今天下午3點左右吧, 打開淘寶首頁的時候被轉到一個錯誤頁面, 說我訪問的頁面不存在.
看被轉過去的頁面域名還是err.taobao.com, 所以應該還是淘寶內部的"正常"的跳轉, 不是病毒啊什么的.
開tcpdump抓包看一下. 和淘寶有關的記錄如下:
192.168.0.110.50874 > 101.226.178.141.80: Flags [.], cksum 0x193e (correct), seq 3469495610:3469497050, ack 3942073739, win 4096, options [nop,nop,TS val 479275520 ecr 780673144], length 1440
D...U\T&..n...E...i.@.@......ne......P..M:..E......>.....
..*... xGET / HTTP/1.1
Host: www.taobao.com
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.89 Safari/537.36
Accept-Encoding: gzip, deflate, sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
...
101.226.178.141.80 > 192.168.0.110.50874: Flags [P.], cksum 0x4485 (correct), seq 1:450, ack 1590, win 126, options [nop,nop,TS val 780733766 ecr 479275520], length 449
T&..n.D...U\..E.....@.8...e......n.P....E...Sp...~D......
F..*.HTTP/1.1 302 Found
Server: Tengine
Date: Sat, 14 Mar 2015 07:25:11 GMT
Content-Type: text/html
Content-Length: 258
Connection: keep-alive
Location: http://err.taobao.com/error1.html
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html>
<head><title>302 Found</title></head>
<body bgcolor="white">
<h1>302 Found</h1>
<p>The requested resource resides temporarily under a different URI.</p>
<hr/>Powered by Tengine</body>
</html>
總的來說就是我淘寶www.taobao.com, 域名被解析到101.226.178.141這個IP,然后我的請求被轉到了http://err.taobao.com/error1.html這個頁面.
看一下dns:
% nslookup www.taobao.com 127 ↵ ✭
Server:192.168.0.1
Address:192.168.0.1#53
Non-authori tative answer:
Name:www.taobao.com
Address: 222.73.134.41
Name:www.ta obao.com
Address: 101.226.178.151
Name:www.taobao.com
Address: 222.73. 134.51
Name:www.taobao.com
Address: 101.226.178.141
在 /etc/hosts里添加一行 222.73.134.41 www.taobao.com 指向另外一個IP試一下, 訪問正常了. 然后再手工換成101.226.178.141, 還是被轉到錯誤頁, 看來101.226.178.141這個IP是有問題.
網上搜索了一下, 101.226.178.141 這個IP是天貓的. 本地看一下:
% host www.tmall.com
www.tmall.com is an alias for www.gslb.taobao.com.danuoyi.tbcache.com.
www.gslb.taobao.com.danuoyi.tbcache.com has address 101.226.178.111
www.gslb.taobao.com.danuoyi.tbcache.com has address 101.226.178.141
www.gslb.taobao.com.danuoyi.tbcache.com has address 101.226.178.151
www.gslb.taobao.com.danuoyi.tbcache.com has address 101.226.181.111
www.gslb.taobao.com.danuoyi.tbcache.com has address 222.73.134.41
www.gslb.taobao.com.danuoyi.tbcache.com has address 222.73.134.51
www.gslb.taobao.com.danuoyi.tbcache.com has address 101.226.181.101
www.gslb.taobao.com.danuoyi.tbcache.com has address 101.226.178.101
所以說, 可能是淘寶DNS管理人員不小心把www.taobao.com的一條IP不小心轉到天貓去了. 然后還被電信等dns服務器緩存了起來.
更新: 這其實已經是昨天發生事情了. 但現在看到的dns好像還不對,有可能還是電信的緩存?? 這么久?
到http://tool.chinaz.com/dns 查看了一下, 上海電信的www.taobao.com的dns地址已經沒有101.226.178.141了
上海[電信]
101.226.178.151 [上海市 浙江淘寶網絡有 限公司電信節點]
101.226.181.101 [上海市 浙江淘寶網絡有限公司電信節點]
101.226.178.141 [上海市 浙江淘寶網絡有限公司電信節點]
101.226.181.111 [上海市 浙江淘寶網絡有限公司電信節點]