AS211763 - ITPIRFC 4890 ✗RPKI -ASPA -

AS overview

Test target: 2001:67c:10f4::1 · static prefix probe · address space: PI · prefixes announced: 1

prefix(es): 2001:67c:10f4::/48

VIX / AAIX / SAIX / TIROL-IX / ERA-IX peering

Random-IP probe (yarrp) into the AS' prefixes

We probed 35 arbitrary IPv6 address(es) inside AS211763's announced prefix(es). No router inside the prefix responded. The deepest visible hop was 2a01:190:1764:2e::2 at hop 10 - that router answers ICMPv6 Echo. This is not in AS211763's announced prefix; operationally it's the AS-edge / peering interface (often on an IXP peering address or an upstream's /127 link). The traceroute boundary is the AS edge: ICMPv6 Time-Exceeded responses from anything inside this AS are filtered.

ICMPv6 Type 2 (Packet Too Big) acceptance - active test

Vantage points disagree about Type 2 acceptance - transit ASes on one path may be filtering Type 2 even though the destination's stack accepts it on another path:

• SRB host (SOX, Belgrade): inconclusive: no Echo Reply to 1300-byte probe. (ICMPv6 Echo + forged PTB)
• DE host (Berlin): inconclusive: no Echo Reply to 1300-byte probe. (ICMPv6 Echo + forged PTB)
• DE host (Düsseldorf): inconclusive: no Echo Reply after PTB (probe 1300B). (ICMPv6 Echo + forged PTB)
• NL host (go6lab): Type 2 NOT honored. Forged PTB had no effect (filtered en route or stack ignored it). (ICMPv6 Echo + forged PTB)
• ITA host (Karsolink): inconclusive: no Echo Reply to 1300-byte probe. (ICMPv6 Echo + forged PTB)
• SLO host (6connect): inconclusive: no Echo Reply to 1300-byte probe. (ICMPv6 Echo + forged PTB)
• SLO host (T-2): inconclusive: no Echo Reply to 1300-byte probe. (ICMPv6 Echo + forged PTB)

Why they disagree - reachability mismatch: One vantage couldn't drive a flow at all to this destination (no Echo Reply or no responding TCP port), so the active test had no behavioural change to observe. The other vantage's verdict is the only meaningful one here.

sudo tcpdump -i any -n -e 'icmp6 and ip6[40] = 2 and (src host 2607:fae0:a000::42 or src host 2a00:8642:42::75 or src host 2a01:261:313:b814:2a0:98ff:fe5b:13e4 or src host 2a06:d1c1:10b::cccc or src host 2a06:d1c1:10d::aaaa or src host 2a09:ab81::91 or src host 2a12:d8c0:105a:9001::a154)'

sudo ip6tables -L INPUT -nv | grep -iE 'icmpv6|packet-too-big'
sudo nft list ruleset 2>/dev/null | grep -A1 'icmpv6'

sudo sysctl net.ipv6.conf.all.accept_redirects net.ipv4.ip_no_pmtu_disc net.ipv6.route.mtu_expires

sudo tcpdump -i any -n -e 'icmp6 and ip6[40] = 2 and (src host 2607:fae0:a000::42 or src host 2a00:8642:42::75 or src host 2a12:d8c0:105a:9001::a154 or src host 2a09:ab81::91 or src host 2a01:261:313:b814:2a0:98ff:fe5b:13e4 or src host 2a06:d1c1:10a::bbbb or src host 2a06:d1c1:10d::aaaa or src host 2a06:d1c1:10b::cccc)'

Multi-vantage path map

Every hop of all vantages’ traceroutes toward the target, drawn left→right, grouped into per-AS bubbles (a hop seen from several vantages is one shared bubble, so converging paths merge). It answers two questions per vantage — shown on each source bubble as echo ✓/⚠/✗ · trace ✓/✗: did the destination reply to ICMPv6 Echo (✓ honored, ⚠ replied but PTB not honored, ✗ no reply), and did the traceroute reach it. A line to the target is drawn only when that vantage got an echo reply — solid if the PTB was honored, dashed if not (reachable but a broken-PMTUD / RFC 4890 violation). The path depth still shows how far the traceroute itself got, and runs of unanswered (* *) hops collapse into one dashed “silent” bubble. Open full size ↗

• ● SRB host (SOX, Belgrade)
• ● DE host (Berlin)
• ● DE host (Düsseldorf)
• ● NL host (go6lab)
• ● ITA host (Karsolink)
• ● SLO host (6connect)
• ● SLO host (T-2)
• ── solid line = echo reply, PTB honored (clean reach)
• — — dashed line = echo reply but PTB not honored (RFC 4890 violation)
• no line = no echo reply (never reached)
• ◉ target: green = clean, amber = reachable-but-violation / unreachable
• ⚠ suspected drop AS
• ⋯ silent (unanswered) hops
• ● IXP hop

From SRB host (SOX, Belgrade)   echo onlyRFC 4890 ✗

filter likely at: destination AS211763 (CPS-IT) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

tracepath -6

 1?: [LOCALHOST]                        0.016ms pmtu 1500
 1:  _gateway                                              0.404ms 
 1:  _gateway                                              0.560ms 
 2:  sox-pn.sox.rs                                         0.587ms 
 3:  2001:7f8:1e:8::3d                                     0.820ms asymm  2 
 4:  ae8-930.RT.IRX.VIE.AT.retn.net                       11.341ms asymm  3 
 5:  vix-ip6-et-0-1-2-0-r60.inx.vie.at.nextlayer.net      11.562ms asymm  3 
 6:  no reply
 7:  no reply
 8:  no reply
 9:  no reply
10:  no reply
11:  no reply
12:  no reply
13:  no reply
14:  no reply
15:  no reply
16:  no reply
17:  no reply
     Too many hops: pmtu 1500
     Resume: pmtu 1500 

From DE host (Berlin)   echo onlyRFC 4890 ✗

filter likely at: destination AS211763 (CPS-IT) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

tracepath -6

 1?: [LOCALHOST]                        0.032ms pmtu 1500
 1:  xe-0-0-13-178.gw01.ber01.as59645.net                  0.476ms 
 1:  xe-0-0-13-178.gw01.ber01.as59645.net                  0.470ms 
 2:  ae0-2453.cr10.ber01.lwlcom.net                        1.131ms 
 3:  ae0-150.cr10.fra01.lwlcom.net                        10.369ms asymm  7 
 4:  ae0-100.cr10.fra02.lwlcom.net                        10.521ms asymm  8 
 5:  ae0-10.cr10.fra06.lwlcom.net                         42.365ms asymm  7 
 6:  nextlayer.peering.cz                                 36.639ms asymm  8 
 7:  no reply
 8:  no reply
 9:  no reply
10:  no reply
11:  no reply
12:  no reply
13:  no reply
14:  no reply
15:  no reply
16:  no reply
17:  no reply
     Too many hops: pmtu 1500
     Resume: pmtu 1500 

From DE host (Düsseldorf)   echo onlyRFC 4890 ✗

filter likely at: destination AS211763 (CPS-IT) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

Rate-limited ICMPv6: hop 8 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.042ms pmtu 1500
 1:  xe-0-0-12-142.gw01.dus01.as59645.net                  0.347ms 
 1:  xe-0-0-12-142.gw01.dus01.as59645.net                  0.308ms 
 2:  eth1-0-12-h5594.edge5-dus1.bb.wiit.network            1.301ms 
 3:  no reply
 4:  lag30.core3-dus1.bb.wiit.network                      0.396ms 
 5:  lag2.core1-dus-ix.bb.wiit.network                     0.546ms 
 6:  de-cix.r60.inx.fra.de.nextlayer.net                   4.021ms 
 7:  no reply
 8:  no reply
 9:  no reply
10:  no reply
11:  no reply
12:  no reply
13:  no reply
14:  no reply
15:  no reply
16:  no reply
17:  no reply
     Too many hops: pmtu 1500
     Resume: pmtu 1500 

From NL host (go6lab)   echo onlyRFC 4890 ✗

filter likely at: destination AS211763 (CPS-IT) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

Rate-limited ICMPv6: hop 5, hop 6 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.020ms pmtu 1500
 1:  2a00:8642:42::2                                       0.905ms 
 1:  2a00:8642:42::2                                       0.822ms 
 2:  gw.friends.steffann.nl                                4.225ms 
 3:  2a00:1ca8:1::194                                      4.943ms 
 4:  2a03:3f40::10:41                                      5.729ms 
 5:  2001:b28:3ff::1b1b:0:1                               28.649ms 
 6:  no reply
 7:  no reply
 8:  de-cix.r60.inx.fra.de.nextlayer.net                  42.720ms 
 9:  ams-ix.r06.nikh.ams.nl.nextlayer.net                 52.130ms asymm  8 
10:  no reply
11:  no reply
12:  no reply
13:  no reply
14:  no reply
15:  no reply
16:  no reply
17:  no reply
     Too many hops: pmtu 1500
     Resume: pmtu 1500 

From ITA host (Karsolink)   echo onlyRFC 4890 ✗

filter likely at: destination AS211763 (CPS-IT) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

Rate-limited ICMPv6: hop 3 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.039ms pmtu 1500
 1:  karsolink-01.net.karsolink.com                        1.042ms 
 2:  no reply
 3:  2a12:d8c0:101f:103::1                                 8.775ms 
 4:  no reply
 5:  be47.core1.mil2.he.net                               12.599ms 
 6:  be1.core1.zrh2.he.net                                16.134ms 
 7:  no reply
 8:  be1.core3.zrh3.he.net                                16.226ms 
 9:  no reply
10:  no reply
11:  no reply
12:  no reply
13:  no reply
14:  no reply
15:  no reply
16:  no reply
17:  no reply
     Too many hops: pmtu 1500
     Resume: pmtu 1500 

From SLO host (6connect)   echo onlyRFC 4890 ✗

filter likely at: destination AS211763 (CPS-IT) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

Rate-limited ICMPv6: hop 3 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.024ms pmtu 9000
 1:  fw1-lju.6connect.com                                  0.629ms 
 1:  fw1-lju.6connect.com                                  0.559ms 
 2:  no reply
 3:  2a00:ee1:800:9::1                                     4.341ms 
 4:  2a00:ee0:1:10::2                                      1.328ms asymm  3 
 5:  2a00:ee0:1:10::2                                      1.427ms pmtu 1500
 5:  de-cix.r60.inx.fra.de.nextlayer.net                  15.817ms asymm  6 
 6:  no reply
 7:  no reply
 8:  no reply
 9:  no reply
10:  no reply
11:  no reply
12:  no reply
13:  no reply
14:  no reply
15:  no reply
16:  no reply
17:  no reply
     Too many hops: pmtu 1500

From SLO host (T-2)   echo onlyRFC 4890 ✗

filter likely at: destination AS211763 (CPS-IT) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

Rate-limited ICMPv6: hop 8 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.032ms pmtu 1500
 1:  no reply
 2:  2a01:260:1::225                                       2.985ms 
 3:  2a01-260-1-1--9c.core6.t-2.net                        2.636ms 
 4:  2a01-260-1-1--c.core6.t-2.net                         4.714ms 
 5:  2a01-260-1-1--c.core6.t-2.net                         5.339ms asymm  4 
 6:  vix-ip6-et-0-1-2-0-r60.esh.vie.at.nextlayer.net       8.447ms asymm  5 
 7:  no reply
 8:  no reply
 9:  no reply
10:  no reply
11:  no reply
12:  no reply
13:  no reply
14:  no reply
15:  no reply
16:  no reply
17:  no reply
     Too many hops: pmtu 1500
     Resume: pmtu 1500