Who's leaking onto the peering LAN?

An IXP peering LAN should carry IP unicast, ARP and neighbour discovery between member routers, and nothing else. We watch the LAN on several IXPs and list every network sending something else, live. New to this? Here's what it all means.

Loading live data…

A source is a MAC address on one IXP, listed once we can tie it to a member network. It drops off 7 days after its last frame. Select a row for the network's page: its frames, a pcap and the fix. Want to hear it from us first? Get alerts when your network starts or stops leaking.

What we look for

IPv6 RA: IPv6 router advertisements. Peers could autoconfigure a default route through you.
Other broadcast: Non-ARP broadcast we have no more specific label for. The fabric floods it to every member port, and routers usually hand it to their CPU just to drop it.
Other multicast: L2 multicast that isn't IPv6 neighbour discovery and has no more specific label. Usually a protocol left enabled on the IX port.
CDP: Cisco Discovery Protocol leaks device, model and software details to every member.
LLDP: Link Layer Discovery Protocol leaks device details to every member.
STP: Spanning tree BPDUs. An IX port should never take part in spanning tree.
MNDP: MikroTik neighbour discovery, left enabled on the IX interface.
MAC-Telnet: MikroTik MAC-Telnet/Winbox discovery. It offers a management login over L2.
MikroTik loop detect: MikroTik loop-protect frames sent into the fabric.
DHCP: DHCPv4 traffic. A DHCP client or server is running on the IX port.
DHCPv6: DHCPv6 traffic. A DHCPv6 client or server is running on the IX port.
Syncthing: Syncthing local discovery. Somebody bridged a workstation onto the IX.
ARP off-LAN: ARP for a peering LAN address, asked from an IPv4 address outside the LAN. IXPs only allow LAN addresses on the LAN.
ARP probe off-LAN: ARP probes from 0.0.0.0 for addresses outside the peering LAN, often on another IX's LAN. Every member's router has to handle them.
ND off-LAN: IPv6 neighbour discovery for a peering LAN address, sent from a global address outside the LAN.
Wrong netmask: IPv4 sent to the broadcast address of a subnet smaller than the IX's LAN. The interface has too long a prefix (a /24 on a /23), so traffic for peers in the rest of the LAN goes out as broadcast.
IPv6 to broadcast: IPv6 sent to the Ethernet broadcast address. IPv6 has no broadcast; neighbour discovery uses solicited-node multicast.
RoMON: MikroTik RoMON, a management overlay. It offers router management to anything on the LAN.
Ubiquiti discovery: Ubiquiti device discovery. The router announces its model, firmware and addresses to every member.
RARP: Reverse ARP: a device on the port asking for its own IP address.

Most of these come down to one line of config on the IX-facing interface. Each network's page shows the fix for the hardware we saw.

The fabric

The same sources, one port per source and one line card per IXP. A port's LED flickers when a frame comes in.

What is all this?

All of it in 2½ minutes, or read on.

The internet is tens of thousands of separate networks that agree to carry each other's traffic. This site watches some of the places where they meet.

An IXP

An internet exchange point is, more or less, a big shared switch. Networks rent a port on it and plug in a router, and every member lands on the same Ethernet LAN: the peering LAN. From there any two members can swap traffic directly, instead of paying a transit provider to carry it the long way round. The big IXPs connect hundreds of networks, a small regional one a dozen or two.

An ASN

Every network that routes its own addresses on the internet has an autonomous system number from a regional registry, such as the RIPE NCC in Europe. BGP, the protocol networks use to tell each other what they can reach, knows them by that number. AS202585 runs ix.watch, for example. PeeringDB records which network holds which address on each peering LAN, which is how we put a name to what we see.

What you're looking at

Because the peering LAN is one shared Ethernet, anything a router sends as broadcast or multicast reaches every member's port. The LAN is meant for IP between routers, plus the ARP and neighbour discovery they need to find each other. But routers ship with chatty protocols switched on: discovery protocols, spanning tree, IPv6 router advertisements, DHCP. When a network leaves those on towards the IX, we catch it, and each row above is one such sender. Mostly it's noise every member's router has to process. Sometimes it gives away device models, firmware or a management login. Occasionally it breaks things, like a router advertisement offering itself as everyone's default route. The fix is usually one line of config.

Internet exchange point and autonomous system on Wikipedia
PeeringDB, the public directory of networks, IXPs and who peers where
Allowed traffic: the list of what AMS-IX permits on its peering LAN. Most IXPs have a similar one
Euro-IX technical recommendations for running an IXP

Your IXP isn't here?

We only see the IXPs we're connected to. If you're a member somewhere else, you can run a sensor. If you run an IXP, we'd like a port. Here's how to add your IX.