[as112-ops] discarding request from Colt IP 217.111.216.206

[Joe Abley]

On 20 Dec 2016, at 13:13, Clement Cavadore <clement at cavadore.net> wrote:

> On Tue, 2016-12-20 at 17:59 +0000, Nick Hilliard wrote:
>> stefano.bucci at colt.net wrote:
>>> As per my subject, is it possible that DNS query coming from IP
>>> 217.111.216.20 owned by Colt are being discarded.
> 
> I cannot reach this IP from my ASN, it seems that traffic is blackholoed
> at Colt's DECIX FRA router, or mtr has strange behaviour:
> 4. Te0-0-0-0-pr1.FRA.router.colt.ne  0.0%     1   10.2  10.2  10.2  10.2   0.0
> 5. 212.74.67.79                      0.0%     1   37.2  37.2  37.2  37.2   0.0
> 6. 212.74.67.79                      0.0%     1   36.7  36.7  36.7  36.7   0.0
> (...)
> 
>> which is your nearest as112 server?  Can you provide a traceroute to
>> 192.175.48.6 and 2620:4f:8000::6?
> 
> It seems that 217.111.216.20 is a Colt's spanish IP, and is sent to a
> node in CH:
> https://portal.colt.net/lg/private/lookingGlassExec.do?action=doExecCommand&cityId=Madrid&commandId=TracertV4&ipAddress=192.175.48.6
> 
> inetnum:        212.74.70.0 - 212.74.70.255
> netname:        COLT-BB-CH

It's so much easier to diagnose these things when you have a traceroute in both directions. Perhaps we need some kind of evldns/traceroute mashup. Ray! :-)

$ dig @blackhole-1.iana.org 1.90.212.199.traceroute.as112.net <http://traceroute.as112.net/> txt +short
"NOTREADY: traceroute in progress; ask again in a minute"
$ dig @blackhole-1.iana.org 1.90.212.199.traceroute.as112.net <http://traceroute.as112.net/> txt +short
"READY: traceroute from 192.175.48.6 to 199.212.90.1 at 183203T20161220Z"
"67.215.197.147"
"67.215.192.82"
"216.235.0.73"
"216.235.0.165"
"206.108.34.67"
"206.248.155.14"
"206.248.155.9"
"76.10.159.98"
"76.10.159.98"
"* * *"
$


Joe
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/mailman/private/as112-ops/attachments/20161220/3c05b108/attachment.html>