[dns-operations] f.root IPv6 highly biased towards one instance

[Jim Martin]

All,
	Just a quick update. We’ve pulled the advertisement and are reaching out to the peer mis-propagating the prefix. We had actually caught this earlier and downed the peer, but an unfortunate confluence of a forgotten save and a local power glitch caused it to inadvertently come back up.

	-JIm

> On Dec 15, 2015, at 12:42 PM, Jim Martin <jrmii at isc.org> wrote:
> 
> Sebastian,
> 	Thanks for the note. As you suspected, this is a local node and it shouldn’t be attracting traffic outside of the local exchange. It’s almost definitely someone stripping our NO_EXPORT advertisement, but we’ll know for certain shortly.  More info as I get it.
> 
> 	- Jim
> 
>> On Dec 15, 2015, at 12:08 PM, Sebastian Wiesinger <sebastian at karotte.org> wrote:
>> 
>> Hello,
>> 
>> I noticed that connections to f.root-servers.net IPv6 address
>> (2001:500:2f::f) is highly biased towards the SXM1 location. When
>> checking all RIPE atlas probes most of the answers are coming from sxm1a:
>> 
>> 45740   sxm1a.f.root-servers.org
>> 6340    pao1a.f.root-servers.org
>> 6200    pao1b.f.root-servers.org
>> 5489    ams1b.f.root-servers.org
>> 4407    ams1a.f.root-servers.org
>> 2923    sxm1b.f.root-servers.org
>> 2873    fra1a.f.root-servers.org
>> 2816    fra1b.f.root-servers.org
>> 1292    svo1b.f.root-servers.org
>> 1287    svo1a.f.root-servers.org
>> 
>> This is the local node at the Netherlands Antilles.
>> 
>> Data comes from https://atlas.ripe.net/measurements/11404/
>> 
>> When checking the beginning of 2015 it looks different:
>> 
>> 28177   ord1b.f.root-servers.org
>> 27684   ord1a.f.root-servers.org
>> 6180    ams1b.f.root-servers.org
>> 5834    pao1a.f.root-servers.org
>> 5656    pao1b.f.root-servers.org
>> 4653    atl1a.f.root-servers.org
>> 4286    ams1a.f.root-servers.org
>> 3386    atl1b.f.root-servers.org
>> 3001    fra1a.f.root-servers.org
>> 2578    fra1b.f.root-servers.org
>> 
>> As sxm1 is supposed to be a "local" instance I think that this might
>> be an error?
>> 
>> Right now I have a latency of around 150ms via IPv6 and 21ms via IPv4
>> towards f-root from my location.
>> 
>> I have the feeling this might be because HE is using this node and
>> most traffic goes over HE, at least from locations I can check right
>> now. Am I reading this wrong or should I give HE a heads up?
>> 
>> Regards
>> 
>> Sebastian
>> 
>> --
>> GPG Key: 0x93A0B9CE (F4F6 B1A3 866B 26E9 450A  9D82 58A2 D94A 93A0 B9CE)
>> 'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE.
>>           -- Terry Pratchett, The Fifth Elephant
>> _______________________________________________
>> dns-operations mailing list
>> dns-operations at lists.dns-oarc.net
>> https://lists.dns-oarc.net/mailman/listinfo/dns-operations
>> dns-jobs mailing list
>> https://lists.dns-oarc.net/mailman/listinfo/dns-jobs
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20151215/5c888eb0/attachment.sig>