AS35130 SFERANET-AS REGISTER S.P.A.

IPv6 prefix announced, but nothing inside is responding yet. AS35130 announces 2 IPv6 prefix(es) to the global routing table - that’s the part that BGP and our route-server scrape confirm. But our active discovery (curated hostnames, holder-derived domains, authoritative DNS NS/SOA/MX, certificate-transparency hostnames, RIPE Atlas, RDAP, IPv6 Hitlist) found no ICMPv6-responsive host inside the prefix on either vantage, and a yarrp pass against random addresses inside the prefix produced zero in-prefix hops (no router on the path through the AS replied with Time-Exceeded for any random target). That combination usually means the announcement is configured but the addresses inside aren’t in active use yet. The BGP route is there; the operational deployment is still ahead.

AS overview

Test target: 2a02:6000:ffff::1 · (no live host found) · address space: PA · prefixes announced: 2

prefix(es): 2a02:6000:ffff::/48, 2a02:6000::/33

MIX-IT / NAMEX / MINAP / TOP-IX / VSIX / EQUINIX-MILAN / BGPX-ROME / NAMEX-BARI / PCIX / DECIX-PALERMO peering

Not an MIX-IT / NAMEX / MINAP / TOP-IX / VSIX / EQUINIX-MILAN / BGPX-ROME / NAMEX-BARI / PCIX / DECIX-PALERMO member, but our traceroute path crosses the MIX-IT / NAMEX / MINAP / TOP-IX / VSIX / EQUINIX-MILAN / BGPX-ROME / NAMEX-BARI / PCIX / DECIX-PALERMO LAN from ITA host (Karsolink) - reached via an MIX-IT / NAMEX / MINAP / TOP-IX / VSIX / EQUINIX-MILAN / BGPX-ROME / NAMEX-BARI / PCIX / DECIX-PALERMO-resident transit operator.

RPKI & ASPA

2 of 2 prefix(es) covered by a valid ROA.

Prefix	RPKI state	Reason	Covering VRP(s)
`2a02:6000:ffff::/48`	✓ valid	matched VRP (correct origin, length within maxLength)	AS35130 /48 maxLen 48 (ripe); AS63017 /48 maxLen 48 (ripe)
`2a02:6000::/33`	✓ valid	matched VRP (correct origin, length within maxLength)	AS35130 /33 maxLen 33 (ripe)

Random-IP probe (yarrp) into the AS' prefixes

We probed 30 arbitrary IPv6 address(es) inside AS35130's announced prefix(es). No router inside the prefix responded. The deepest visible hop was 2001:1bd0:1:b::2 at hop 22 - that router answers ICMPv6 Echo. This is not in AS35130's announced prefix; operationally it's the AS-edge / peering interface (often on an IXP peering address or an upstream's /127 link). The traceroute boundary is the AS edge: ICMPv6 Time-Exceeded responses from anything inside this AS are filtered.

ICMPv6 Type 2 (Packet Too Big) acceptance - active test

Type 2 active test inconclusive: no Echo Reply to 1300-byte probe.
method: ICMPv6 Echo + forged PTB, tested 2026-05-25T12:31:47Z

Failure detail — what to grep in your logs

vantage	our source	your target	method	result	tested (UTC)
go6lab	`2a00:8642:42::75`	`2a02:6000:ffff::1`	`icmp6-echo`	no_echo	2026-05-25T12:31:47Z
karsolink	`2a12:d8c0:105a:9001::a154`	`2a02:6000:ffff::1`	`icmp6-echo`	no_echo	2026-05-25T12:39:47Z
odin	`2607:fae0:a000::42`	`2a02:6000:ffff::1`	`icmp6-echo`	no_echo	2026-05-25T12:31:30Z

Attempt log (go6lab):

icmp6-echo → no_echo: no Echo Reply to 1300-byte probe
dns-tcp → no_tcp: connect failed: [Errno 13] Permission denied
tls → no_tcp: TLS connect failed
http → no_tcp: tcp/80 not open

Attempt log (karsolink):

icmp6-echo → no_echo: no Echo Reply to 1300-byte probe
dns-tcp → no_tcp: connect failed: [Errno 13] Permission denied
tls → no_tcp: TLS connect failed
http → no_tcp: tcp/80 not open

Attempt log (odin):

icmp6-echo → no_echo: no Echo Reply to 1300-byte probe
dns-tcp → no_tcp: connect failed: [Errno 13] Permission denied
tls → no_tcp: TLS connect failed
http → no_tcp: tcp/80 not open

To match the corresponding ICMPv6 packet on your side (host firewall, AS edge, or transit tap), look for our PTBs around the timestamps above:

sudo tcpdump -i any -n -e 'icmp6 and ip6[40] = 2 and (src host 2607:fae0:a000::42 or src host 2a00:8642:42::75 or src host 2a12:d8c0:105a:9001::a154)'

If you see our PTBs arriving but the destination's TCP/Echo flow does not shrink, the drop is in the destination kernel (cause 3 below). If you don't see them at all, drop is upstream of you (cause 2). If you only see them from one of our two source IPs, the drop is path-asymmetric — one transit on the asymmetric route is filtering, the other is not.

From NL host (go6lab) transit only unreachable

filter likely at: past AS28716 (RETELIT-AS) · min PMTU on path: 1500

0/4

Echo small (56B) -

0/4

Echo 1500B (DF) -

yes

Type 1 dest-unreach

TCP responds on

Path (traceroute + mtr + PTR)

#	IP / PTR	RTT	mtr loss	AS	AS holder
1	2a00:8642:42::3	1.1ms	0%	AS203993	STEFFANN-DC-AS - S.J.M. Steffann, NL
2	gw.friends.steffann.nl 2a00:8642:1000:f000::1	2.2ms	0%*	AS203993	STEFFANN-DC-AS - S.J.M. Steffann, NL
3	2a00:1ca8:1::194	2.3ms	0%	AS50673	Serverius-as - Serverius Holding B.V., NL
4	2a03:3f40::10:33	6.2ms	0%	AS50673	Serverius-as - Serverius Holding B.V., NL
5	ae22-404.ams10.core-backbone.com 2a01:4a0:1338:155::1	5.5ms	0%	AS201011	CORE-BACKBONE - Core-Backbone GmbH, DE
6	ae16-2074.fra10.core-backbone.com 2a01:4a0:0:2074::3	11.0ms	0%	AS201011	CORE-BACKBONE - Core-Backbone GmbH, DE
7	ae2-2021.fra20.core-backbone.com 2a01:4a0:0:2021::4	10.6ms	0%	AS201011	CORE-BACKBONE - Core-Backbone GmbH, DE
8	6te2-2.mivivxmr01.retelit.it 2001:7f8::702c:0:1	33.8ms	0%	-	NA
9	2001:1bd0:0:2::5	21.9ms	0%	AS28716	RETELIT-AS - Retelit Digital Services S.p.A., IT
10	*	-	0%	-
11	*	-	0%	-
12	2001:1bd0:1:b::2	21.9ms	-	AS28716	RETELIT-AS - Retelit Digital Services S.p.A., IT

tracepath -6

 1?: [LOCALHOST]                        0.041ms pmtu 1500
 1:  2a00:8642:42::3                                       1.964ms 
 1:  2a00:8642:42::3                                       1.331ms 
 2:  gw.friends.steffann.nl                                2.508ms 
 3:  2a00:1ca8:1::194                                      3.049ms 
 4:  2a03:3f40::10:33                                      5.840ms 
 5:  ae22-404.ams10.core-backbone.com                      6.501ms 
 6:  ae16-2074.fra10.core-backbone.com                    11.364ms 
 7:  ae2-2021.fra20.core-backbone.com                     10.943ms 
 8:  6te2-2.mivivxmr01.retelit.it                         34.065ms asymm  7 
 9:  2001:1bd0:0:2::5                                     21.795ms asymm  8 
10:  ???                                                  22.315ms asymm  9 
11:  ???                                                  23.397ms !A
     Resume: pmtu 1500

From ITA host (Karsolink) transit only unreachable

filter likely at: past AS8968 (BT-Italia) · min PMTU on path: 1500

0/4

Echo small (56B) -

0/4

Echo 1500B (DF) -

yes

Type 1 dest-unreach

TCP responds on

Path (traceroute + mtr + PTR)

#	IP / PTR	RTT	mtr loss	AS	AS holder
1	karsolink-01.net.karsolink.com 2a12:d8c0:105a:9001::1	0.5ms	0%*	AS204471	KARSOLINK - 2S Computers SRL, IT
2	*	-	0%*	-
3	2a12:d8c0:101f:103::1	8.4ms	30%	AS204471	KARSOLINK - 2S Computers SRL, IT
4	btitalia2-v6.mix-it.net @MIX-IT / NAMEX / MINAP / TOP-IX / VSIX / EQUINIX-MILAN / BGPX-ROME / NAMEX-BARI / PCIX / DECIX-PALERMO 2001:7f8:b:100:1d1:a5d0:8968:150	9.9ms	0%	-	NA
5	2a02:4d80:ac6:2::2	10.1ms	0%	AS8968	BT-Italia - BT Italia S.p.A., IT
6	2a02:4d80:ac6:2::2	10.2ms	0%	AS8968	BT-Italia - BT Italia S.p.A., IT

Rate-limited ICMPv6: hop 3 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.031ms pmtu 1500
 1:  karsolink-01.net.karsolink.com                        0.660ms 
 1:  karsolink-01.net.karsolink.com                        0.584ms 
 2:  2a12:d8c0:109f:121::a1                                0.788ms 
 3:  2a12:d8c0:101f:103::1                                 8.900ms 
 4:  btitalia2-v6.mix-it.net                              10.248ms 
 5:  2a02:4d80:ac6:2::2                                   37.497ms 
 6:  2a02:4d80:ac6:2::2                                   36.220ms !A
     Resume: pmtu 1500

From SLO host (6connect) transit only unreachable

filter likely at: past AS28716 (RETELIT-AS) · min PMTU on path: 1500

0/4

Echo small (56B) -

0/4

Echo 1500B (DF) -

yes

Type 1 dest-unreach

TCP responds on

Path (traceroute + mtr + PTR)

#	IP / PTR	RTT	mtr loss	AS	AS holder
1	fw1-lju.6connect.com 2607:fae0:a000::2	2.1ms	0%*	AS8038	6CONNECT - 6connect, Inc., US
2	*	-	0%*	-
3	*	-	-	-
4	2a00:ee0:1:15::2	3.3ms	0%	AS5603	SIOL-NET - Telekom Slovenije, d.d., SI
5	6te2-2.mivivxmr01.retelit.it 2001:7f8::702c:0:1	17.1ms	0%	-	NA
6	2001:1bd0:0:2::5	18.5ms	0%	AS28716	RETELIT-AS - Retelit Digital Services S.p.A., IT
7	2001:1bd0:1:b::2	18.3ms	0%	AS28716	RETELIT-AS - Retelit Digital Services S.p.A., IT
8	2001:1bd0:1:b::2	19.9ms	0%	AS28716	RETELIT-AS - Retelit Digital Services S.p.A., IT

tracepath -6

 1?: [LOCALHOST]                        0.040ms pmtu 1500
 1:  fw1-lju.6connect.com                                  0.525ms 
 1:  fw1-lju.6connect.com                                  0.482ms 
 2:  no reply
 3:  no reply
 4:  2a00:ee0:1:15::2                                      1.357ms asymm  3 
 5:  6te2-2.mivivxmr01.retelit.it                         17.282ms asymm 10 
 6:  2001:1bd0:0:2::5                                     17.407ms asymm  9 
 7:  ???                                                  18.101ms asymm 10 
 8:  ???                                                  18.592ms !A
     Resume: pmtu 1500