Nine-IX
Who's leaking onto Nine-IX's peering LAN, live: every member sending something other than IP unicast, ARP and neighbour discovery.
Connecting…
Loading live data…
| State | Network | IXP | Source | Sending | Frames | First seen | Last seen |
|---|
A source is a MAC address on one IXP, listed once we can tie it to a member network. It drops off 7 days after its last frame. Select a row for the network's page: its frames, a pcap and the fix. Want to hear it from us first? Get alerts when your network starts or stops leaking.
What we look for
- IPv6 RA
- IPv6 router advertisements. Peers could autoconfigure a default route through you.
- Other broadcast
- Non-ARP broadcast we have no more specific label for. The fabric floods it to every member port, and routers usually hand it to their CPU just to drop it.
- Other multicast
- L2 multicast that isn't IPv6 neighbour discovery and has no more specific label. Usually a protocol left enabled on the IX port.
- CDP
- Cisco Discovery Protocol leaks device, model and software details to every member.
- LLDP
- Link Layer Discovery Protocol leaks device details to every member.
- STP
- Spanning tree BPDUs. An IX port should never take part in spanning tree.
- MNDP
- MikroTik neighbour discovery, left enabled on the IX interface.
- MAC-Telnet
- MikroTik MAC-Telnet/Winbox discovery. It offers a management login over L2.
- MikroTik loop detect
- MikroTik loop-protect frames sent into the fabric.
- DHCP
- DHCPv4 traffic. A DHCP client or server is running on the IX port.
- DHCPv6
- DHCPv6 traffic. A DHCPv6 client or server is running on the IX port.
- Syncthing
- Syncthing local discovery. Somebody bridged a workstation onto the IX.
- ARP off-LAN
- ARP for a peering LAN address, asked from an IPv4 address outside the LAN. IXPs only allow LAN addresses on the LAN.
- ARP probe off-LAN
- ARP probes from 0.0.0.0 for addresses outside the peering LAN, often on another IX's LAN. Every member's router has to handle them.
- ND off-LAN
- IPv6 neighbour discovery for a peering LAN address, sent from a global address outside the LAN.
- Wrong netmask
- IPv4 sent to the broadcast address of a subnet smaller than the IX's LAN. The interface has too long a prefix (a /24 on a /23), so traffic for peers in the rest of the LAN goes out as broadcast.
- IPv6 to broadcast
- IPv6 sent to the Ethernet broadcast address. IPv6 has no broadcast; neighbour discovery uses solicited-node multicast.
- RoMON
- MikroTik RoMON, a management overlay. It offers router management to anything on the LAN.
- Ubiquiti discovery
- Ubiquiti device discovery. The router announces its model, firmware and addresses to every member.
- RARP
- Reverse ARP: a device on the port asking for its own IP address.
Most of these come down to one line of config on the IX-facing interface. Each network's page shows the fix for the hardware we saw.
The fabric
The same sources, one port per source and one line card per IXP. A port's LED flickers when a frame comes in.
Run Nine-IX?
Get a mail when a member starts or stops leaking onto the LAN, including the MACs we can't tie to a network. Free for IX operators: set up alerts for Nine-IX.
A member leaking? Each network's page has the frames, a pcap and the fix for the hardware we saw. Send it to them, or help us watch more IXPs.