AS201522 - UB330.netPARFC 4890 ✓RPKI ✓ 1/1ASPA -

← back to summary

All countriesHomeState of IPv6TopologySIXAboutipv6.si ↗ Sparky

AS overview

Test target: 2a05:33c0:0:1::11 · via IPv6 Hitlist (responsive) · address space: PA · prefixes announced: 1

prefix(es): 2a05:33c0::/48

Targets & per-vantage-point probe results (5 target(s) across 3 vantage point(s))

Source codes (hover any badge for full description): CUR=curated · NS/SOA/MX=DNS records · SPF=SPF TXT · DRV=holder-derived (www, ns1, mail, gw, …) · ATL=RIPE Atlas · PDB=PeeringDB · WHOIS=RIPE whois · RDAP=RIPE RDAP · HIT=IPv6 Hitlist · RTR=in-prefix path hop (router) · PRB=static prefix probe · SYN=synthetic prefix::1 fallback

Target IP / hostnameSourceNL host (go6lab)ITA host (Karsolink)SLO host (6connect)
ping1500B:80:443reachedping1500B:80:443reachedping1500B:80:443reached
2a05:33c0:0:1::11hit??refusedrefusedrefusedrefused
2a05:33c0:0:1::62hitopenopenopenopenopenopen
2a05:33c0:0:1::77hitopenopenopenopenopenopen
2a05:33c0::1prb??-??-??-
2a05:33c0::3hit??-??-??-

SIX peering

Not an SIX member, but our traceroute path crosses the SIX LAN from SLO host (6connect) - reached via an SIX-resident transit operator.

RPKI & ASPA

1 of 1 prefix(es) covered by a valid ROA.

PrefixRPKI stateReasonCovering VRP(s)
2a05:33c0::/48✓ validmatched VRP (correct origin, length within maxLength)AS201522 /48 maxLen 48 (ripe)

Random-IP probe (yarrp) into the AS' prefixes

We probed 15 arbitrary IPv6 address(es) inside AS201522's announced prefix(es). No router inside the prefix responded. The deepest visible hop was 2a01:260:4057::12 at hop 14 - that router answers ICMPv6 Echo. This is not in AS201522's announced prefix; operationally it's the AS-edge / peering interface (often on a SIX peering address or an upstream's /127 link). The traceroute boundary is the AS edge: ICMPv6 Time-Exceeded responses from anything inside this AS are filtered.

ICMPv6 Type 2 (Packet Too Big) acceptance - active test

Vantage points disagree about Type 2 acceptance - transit ASes on one path may be filtering Type 2 even though the destination's stack accepts it on another path:

Why they disagree - measurement artifact: One vantage's probe didn't generate enough data to detect segment shrinkage (natural reply too small, or no second response). The other vantage's verdict is the meaningful one.

Failure detail — what to grep in your logs
vantageour sourceyour targetmethodresulttested (UTC)
go6lab2a00:8642:42::752a05:33c0:0:1::11icmp6-echoinconclusive2026-05-30T10:35:17Z
karsolink2a12:d8c0:105a:9001::a1542a05:33c0:0:1::11icmp6-echohonored2026-05-30T10:44:49Z
odin2607:fae0:a000::422a05:33c0:0:1::11icmp6-echohonored2026-05-30T10:34:55Z

Attempt log (go6lab):

  1. icmp6-echoinconclusive (size_before=1460, size_after=None): no Echo Reply after PTB (probe 1500B)
  2. dns-tcpinconclusive (size_before=88, size_after=None): max DNS-over-TCP segment 88B; not big enough to test PMTU shrink
  3. tlsno_tcp: TLS connect failed
  4. httpno_tcp: tcp/80 not open

Attempt log (karsolink):

  1. icmp6-echohonored (size_before=1360, size_after=None)
  2. dns-tcpinconclusive (size_before=156, size_after=None): max DNS-over-TCP segment 156B; not big enough to test PMTU shrink
  3. tlsno_tcp: TLS connect failed
  4. httpno_tcp: tcp/80 not open

Attempt log (odin):

  1. icmp6-echohonored (size_before=1360, size_after=None): natural Echo Reply at 1400B was already split into IPv6 fragments without our PTB intervention -- the destination's stack has a cached path MTU below 1400B from a previously-honored ICMPv6 Type 2, which is itself evidence that this destination honors PTB on this path.
  2. dns-tcpinconclusive (size_before=156, size_after=None): max DNS-over-TCP segment 156B; not big enough to test PMTU shrink
  3. tlsno_tcp: TLS connect failed
  4. httpno_tcp: tcp/80 not open

To match the corresponding ICMPv6 packet on your side (host firewall, AS edge, or transit tap), look for our PTBs around the timestamps above:

sudo tcpdump -i any -n -e 'icmp6 and ip6[40] = 2 and (src host 2607:fae0:a000::42 or src host 2a00:8642:42::75 or src host 2a12:d8c0:105a:9001::a154)'

If you see our PTBs arriving but the destination's TCP/Echo flow does not shrink, the drop is in the destination kernel (cause 3 below). If you don't see them at all, drop is upstream of you (cause 2). If you only see them from one of our two source IPs, the drop is path-asymmetric — one transit on the asymmetric route is filtering, the other is not.

Where the path divergence is

Per-vantage probe + verdict (headline):

Full per-method matrix (all four methods run at each vantage):

vantageicmp6-echodns-tcptlshttp
go6labinconclusiveinconclusiveno_tcpno_tcp
karsolinkhonoredinconclusiveno_tcpno_tcp
odinhonoredinconclusiveno_tcpno_tcp

✓ All vantages agree on method(s): icmp6-echo — the headline-method spread above is dispatcher noise, not a real Type 2 disagreement.

These vantage-level disagreements are rooted somewhere in the forward paths. Joining each per-vantage traceroute against the IP→AS lookup from our global yarrp mesh, the first hop where the paths land in different ASes is the most likely site of the offending filter / unreachable AS / Type 2 drop.

Suspect transit ASes (ranked by how often they appear at the divergence point on the path of the worse-classifying vantage): AS201522, AS34779, AS50673.

Diagnosis is path-level, not packet-level: it tells you which transit AS is the prime suspect, not exactly which firewall rule is to blame. Use the tracepath6 output below (when available) for per-hop PMTU evidence on the same path.

Diagnostic interpretation

An operator-targeted diagnostic interpretation can be generated for this AS on demand. The pipeline holds the raw verdicts and the per-hop walk; an AI pass synthesises where to start looking. Click the button below to run it.

Per-hop PTB acceptance walk

From the local vantage, we walk the forward path hop-by-hop, sending each hop a 1500-byte ICMPv6 Echo, then a forged PTB (MTU=1280) sourced from us, then another 1500-byte Echo. If the second reply arrives fragmented or smaller, that hop honoured the PTB. If unchanged, it didn't. The first ✗ in an otherwise-✓ path is the most likely filter location. Cross-country aggregation: see the global PTB filter atlas for transit ASes ranked by filter rate across all measurements.

#hop IPASHolderPTB acceptance
12607:fae0:a000::2AS80386CONNECT - 6connect, Inc., US- skipped (CoPP)
2*-- (no IP)
32a03:a100:0:201:1::1AS56635XENYA - XENYA inzeniring, proizvodnja in✓ honored
42001:7f8:46::3:4779AS34779T-2✓ honored
52a01:260:1:1::93AS34779T-2-AS - T-2, d.o.o., SI✓ honored
62a01:260:4057::12AS34779T-2-AS - T-2, d.o.o., SI? no_response
72a05:33c0::3AS201522UB330-net - UB330.net d.o.o., SI? no_response
82a05:33c0:0:1::11AS201522UB330-net - UB330.net d.o.o., SI? no_response

Tests host-mode PTB acceptance (PTBs aimed at the hop itself). A router that honours PTBs to itself can still be filtering PTBs transiting through it; this is one indicator, not proof of full PTB transparency. Hops in CoPP-rate-limit ranges are skipped to avoid false signals.

tracepath6 per-hop PMTU drilldown

For each target where Type 2 verdicts disagreed across vantages, tracepath -6 ran from every vantage to capture per-hop PMTU evolution along that vantage's actual forward path. A pmtu change entry on a hop means that hop's router generated a PTB and we observed the shrink; absence of any change combined with a not_honored verdict suggests a router somewhere downstream is silently dropping >MTU packets (an RFC 4890 violation) rather than sending a PTB.

Target 2a05:33c0:0:1::62

go6lab — verdict not_honored

verdict = not_honored; final pmtu = 1500

#hop IPpmtu change
1<span class='muted'>no reply</span>
22a00:8642:1000:f000::1
32a00:1ca8:1::194
42a03:3f40::10:33
52001:7f8:13::a503:4779:1
62a01:260:1:1::95
72a01:260:4057::12
82a05:33c0::3
92a05:33c0:0:1::62
karsolink — verdict honored

verdict = honored; final pmtu = 1500

#hop IPpmtu change
1<span class='muted'>no reply</span>
22a12:d8c0:109f:121::a1
32a12:d8c0:101f:6::1
4<span class='muted'>no reply</span>
52001:470:0:414::1
62001:7f8:30:0:2:1:3:4779
72a01:260:1:1::d
82a01:260:1:1::93
92a01:260:4057::12
102a05:33c0::3
112a05:33c0:0:1::62
odin — verdict honored

verdict = honored; final pmtu = 1500

#hop IPpmtu change
1<span class='muted'>no reply</span>
22607:fae0:a000:2::2
32a03:a100:0:201:1::1
42001:7f8:46::3:4779
52a01:260:1:1::93
62a01:260:4057::12
72a05:33c0::3
82a05:33c0:0:1::62

From NL host (go6lab)   open

filter likely at: (none) · min PMTU on path: 1500

4/4
Echo small (56B) 38.7ms
3/4
Echo 1500B (DF) 38.9ms
yes
Type 1 dest-unreach
-
TCP responds on

Path (traceroute + mtr + PTR)

#IP / PTRRTTmtr lossASAS holder
12a00:8642:42::31.7ms0%AS203993STEFFANN-DC-AS - S.J.M. Steffann, NL
2gw.friends.steffann.nl
2a00:8642:1000:f000::1
2.1ms0%*AS203993STEFFANN-DC-AS - S.J.M. Steffann, NL
32a00:1ca8:1::1942.1ms10%AS50673Serverius-as - Serverius Holding B.V., NL
42a03:3f40::10:334.9ms0%AS50673Serverius-as - Serverius Holding B.V., NL
5t-2.interxionfra11.nlsix.net
2001:7f8:13::a503:4779:1
34.5ms0%-NA
62a01-260-1-1--95.core6.t-2.net
2a01:260:1:1::95
36.8ms0%AS34779T-2-AS - T-2, d.o.o., SI
72a01-260-4057--12.link6.t-2.net
2a01:260:4057::12
36.8ms0%AS34779T-2-AS - T-2, d.o.o., SI
82a05:33c0::339.1ms0%AS201522UB330-net - UB330.net d.o.o., SI
9delphi.powercom.si
2a05:33c0:0:1::11
39.6ms10%AS201522UB330-net - UB330.net d.o.o., SI

Rate-limited ICMPv6: hop 3, hop 9 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.034ms pmtu 1500
 1:  2a00:8642:42::3                                       2.173ms 
 1:  2a00:8642:42::3                                       1.590ms 
 2:  no reply
 3:  2a00:1ca8:1::194                                      3.188ms 
 4:  2a03:3f40::10:33                                      6.021ms 
 5:  t-2.interxionfra11.nlsix.net                         34.553ms asymm  6 
 6:  2a01-260-1-1--95.core6.t-2.net                       39.727ms asymm  7 
 7:  2a01-260-4057--12.link6.t-2.net                      38.656ms asymm  8 
 8:  2a05:33c0::3                                         36.565ms asymm  9 
 9:  delphi.powercom.si                                   38.126ms reached
     Resume: pmtu 1500 hops 9 back 11 

From ITA host (Karsolink)   openRFC 4890 ✓

filter likely at: (none) · min PMTU on path: 1500

3/4
Echo small (56B) 45.0ms
3/4
Echo 1500B (DF) 45.5ms
yes
Type 1 dest-unreach
443,80
TCP responds on

Path (traceroute + mtr + PTR)

#IP / PTRRTTmtr lossASAS holder
1*-0%*-
22a12:d8c0:109f:121::a10.4ms-AS204471KARSOLINK - 2S Computers SRL, IT
32a12:d8c0:101f:6::110.0ms-AS204471KARSOLINK - 2S Computers SRL, IT
4*---
5100ge0-0-0-20.core1.vie1.he.net
2001:470:0:414::1
21.7ms0%AS6939HURRICANE - Hurricane Electric LLC, US
62001:7f8:30:0:2:1:3:477920.2ms0%-NA
72a01-260-1-1--d.core6.t-2.net
2a01:260:1:1::d
44.4ms0%AS34779T-2-AS - T-2, d.o.o., SI
82a01-260-1-1--93.core6.t-2.net
2a01:260:1:1::93
43.7ms0%AS34779T-2-AS - T-2, d.o.o., SI
92a01-260-4057--12.link6.t-2.net
2a01:260:4057::12
45.9ms0%AS34779T-2-AS - T-2, d.o.o., SI
102a05:33c0::346.8ms0%AS201522UB330-net - UB330.net d.o.o., SI
11delphi.powercom.si
2a05:33c0:0:1::11
45.8ms0%AS201522UB330-net - UB330.net d.o.o., SI

tracepath -6

 1?: [LOCALHOST]                        0.032ms pmtu 1500
 1:  karsolink-01.net.karsolink.com                        1.232ms 
 1:  karsolink-01.net.karsolink.com                        0.889ms 
 2:  2a12:d8c0:109f:121::a1                                0.936ms 
 3:  2a12:d8c0:101f:6::1                                  10.682ms 
 4:  no reply
 5:  100ge0-0-0-20.core1.vie1.he.net                      22.435ms 
 6:  2001:7f8:30:0:2:1:3:4779                             20.412ms 
 7:  2a01-260-1-1--d.core6.t-2.net                        44.885ms asymm 10 
 8:  2a01-260-1-1--93.core6.t-2.net                       43.484ms asymm 10 
 9:  2a01-260-4057--12.link6.t-2.net                      47.022ms asymm 11 
10:  2a05:33c0::3                                         47.296ms asymm 12 
11:  delphi.powercom.si                                   45.260ms reached
     Resume: pmtu 1500 hops 11 back 13 

From SLO host (6connect)   openRFC 4890 ✓

filter likely at: (none) · min PMTU on path: 1500

2/4
Echo small (56B) 4.6ms
4/4
Echo 1500B (DF) 4.6ms
yes
Type 1 dest-unreach
443,80
TCP responds on

Path (traceroute + mtr + PTR)

#IP / PTRRTTmtr lossASAS holder
1fw1-lju.6connect.com
2607:fae0:a000::2
0.3ms0%*AS80386CONNECT - 6connect, Inc., US
2*---
32a03:a100:0:201:1::10.5ms50%AS56635XENYA - XENYA inzeniring, proizvodnja in trgovina, d.o.o. Ljubljana, SI
4six.t-2.si @SIX
2001:7f8:46::3:4779
1.1ms0%AS34779T-2
52a01-260-1-1--93.core6.t-2.net
2a01:260:1:1::93
1.6ms0%AS34779T-2-AS - T-2, d.o.o., SI
62a01-260-4057--12.link6.t-2.net
2a01:260:4057::12
2.4ms0%AS34779T-2-AS - T-2, d.o.o., SI
72a05:33c0::33.6ms0%AS201522UB330-net - UB330.net d.o.o., SI
8delphi.powercom.si
2a05:33c0:0:1::11
3.6ms0%AS201522UB330-net - UB330.net d.o.o., SI

Rate-limited ICMPv6: hop 3 (loss between 5% and 95% across mtr cycles - the router replies but only sometimes).

tracepath -6

 1?: [LOCALHOST]                        0.045ms pmtu 1500
 1:  fw1-lju.6connect.com                                  0.660ms 
 1:  fw1-lju.6connect.com                                  0.739ms 
 2:  no reply
 3:  2a03:a100:0:201:1::1                                  0.827ms 
 4:  six.t-2.si                                            1.123ms 
 5:  2a01-260-1-1--93.core6.t-2.net                        3.008ms 
 6:  2a01-260-4057--12.link6.t-2.net                       3.402ms 
 7:  2a05:33c0::3                                          3.075ms 
 8:  delphi.powercom.si                                    4.959ms reached
     Resume: pmtu 1500 hops 8 back 8