Facebook Outage: Yes, its DNS (sort of). A super quick analysis of what is going on.
For the Billions out there still wasting time on Facebook: Enjoy your increased productivity while many Facebook properties (Facebook, Instagram, WhatsApp) are down.
More readable summary of the analysis below: The BGP routes pointing traffic to Facebook's IP address space have been withdrawn. The Internet no longer knows where to find Facebook's IPs. One symptom is that DNS requests are failing. But this is just the result of Facebook hosting its DNS servers inside its own network. Even with working DNS (for example if you still have cached results), the IPs are currently not reachable
Here is a quick view of what may have happened.
1 - Does facebook.com resolve?
% host facebook.com facebook.com has address 31.13.79.35 facebook.com has IPv6 address 2a03:2880:f141:82:face:b00c:0:25de facebook.com mail is handled by 2560 smtpin.vvv.facebook.com. % host www.facebook.com www.facebook.com is an alias for star-mini.c10r.facebook.com. star-mini.c10r.facebook.com has address 31.13.88.35 star-mini.c10r.facebook.com has IPv6 address 2a03:2880:f138:83:face:b00c:0:25de
Yes! (at least for me, it does). But was that just a cached response? Let's follow the DNS chain.
2. What is the NS record for facebook.com according to the .com zone?
(abbreviated output)
% dig NS facebook.com @h.gtld-servers.net
;; AUTHORITY SECTION: facebook.com. 172800 IN NS a.ns.facebook.com. facebook.com. 172800 IN NS b.ns.facebook.com. facebook.com. 172800 IN NS c.ns.facebook.com. facebook.com. 172800 IN NS d.ns.facebook.com. ;; ADDITIONAL SECTION: a.ns.facebook.com. 172800 IN A 129.134.30.12 a.ns.facebook.com. 172800 IN AAAA 2a03:2880:f0fc:c:face:b00c:0:35 b.ns.facebook.com. 172800 IN A 129.134.31.12 b.ns.facebook.com. 172800 IN AAAA 2a03:2880:f0fd:c:face:b00c:0:35 c.ns.facebook.com. 172800 IN A 185.89.218.12 c.ns.facebook.com. 172800 IN AAAA 2a03:2880:f1fc:c:face:b00c:0:35 d.ns.facebook.com. 172800 IN A 185.89.219.12 d.ns.facebook.com. 172800 IN AAAA 2a03:2880:f1fd:c:face:b00c:0:35
3. Let's use one of these NS records
% dig NS facebook.com @129.134.30.12 ; <<>> DiG 9.10.6 <<>> NS facebook.com @129.134.30.12 ;; global options: +cmd ;; connection timed out; no servers could be reached
4. So let's see why we can't reach these servers
% traceroute 129.134.30.12 traceroute to 129.134.30.12 (129.134.30.12), 64 hops max, 52 byte packets 1 [redacted] 0.628 ms 0.159 ms 0.101 ms 2 [redacted] 2.333 ms 1.715 ms 1.706 ms 3 96.120.21.201 (96.120.21.201) 9.123 ms 10.691 ms 10.338 ms 4 96.110.66.37 (96.110.66.37) 9.254 ms 8.754 ms 10.311 ms 5 ae-13-ar02.westside.fl.jacksvil.comcast.net (68.86.168.1) 9.332 ms 11.930 ms 9.746 ms 6 be-33622-cs02.56marietta.ga.ibone.comcast.net (96.110.43.117) 23.797 ms 7 be-2112-pe12.56marietta.ga.ibone.comcast.net (96.110.33.178) 24.322 ms 8 * * *
So Comcast doesn't know how to reach Facebook. Well... BGP should tell them
5. Let's check with a BGP Looking Glass
show router bgp routes 129.134.0.0/16 ipv4 hunt =============================================================================== BGP Router ID:4.69.178.225 AS:3356 Local AS:3356 =============================================================================== Legend - Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid l - leaked, x - stale, > - best, b - backup, p - purge Origin codes : i - IGP, e - EGP, ? - incomplete =============================================================================== BGP IPv4 Routes =============================================================================== No Matching Entries Found. ===============================================================================
So looks like the route is gone. Oh well. Enjoy while it lasts.
---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|
https://www.sans.edu
