Bug in DNS software for router models ISR4451 and C1101

[maynardDNS]

Dear Cisco community,

we (research team from FU-Berlin) did some research on the open DNS infrastructure and discovered that more than 25% of the ODNS infrastructure are so called "Transparent Forwarder" which are devices that forward DNS requests to a public resolver by spoofing the client's IP address. More details on measurements and our paper can be found at https://odns.secnow.net

Further investigations led to the two routers mentioned in the title: ISR4451 and C1101.

(this was the result of an email campaign where we managed to get in contact with some network operators who confirmed this behavior)

There must be some bug in the DNS software which activates this transparent forwarding as soon as the router is configured as a DNS server.

We would appreciate any help or information on the implementation details of the DNS software used on these routers.

Thanks in advance!

Maynard Koch

[balaji.bandi]

what verrsion code running on these devices ?

[maynardDNS]

thats one thing I would like to find out

the operators could not (or would not) tell me

i am hoping to find someone who knows what DNS software is running generally on these devices (or what software is available and likely to be used on cisco routers)

we found this issue also on MikroTik devices, there may be an overlap somehow