Who's leaking onto the peering LAN?
An IXP peering LAN should carry IP unicast, ARP and neighbour discovery between member routers, and nothing else. We watch the LAN on several IXPs and list every network sending something else, live.
Loading live data…
| State | Network | IXP | Source | Sending | Frames | First seen | Last seen |
|---|
Nobody is sending anything they shouldn't right now.
A source is a MAC address on one IXP, listed once we can tie it to a member network. It drops off 7 days after its last frame. Select a row for the network's page: its frames, a pcap and the fix. Want to hear it from us first? Get alerts when your network starts or stops leaking.
What we look for
- IPv6 RA
- IPv6 router advertisements. Peers could autoconfigure a default route through you.
- Other broadcast
- Non-ARP broadcast we have no more specific label for. The fabric floods it to every member port, and routers usually hand it to their CPU just to drop it.
- Other multicast
- L2 multicast that isn't IPv6 neighbour discovery and has no more specific label. Usually a protocol left enabled on the IX port.
- CDP
- Cisco Discovery Protocol leaks device, model and software details to every member.
- LLDP
- Link Layer Discovery Protocol leaks device details to every member.
- STP
- Spanning tree BPDUs. An IX port should never take part in spanning tree.
- MNDP
- MikroTik neighbour discovery, left enabled on the IX interface.
- MAC-Telnet
- MikroTik MAC-Telnet/Winbox discovery. It offers a management login over L2.
- MikroTik loop detect
- MikroTik loop-protect frames sent into the fabric.
- DHCP
- DHCPv4 traffic. A DHCP client or server is running on the IX port.
- DHCPv6
- DHCPv6 traffic. A DHCPv6 client or server is running on the IX port.
- Syncthing
- Syncthing local discovery. Somebody bridged a workstation onto the IX.
- ARP off-LAN
- ARP for a peering LAN address, asked from an IPv4 address outside the LAN. IXPs only allow LAN addresses on the LAN.
- ND off-LAN
- IPv6 neighbour discovery for a peering LAN address, sent from a global address outside the LAN.
- Wrong netmask
- IPv4 sent to the broadcast address of a subnet smaller than the IX's LAN. The interface has too long a prefix (a /24 on a /23), so traffic for peers in the rest of the LAN goes out as broadcast.
- IPv6 to broadcast
- IPv6 sent to the Ethernet broadcast address. IPv6 has no broadcast; neighbour discovery uses solicited-node multicast.
- RoMON
- MikroTik RoMON, a management overlay. It offers router management to anything on the LAN.
- Ubiquiti discovery
- Ubiquiti device discovery. The router announces its model, firmware and addresses to every member.
- RARP
- Reverse ARP: a device on the port asking for its own IP address.
Most of these come down to one line of config on the IX-facing interface. Each network's page shows the fix for the hardware we saw.
The fabric
The same sources, one port per source and one line card per IXP. A port's LED flickers when a frame comes in.
Your IXP isn't here?
We only see the IXPs we're connected to. If you're a member somewhere else, you can run a sensor. If you run an IXP, we'd like a port. Here's how to add your IX.