and to fix it. I had to flush everything from the dns servers on my lan, flush all the dns caches on my workstations, and point my dns servers back to another one of my ISP's dns servers to cure the problem.
     
    Certifications: MCSE, MCDBA, CCNA, A+
    WIP: LPIC 1
  12. ffreeloader

    ffreeloader Terabyte Poster

    3,661
    106
    167
    Oh, and I had to clear the browser cache too so it wouldn't just look in the cache for the page.
     
    Certifications: MCSE, MCDBA, CCNA, A+
    WIP: LPIC 1
  13. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    Cleared my own DNS before I even posted, Freddy, and not on a lan with a DNS server. Looks like IPS's DNS at this stage.

    Your post above was interesting - would that explain why I can get to Google through Firefox but not IE though ?

    EDIT: Checked the hosts file - fine. Running various scans now.
     
    Certifications: MCP, A+, Network+
    WIP: Clarity
  14. d-Faktor
    Honorary Member

    d-Faktor R.I.P - gone but never forgotten.

    810
    0
    39
    google provides localized content based on the originating ip address. if i use a french proxy, i get a french google, if i use a german proxy, i get a german google. (provided i haven't defined my google preferences in a cookie).
    using a proxy by any chance? or perhaps tiscali has been shifting ip blocks.
     
  15. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    Tests on my IP show the following - still doesn't make sense:

    Code:
    [b]Query the RIPE Whois Database[/b]
    
            [font=ariel][size=2]Search for[/size][/font]  [i]% This is the RIPE Whois query server #1.[/i]
    [i]% The objects are in RPSL format.[/i]
    %
    [i]% Note: the default output of the RIPE Whois server[/i]
    [i]% is changed. Your tools may need to be adjusted. See[/i]
    [i]% [url="http://www.ripe.net/db/news/abuse-proposal-20050331.html"]http://www.ripe.net/db/news/abuse-proposal-20050331.html[/url][/i]
    [i]% for more details.[/i]
    %
    [i]% Rights restricted by copyright.[/i]
    [i]% See [url="http://www.ripe.net/db/copyright.html"]http://www.ripe.net/db/copyright.html[/url][/i]  [i]% Note: This output has been filtered.[/i]
    [i]%       To receive output for a database update, use the "-B" flag.[/i]  [i]% Information related to '88.104.0.0 - 88.111.255.255'[/i]  [b][u]inetnum[/u][/b]:        88.104.0.0 - 88.111.255.255
    org:            [url="http://www.ripe.net/whois?searchtext=ORG-TUL3-RIPE&form_type=simple"]ORG-TUL3-RIPE[/url]
    netname:        UK-TELINCO-20050805
    descr:          Tiscali UK Limited
    country:        GB
    tech-c:         [url="http://www.ripe.net/whois?searchtext=TU935-RIPE&form_type=simple"]TU935-RIPE[/url]
    admin-c:        [url="http://www.ripe.net/whois?searchtext=TU935-RIPE&form_type=simple"]TU935-RIPE[/url]
    status:         ALLOCATED PA [url="http://www.ripe.net/ripe/docs/ipv4-policies.html#assignment-type"][img]http://www.ripe.net/images/icons/whois-definition.gif[/img][/url]
    mnt-by:         [url="http://www.ripe.net/whois?searchtext=RIPE-NCC-HM-MNT&form_type=simple"]RIPE-NCC-HM-MNT[/url]
    mnt-lower:      [url="http://www.ripe.net/whois?searchtext=TU935-RIPE-MNT&form_type=simple"]TU935-RIPE-MNT[/url]
    mnt-routes:     [url="http://www.ripe.net/whois?searchtext=TU935-RIPE-MNT&form_type=simple"]TU935-RIPE-MNT[/url]
    source:         RIPE # Filtered
    [b][u]organisation[/u][/b]: ORG-TUL3-RIPE
    org-name:     Tiscali UK Limited
    org-type:     LIR
    address:      20 Broadwick Street
    address:      W1F 8HT
    address:      London
    address:      United Kingdom
    phone:        +44 207 087 2000
    fax-no:       +44 207 087 2295
    admin-c:      [url="http://www.ripe.net/whois?searchtext=TU935-RIPE&form_type=simple"]TU935-RIPE[/url]
    admin-c:      [url="http://www.ripe.net/whois?searchtext=FL899-RIPE&form_type=simple"]FL899-RIPE[/url]
    admin-c:      [url="http://www.ripe.net/whois?searchtext=MN4885-RIPE&form_type=simple"]MN4885-RIPE[/url]
    admin-c:      [url="http://www.ripe.net/whois?searchtext=DC-RIPE&form_type=simple"]DC-RIPE[/url]
    admin-c:      [url="http://www.ripe.net/whois?searchtext=BH-RIPE&form_type=simple"]BH-RIPE[/url]
    mnt-ref:      [url="http://www.ripe.net/whois?searchtext=TU935-RIPE-MNT&form_type=simple"]TU935-RIPE-MNT[/url]
    mnt-ref:      [url="http://www.ripe.net/whois?searchtext=RIPE-NCC-HM-MNT&form_type=simple"]RIPE-NCC-HM-MNT[/url]
    mnt-by:       [url="http://www.ripe.net/whois?searchtext=RIPE-NCC-HM-MNT&form_type=simple"]RIPE-NCC-HM-MNT[/url]
    source:       RIPE # Filtered
    [b]role[/b]:           Tiscali UK
    address:        Tiscali UK Limited
    address:        20 Broadwick Street
    address:        London W1F 8HT
    phone:          +44 207 087 2000
    remarks:        trouble:      Information: [url="http://www.tiscali.com"]http://www.tiscali.com[/url]
    remarks:        trouble:      Concerning abuse and spam ... mailto: [email="[email protected]"][email protected][/email]
    admin-c:        [url="http://www.ripe.net/whois?searchtext=DC-RIPE&form_type=simple"]DC-RIPE[/url]
    admin-c:        [url="http://www.ripe.net/whois?searchtext=BH-RIPE&form_type=simple"]BH-RIPE[/url]
    tech-c:         [url="http://www.ripe.net/whois?searchtext=FL899-RIPE&form_type=simple"]FL899-RIPE[/url]
    tech-c:         [url="http://www.ripe.net/whois?searchtext=MN4885-RIPE&form_type=simple"]MN4885-RIPE[/url]
    tech-c:         [url="http://www.ripe.net/whois?searchtext=MM13106-RIPE&form_type=simple"]MM13106-RIPE[/url]
    tech-c:         [url="http://www.ripe.net/whois?searchtext=AC9814-RIPE&form_type=simple"]AC9814-RIPE[/url]
    [u]nic-hdl[/u]:        TU935-RIPE
    remarks:        Hostmaster Role Account
    mnt-by:         [url="http://www.ripe.net/whois?searchtext=TU935-RIPE-MNT&form_type=simple"]TU935-RIPE-MNT[/url]
    source:         RIPE # Filtered
    abuse-mailbox:  [url="http://www.ripe.net/[email protected]&form_type=simple"][email protected][/url]  [i]% Information related to 'ORG-TUL3-RIPE'[/i]  [b][u]route[/u][/b]:          88.104.0.0/13
    descr:          Tiscali UK Limited
    [u]origin[/u]:         [url="http://www.ripe.net/whois?searchtext=AS9105&form_type=simple"]AS9105[/url]
    mnt-by:         [url="http://www.ripe.net/whois?searchtext=TU935-RIPE-MNT&form_type=simple"]TU935-RIPE-MNT[/url]
    source:         RIPE # Filtered
    
    EDIT: My point being that I have no reason to believe that Tiscali have made any significant changes to their service
     
    Certifications: MCP, A+, Network+
    WIP: Clarity
  16. d-Faktor
    Honorary Member

    d-Faktor R.I.P - gone but never forgotten.

    810
    0
    39
    which is why i asked about your proxy settings.
    anyway, try this http://www.whatsmyip.org, and tell us if you get the same result in ie as in ff.
     
  17. ffreeloader

    ffreeloader Terabyte Poster

    3,661
    106
    167
    Gav,

    Try deleting all your temporary internet files and cleaning everything out of the IE cache. I'd even clean out the cookies. Then I'd point my computer to another dns server and see what happens. Try one from anywhere over there on that side of the pond besides Tiscali.
     
    Certifications: MCSE, MCDBA, CCNA, A+
    WIP: LPIC 1
  18. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    d-Faktor:
    Same as same can be.

    Freddy:

    Tried a quick test with NTL's DNS settings, but they flat refused me after reconnecting (thanks to AJ for providing the IPs though)


    Too late for further tests tonight - but should have a bit of time to look at this again tomorrow. Thanks to all for now :)
     
    Certifications: MCP, A+, Network+
    WIP: Clarity
  19. Phoenix
    Honorary Member

    Phoenix 53656e696f7220 4d6f64

    5,749
    200
    246
    Code:
    soverign servers # netcat [url]www.l.google.com[/url] 80
    GET / HTTP/1.0
    
    HTTP/1.0 302 Found
    Location: [url]http://www.google.co.uk/cxfer?c=PREF%3D:TM%3D1125096367:S%3DPxV-fp9gi2Zws3Ty&prev=/[/url]
    Set-Cookie: PREF=ID=e70b3b297ba583cd:CR=1:TM=1125096367:LM=1125096367:S=7UEizrKhux2znlNb; expires=Sun, 17-Jan-2038 19:14:07 GMT; path=/; domain=.google.com
    Content-Type: text/html
    Server: GWS/2.1
    Content-Length: 217
    Date: Fri, 26 Aug 2005 22:46:07 GMT
    Connection: Keep-Alive
    
    <HTML><HEAD><TITLE>302 Moved</TITLE></HEAD><BODY>
    <H1>302 Moved</H1>
    The document has moved
    <A HREF="http://www.google.co.uk/cxfer?c=PREF%3D:TM%3D1125096367:S%3DPxV-fp9gi2Zws3Ty&amp;prev=/">here</A>.
    </BODY></HTML>
    
    This is whats supposed to happen :)
     
    Certifications: MCSE, MCITP, VCP
    WIP: > 0
  20. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    Still the same today ...! Guess it's the Google Gods confirming why I'm using Firefox :biggrin
     
    Certifications: MCP, A+, Network+
    WIP: Clarity

Share This Page

Loading...
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.