Lab Presentation

This lab demonstrates BGP Anycast applied to DNS infrastructure.

Both NS1 and NS2 advertise the same anycast prefix into BGP.

NS1 serves DNS over HTTPS (DoH), NS2 serves DNS over TLS (DoT).

🔍 What to Explore

The lab is structured around three progressive investigations.

Step 1 : Find the anycast prefix

Before sending any DNS query, identify the anycast prefix advertised by both NS1 and NS2.

Once you have found the prefix, use it as PREFIX in all commands below.

Step 2 : Observe BGP Anycast routing

Identify which DNS server the client reaches by default and understand why.

The domain is lab.be. Use traceroute6 to confirm the physical path taken.

Step 3 : Compare DoT, DoH and standard DNS

Send the same query using each protocol and capture the traffic simultaneously. Open two terminals: one for tcpdump, one for the query.

Step 4 : Redirect traffic to the other server

The lab archive includes a helper script bgpRemovePrefix.sh to withdraw the anycast prefix from the currently active DNS server, forcing BGP to switch to the other one. Run it inside the DNS server container you want to withdraw from:

# usage: ./bgpRemovePrefix.sh <as_number> <anycast_prefix>
# example:
./bgpRemovePrefix.sh 100 PREFIX

After running it, verify the switch and confirm the client now reaches the other server.

Useful Commands

# Inspect the routing table and find the anycast prefix
vtysh -c "show bgp ipv6 unicast"

# Check BGP session state
vtysh -c "show bgp neighbors"

# Confirm the path taken to the anycast address
traceroute6 PREFIX

# DNS
dig -6 lab.be @PREFIX

# Capture: content is fully readable
tcpdump -i eth0 -n port 53

# DNS over HTTPS — DoH (port 443)
dig -6 @PREFIX -p 443 +https lab.be

# Capture: encrypted, indistinguishable from normal HTTPS traffic
tcpdump -i eth0 -n port 443

# DNS over TLS — DoT (port 853)
dig -6 @PREFIX -p 853 +tls lab.be

# Capture: encrypted TLS stream, but port 853 is visible and identifiable
tcpdump -i eth0 -n port 853