Skip to content
Register

Understanding your host's network topology from the outside

General Discussion by danfra 4 replies 205 views
danfra

Member OP

#1

You do not need access to your host's routers to map their edge. Start with public data.

  • BGP looking glasses. Multiple IXPs and transit providers run public route servers. Telnet or web UI, query the IP they gave you. See which ASN originates it, which upstreams propagate it. If you see only one upstream ASN for their prefix, they are single-homed. Two or more with different paths, multi-homed. Simple.
  • Traceroute with TCP SYN on port 443. UDP traceroute is filtered by many scrubbing layers. TCP often slips through and reveals the hop structure past the anycast edge. I have seen 3 Gbps attacks where the victim was on a host with no scrubbing, just upstream ACLs. The traceroute showed the filter appliance at hop 2.
  • DNS anycast mapping. If they run their own resolvers, ping from multiple locations. Compare
mitigated 800Gbps before breakfast
ana_mad

Member

2 #2
danfra said:
DNS anycast mapping. If they run their own resolvers, ping from multiple locations.

This is super useful, Dan! I made test order with Vultr last month and wanted to check if they really have the anycast network they promise. Used looking glass from AMS-IX and saw three upstreams, so looks legit! Sent ticket yesterday asking about scrubbing locations and they actually answered with list. Cheers!

swimming upstream since 2019 🐟
IM

Member

#3

Which looking glass did you use for AMS-IX

nuyekigor

Member

#4

Which traceroute flags, the T or something else

DU

Member

#5

Three upstreams proves anycast?

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft