Finding asymmetric path

William Herrin herrin-nanog at dirtside.com
Sat Nov 28 10:22:04 CST 2009


On Fri, Nov 27, 2009 at 10:43 PM, ML <ml at kenweb.org> wrote:
> I'm reasonable certain a customer of ours who is using one of our netblocks
> is using a different reverse path to reach us.  How might I figure out who
> is allowing them to source traffic from IPs that belong to us?

Hi,

Are they complaining about somehting? If so, ask for a traceroute.

You might also try calling and asking. "We're seeing some strange
traffic purporting to be from your addresses but not coming from your
circuit. We're concerned that someone might be attacking your network.
Before taking action to protect you, we want to eliminate the
possibility that you have a second ISP through which you're
accidentally sourcing the packets."

Beyond that, what's your game plan once you know the answer? Threaten
to cut them off? That's a great way to lose a customer who you know
*already* has a second ISP.  Maybe you'll call their second ISP and
complain about their filtering practices? I'd love to get that call
from you. Tells me exactly which name to pass to my upsell specialist.
Yes Mr. Customer, your other ISP is trying to cut you off. They even
asked us to block your packets. But for just a little more we'll give
you IP addresses that you can use with any ISP.

Regards,
Bill Herrin



-- 
William D. Herrin ................ herrin at dirtside.com  bill at herrin.us
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004




More information about the NANOG mailing list