[as112-ops] discarding request from Colt IP 217.111.216.206

Tue Dec 20 18:17:11 UTC 2016

Hi ,

We have a direct peering with you:

RP/0/8/CPU0:sar5.BCN#traceroute ipv4 ?
  WORD  Trace route to destination address or hostname
  <cr>
RP/0/8/CPU0:sar5.BCN#traceroute
Protocol [ipv4]:
Target IP address: 192.175.48.6
Source address: 217.111.216.205
Numeric display? [no]:
Timeout in seconds [3]:
Probe count [3]:
Minimum Time to Live [1]:
Maximum Time to Live [30]:
Port Number [33434]: 53
Loose, Strict, Record, Timestamp, Verbose[none]:

Type escape sequence to abort.
Tracing the route to 192.175.48.6

 1   *
    te0-6-1-0-cr1.BCN.router.colt.net (212.74.67.78) 23 msec  24 msec
 2  te0-5-1-0-cr2.MIL.router.colt.net (212.74.86.96) [MPLS: Label 16041 Exp 0] 22 msec  20 msec  22 msec
 3  te0-6-0-0-cr1.MIL.router.colt.net (212.74.87.112) [MPLS: Label 16380 Exp 0] 21 msec  22 msec  22 msec
 4  te0-2-0-0-cr2.ZRH.router.colt.net (212.74.87.115) [MPLS: Label 17919 Exp 0] 23 msec  21 msec  22 msec
 5  te0-1-0-0-pr2.ZRH.router.colt.net (212.74.87.3) 22 msec  23 msec  22 msec
 6  blackhole-1.iana.org (192.175.48.6) 23 msec  19 msec  19 msec

Stefano Bucci

-----Original Message-----
From: Clement Cavadore [mailto:clement at cavadore.net]
Sent: 20 December 2016 19:14
To: Nick Hilliard <nick at foobar.org>
Cc: Bucci, Stefano <stefano.bucci at colt.net>; as112-ops at lists.dns-oarc.net <as112-ops at dns-oarc.net>
Subject: Re: [as112-ops] discarding request from Colt IP 217.111.216.206

Hi,

On Tue, 2016-12-20 at 17:59 +0000, Nick Hilliard wrote:
> stefano.bucci at colt.net wrote:
> > As per my subject, is it possible that DNS query coming from IP
> > 217.111.216.20 owned by Colt are being discarded.

I cannot reach this IP from my ASN, it seems that traffic is blackholoed at Colt's DECIX FRA router, or mtr has strange behaviour:
 4. Te0-0-0-0-pr1.FRA.router.colt.ne  0.0%     1   10.2  10.2  10.2  10.2   0.0
 5. 212.74.67.79                      0.0%     1   37.2  37.2  37.2  37.2   0.0
 6. 212.74.67.79                      0.0%     1   36.7  36.7  36.7  36.7   0.0
(...)

> which is your nearest as112 server?  Can you provide a traceroute to
> 192.175.48.6 and 2620:4f:8000::6?

It seems that 217.111.216.20 is a Colt's spanish IP, and is sent to a node in CH:
https://portal.colt.net/lg/private/lookingGlassExec.do?action=doExecCommand&cityId=Madrid&commandId=TracertV4&ipAddress=192.175.48.6

inetnum:        212.74.70.0 - 212.74.70.255
netname:        COLT-BB-CH

[Colt Disclaimer] This email is from an entity of the Colt group of companies. Colt Group S.A., K2 Building, Forte 1, 2a rue Albert Borschette, L-1246 Luxembourg, R.C.S. B115679. Corporate and contact information for our entities can be found at http://colt.net/uk/en/Colt-Group-of-Companies/index.htm. Internet communications are not secure and Colt does not accept responsibility for the accurate transmission of this message. Content of this email or its attachments is not legally or contractually binding unless expressly previously agreed in writing by Colt