This document describes how to configure DNS hijacking detection parameters for network quality, page performance, file download, and audio/video experience tasks in CAT. You can refer to the instructions in this document for configuration.
Hijacking Categorization
Hijacking situations can be categorized into two types:
DNS Hijacking: For example:
www.cloud.tencent.com is resolved to another server, which will cause user access failure or return a non-Tencent Cloud destination IP.Page Tampering: Utilizes intermediate page JS, Html, Http headers to perform redirection, open windows, embed Frameset operations, etc., ultimately rendering a hijacked page on the user end. Common manifestations include pop-up ads, floating ads, redirection behaviors.
The format of DNS hijacking is as follows:
www.cloud.tencent.com:202.0.3.55|203.3.44.67Input rule
The part before the colon is the domain name to be judged.
The part after the colon is the match rule.
Match rules support multiple, separated by vertical bars.
Match rules support exact IP/ip wildcards/subnet masks/cname.
Sample:
DNS hijacking allowlist
Input Content | Meaning |
www.cloud.tencent.com:202.0.3.55|203.3.44.67 | The domains under www.cloud.tencent.com are not considered hijacked except for 202.0.3.55 and 203.3.44.67. |
www.cloud.tencent.com:202.0.3.* | The IP addresses under the www.cloud.tencent.com domain name starting with 202.0.3. can be considered not hijacked. |
www.cloud.tencent.com:202.0.3.1/27 | The IP addresses under the www.cloud.tencent.com domain name whose first 27 bits match those of 202.0.3.1 are not considered hijacked. |
www.cloud.tencent.com:* | All IP addresses under the www.cloud.tencent.com domain are considered hijacked. |
DNS hijacking blocklist
Input Content | Meaning |
www.cloud.tencent.com:202.0.3.55|203.3.44.67 | The domains under www.cloud.tencent.com are considered hijacked except for 202.0.3.55 and 203.3.44.67. |
www.cloud.tencent.com:202.0.3.* | The IP addresses under the www.cloud.tencent.com domain starting with 202.0.3. are considered hijacked. |
www.cloud.tencent.com:202.0.3.1/27 | IP addresses where the first 27 bits match those of 202.0.3.1 under the www.cloud.tencent.com domain are considered hijacked. |
www.cloud.tencent.com:* | All IP addresses under the www.cloud.tencent.com domain are considered hijacked. |