[Tfug] Comcast Anomaly

[Adrian]

On Monday 17 April 2006 14:30, evorrie at comcast.net wrote:
Oh... one more note:

> 13  12-220-0-25.client.insightbb.com (12.220.0.25)  57.667 ms  57.802 ms  
58.127 ms
> 14  12-220-1-238.client.insightbb.com (12.220.1.238)  58.615 ms  57.573 ms  
59.127 ms
> 15  12-220-1-93.client.insightbb.com (12.220.1.93)  62.426 ms  84.802 ms  
62.683 ms
> 16  * * *
> 17  10.6.90.159 (10.6.90.159)  67.088 ms  69.857 ms  72.274 ms
[snip]
> Hop 6 moves from Comcast to AT&T Worldnet, Comcast's ISP.  12-nets usually
> are AT&T.  From hop 6 through hop 12 we stay inside the AT&T network until
> we emerge at hop 13, a client at insightbbs. This is insight Communications
> company and they use AT&T as their ISP.  Note the turnaround times on hops
> 13-15, all Insight Clients.

Your professor here says that these are InsightBB "clients". I do not believe 
that is correct... InsightBB seems to have a habit of not putting 
distingushed rDNS names on it's routers. Anything without a specific rDNS 
gets a x-x-x-x.client. rDNS name. Note the "12.220.1.238" and "12.220.1.93", 
these are in the same /24. "Clients" in a /24 subnet would not route packets 
like this.

In fact, I believe, these InsightBB IPs are InsightBB's core routers (running 
as /30 ptp serial interfaces most likely). Hop 16+, which doesn't respond to 
a traceroute, I would guess is a GBLX route (from my previous investigation, 
it appears that they have a T3 to the German exchange which is 1 hop to 
Genotec). So the actual route is "probably":
 Comcast -> ATT backbone -> Insight backone -> GBLX trans-atlantic -> Genotec

Adrian