AS199324 - dodonet DODONET S.R.LPARFC 4890 ✓RPKI ✓ 1/1ASPA -

AS overview

Test target: 2a00:54e0::d0d0 · ns1.dodonet.it · address space: PA · prefixes announced: 1

prefix(es): 2a00:54e0::/32

MIX-IT / NAMEX / MINAP / TOP-IX / VSIX / EQUINIX-MILAN / BGPX-ROME / NAMEX-BARI / PCIX / DECIX-PALERMO peering

Random-IP probe (yarrp) into the AS' prefixes

At least one router inside AS199324's announced prefix replied during the random-target probe. Hop(s): 2a00:54e0:255::5:1, 2a00:54e0:255::f:3. These are candidate targets for direct testing.

ICMPv6 Type 2 (Packet Too Big) acceptance - active test

Vantage points disagree about Type 2 acceptance - transit ASes on one path may be filtering Type 2 even though the destination's stack accepts it on another path:

• SRB host (SOX, Belgrade): Type 2 honored. Forged PTB accepted; next response shrunk. (ICMPv6 Echo + forged PTB)
• DE host (Berlin): Type 2 NOT honored. Forged PTB had no effect (filtered en route or stack ignored it). (ICMPv6 Echo + forged PTB)
• DE host (Düsseldorf): Type 2 honored. Forged PTB accepted; next response shrunk. (ICMPv6 Echo + forged PTB)
• NL host (go6lab): Type 2 honored. Forged PTB accepted; next response shrunk. (ICMPv6 Echo + forged PTB)
• ITA host (Karsolink): Type 2 honored. Forged PTB accepted; next response shrunk. (ICMPv6 Echo + forged PTB)
• SLO host (6connect): Type 2 honored. Forged PTB accepted; next response shrunk. (ICMPv6 Echo + forged PTB)
• SLO host (T-2): Type 2 NOT honored. Forged PTB had no effect (filtered en route or stack ignored it). (ICMPv6 Echo + forged PTB)

Why they disagree - path-asymmetric Type 2 filtering: Both vantages used the ICMPv6 Echo + forged-PTB method on the same destination IP, but reached different verdicts. The destination's stack is the same in both cases - so the difference is in the path: a transit AS on one route filters our forged Type 2 (or its return ICMPv6 carrying the embedded packet) while the other route delivers it intact. The vantage that says honored shows what the destination's stack actually does; the one that says not honored shows that the path between us and them drops Type 2.

sudo tcpdump -i any -n -e 'icmp6 and ip6[40] = 2 and (src host 2607:fae0:a000::42 or src host 2a00:8642:42::75 or src host 2a01:261:313:b814:2a0:98ff:fe5b:13e4 or src host 2a06:d1c1:10b::cccc or src host 2a06:d1c1:10d::aaaa or src host 2a09:ab81::91 or src host 2a12:d8c0:105a:9001::a154)'

sudo ip6tables -L INPUT -nv | grep -iE 'icmpv6|packet-too-big'
sudo nft list ruleset 2>/dev/null | grep -A1 'icmpv6'

sudo sysctl net.ipv6.conf.all.accept_redirects net.ipv4.ip_no_pmtu_disc net.ipv6.route.mtu_expires

sudo tcpdump -i any -n -e 'icmp6 and ip6[40] = 2 and (src host 2607:fae0:a000::42 or src host 2a00:8642:42::75 or src host 2a12:d8c0:105a:9001::a154 or src host 2a09:ab81::91 or src host 2a01:261:313:b814:2a0:98ff:fe5b:13e4 or src host 2a06:d1c1:10a::bbbb or src host 2a06:d1c1:10d::aaaa or src host 2a06:d1c1:10b::cccc)'

Multi-vantage path map

Every hop of all vantages’ traceroutes toward the target, drawn left→right, grouped into per-AS bubbles (a hop seen from several vantages is one shared bubble, so converging paths merge). It answers two questions per vantage — shown on each source bubble as echo ✓/⚠/✗ · trace ✓/✗: did the destination reply to ICMPv6 Echo (✓ honored, ⚠ replied but PTB not honored, ✗ no reply), and did the traceroute reach it. A line to the target is drawn only when that vantage got an echo reply — solid if the PTB was honored, dashed if not (reachable but a broken-PMTUD / RFC 4890 violation). The path depth still shows how far the traceroute itself got, and runs of unanswered (* *) hops collapse into one dashed “silent” bubble. Open full size ↗

• ● SRB host (SOX, Belgrade)
• ● DE host (Berlin)
• ● DE host (Düsseldorf)
• ● NL host (go6lab)
• ● ITA host (Karsolink)
• ● SLO host (6connect)
• ● SLO host (T-2)
• ── solid line = echo reply, PTB honored (clean reach)
• — — dashed line = echo reply but PTB not honored (RFC 4890 violation)
• no line = no echo reply (never reached)
• ◉ target: green = clean, amber = reachable-but-violation / unreachable
• ⚠ suspected drop AS
• ⋯ silent (unanswered) hops
• ● IXP hop

From SRB host (SOX, Belgrade)   openRFC 4890 ✓

filter likely at: (none) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

Rate-limited ICMPv6: hop 8, hop 9 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.013ms pmtu 1500
 1:  _gateway                                              0.460ms 
 1:  _gateway                                              0.375ms 
 2:  sox-pn.sox.rs                                         0.322ms 
 3:  2001:7f8:1e:8::3d                                     0.606ms asymm  2 
 4:  2001:67c:128c::699                                   17.128ms 
 5:  hu0-15-0-0.lontr4.London.opentransit.net             41.757ms asymm  6 
 6:  no reply
 7:  be4.core2.ams2.he.net                                41.646ms 
 8:  be7.core2.fra2.he.net                                40.639ms asymm  6 
 9:  be3.core4.fra1.he.net                                41.097ms asymm  7 
10:  be10.core1.zrh2.he.net                               45.162ms asymm  8 
11:  be1.core1.mil2.he.net                                45.502ms asymm  7 
12:  no reply
13:  dodonet-v6.mix-it.net                                49.787ms asymm  5 
14:  2a00:54e0:255::5:1                                   60.099ms asymm  6 
15:  2a00:54e0:255::f:3                                   60.896ms asymm  7 
16:  2a00:54e0:dcdc:0:b::5                                63.895ms asymm  8 
17:  ns1.dodonet.it                                       61.469ms !A
     Resume: pmtu 1500 

From DE host (Berlin)   openRFC 4890 ✗

filter likely at: (none) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

tracepath -6

 1?: [LOCALHOST]                        0.033ms pmtu 1500
 1:  xe-0-0-13-178.gw01.ber01.as59645.net                  0.579ms 
 1:  xe-0-0-13-178.gw01.ber01.as59645.net                  0.553ms 
 2:  ae0-2453.cr10.ber01.lwlcom.net                        1.112ms 
 3:  ae0-10.cr10.ber03.lwlcom.net                          5.792ms 
 4:  ae0-15.cr11.dtm01.lwlcom.net                          9.111ms asymm  5 
 5:  ae0-20.cr10.dtm01.lwlcom.net                          8.658ms asymm  4 
 6:  ae0-50.cr10.dus02.lwlcom.net                          8.976ms asymm  3 
 7:  ae0-10.cr10.dus01.lwlcom.net                          8.841ms asymm  4 
 8:  ae6-60.cr10.ams01.lwlcom.net                         18.828ms asymm  5 
 9:  2001:7f8:12a::18                                     15.090ms asymm  4 
10:  2a03:b020::226                                       24.543ms asymm  4 
11:  2a03:b020:1:47::b                                    24.363ms 
12:  2a00:54e0:255::5:1                                   35.381ms 
13:  2a00:54e0:255::f:3                                   36.172ms 
14:  2a00:54e0:dcdc:0:b::5                                36.865ms 
15:  ns1.dodonet.it                                       36.569ms !A
     Resume: pmtu 1500 

From DE host (Düsseldorf)   openRFC 4890 ✓

filter likely at: (none) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

tracepath -6

 1?: [LOCALHOST]                        0.016ms pmtu 1500
 1:  xe-0-0-12-142.gw01.dus01.as59645.net                  0.351ms 
 1:  xe-0-0-12-142.gw01.dus01.as59645.net                  0.295ms 
 2:  eth1-0-12-h5594.edge5-dus1.bb.wiit.network            1.333ms 
 3:  no reply
 4:  lag30.core3-dus1.bb.wiit.network                      0.477ms 
 5:  lag0-vl1011.core1-fra-ix.bb.wiit.network              4.290ms 
 6:  lag0-vl1001.core1-nbg-ncd.bb.wiit.network             6.947ms 
 7:  lag0-vl6.core2-nbg-ncd.bb.wiit.network                7.249ms 
 8:  lag0-vl1006.core2-muc2.bb.wiit.network                9.698ms 
 9:  lag0-vl1009.core1-muc-eq3.bb.wiit.network             9.962ms 
10:  lag0-vl1001.core1-pda-vsix.bb.wiit.network           20.491ms 
11:  lag0-vl1001.core1-mil-mix.bb.wiit.network            20.663ms asymm  9 
12:  dodonet-v6.mix-it.net                                20.231ms asymm 10 
13:  2a00:54e0:255::5:1                                   31.221ms asymm 11 
14:  2a00:54e0:255::f:3                                   32.057ms asymm 12 
15:  2a00:54e0:dcdc:0:b::5                                32.454ms asymm 13 
16:  ns1.dodonet.it                                       32.506ms !A
     Resume: pmtu 1500 

From NL host (go6lab)   openRFC 4890 ✓

filter likely at: (none) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

tracepath -6

 1?: [LOCALHOST]                        0.042ms pmtu 1500
 1:  2a00:8642:42::2                                       2.670ms 
 1:  2a00:8642:42::2                                       1.922ms 
 2:  gw.friends.steffann.nl                                2.733ms 
 3:  speed-ix.fibertelecom.it                              4.274ms 
 4:  2a03:b020::226                                       21.736ms 
 5:  2a03:b020:1:47::b                                    21.892ms asymm  8 
 6:  2a00:54e0:255::5:1                                   30.947ms asymm  9 
 7:  2a00:54e0:255::f:3                                   31.223ms asymm 10 
 8:  2a00:54e0:dcdc:0:b::5                                32.734ms asymm 11 
 9:  ns1.dodonet.it                                       33.739ms !A
     Resume: pmtu 1500 

From ITA host (Karsolink)   openRFC 4890 ✓

filter likely at: (none) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

Rate-limited ICMPv6: hop 3, hop 4, hop 5 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.052ms pmtu 1500
 1:  karsolink-01.net.karsolink.com                        0.810ms 
 1:  karsolink-01.net.karsolink.com                        0.837ms 
 2:  2a12:d8c0:109f:121::a1                                0.747ms 
 3:  2a12:d8c0:101f:103::1                                 8.843ms 
 4:  2001:7f8:b9::24:1                                    19.886ms asymm  8 
 5:  cr1-hu0-0-0-3-703.ip6.it3.aruba.it                   14.375ms asymm  6 
 6:  er2-hu0-0-0-21.ip6.it3.aruba.it                      11.112ms asymm  7 
 7:  2a00:6d42:0:2:9b::26                                 10.112ms asymm  4 
 8:  2a02:29e0:255::3:1993:2                              10.124ms asymm  4 
 9:  2a00:54e0:255::5:1                                   21.033ms asymm  5 
10:  2a00:54e0:255::f:3                                   23.880ms asymm  6 
11:  2a00:54e0:dcdc:0:b::5                                22.339ms asymm  7 
12:  ns1.dodonet.it                                       22.208ms !A
     Resume: pmtu 1500 

From SLO host (6connect)   openRFC 4890 ✓

filter likely at: (none) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

Rate-limited ICMPv6: hop 4 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.018ms pmtu 9000
 1:  fw1-lju.6connect.com                                  0.687ms 
 1:  fw1-lju.6connect.com                                  0.516ms 
 2:  ccr-to-fw-ccr1-gw-lju.6connect.com                    0.966ms 
 3:  2a03:a100:0:201:1::1                                  0.998ms 
 4:  2a03:a100:0:201:1::1                                  0.814ms pmtu 1500
 4:  e0-1.core1.lju1.he.net                                2.489ms 
 5:  no reply
 6:  port-channel1.core1.zag2.he.net                       4.208ms 
 7:  no reply
 8:  dodonet-v6.mix-it.net                                12.107ms 
 9:  2a00:54e0:255::5:1                                   23.257ms 
10:  2a00:54e0:255::f:3                                   23.834ms 
11:  2a00:54e0:dcdc:0:b::5                                24.388ms 
12:  ns1.dodonet.it                                       24.223ms !A
     Resume: pmtu 1500 

From SLO host (T-2)   openRFC 4890 ✗

filter likely at: (none) · min PMTU on path: 1500

Path (traceroute + mtr + PTR)

Rate-limited ICMPv6: hop 7, hop 8, hop 9, hop 10 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.028ms pmtu 1500
 1:  no reply
 2:  2a01:260:1::225                                      16.074ms 
 3:  2a01-260-1-1--9a.core6.t-2.net                        2.567ms 
 4:  2a01-260-1-1--38.core6.t-2.net                        3.063ms asymm  3 
 5:  port-channel1.core1.zag2.he.net                      10.638ms asymm  7 
 6:  port-channel1.core1.zag2.he.net                      10.671ms asymm  7 
 7:  dodonet-v6.mix-it.net                                17.019ms 
 8:  2a00:54e0:255::5:1                                   27.520ms 
 9:  2a00:54e0:255::f:3                                   28.038ms 
10:  2a00:54e0:dcdc:0:b::5                                29.918ms 
11:  2a00:54e0:dcdc:0:b::5                                29.591ms asymm 10 
12:  ns1.dodonet.it                                       29.190ms !A
     Resume: pmtu 1500