Network detour: Phoenix to Houston via Newark?

Not_Oles

Here's some mtr output from my Chromebook's Linux container. May I please have some help with the questions below? Additional comments and suggestions also appreciated! Thanks!

chronos@penguin:~/servers/redacted$ mtr -brzw xxx.xxx.xxx.xxx
Start: 2024-08-28T22:12:06-0700
HOST: penguin                                                        Loss%   Snt   Last   Avg  Best  Wrst StDev    
  [ . . . ]
  8. AS6461   0.lag-58.ter1.phx2.us.zip.zayo.com (208.185.98.117)    70.0%    10   24.6  25.2  24.6  25.7   0.6
  9. AS3356   4.68.68.41                                              0.0%    10   40.7  43.1  24.7 143.7  36.2
 10. AS3356   ae7.3601.bear2.Houston1.net.lumen.tech (4.69.216.209)  80.0%    10   52.1  52.1  52.0  52.1   0.1
  [ . . . ]

1. Why is the loss so high in Hop 8 and Hop 10? I hear that packets are moving through the router's forwarding plane but that the traceroute is being handled by the router's control plane. Therefore, supposedly, the Loss % reported by mtr is not related to actual packet loss. Is what I have heard actually correct?

2. As can be inferred from the "phx" in the Hop 8 output, Hop 8 probably is in Phoenix. And as can be inferred from the "Houston1" in the Hop 10 output, Hop 10 probably is in Houston. However, according to https://www.ip2location.com/4.68.68.41, Hop 9 is in Newark. Is 4.68.68.41 really in Newark?

3. How does it make sense for Zayo in Phoenix to route packets intended for an AS that peers with Lumen in Houston through Newark? It is Zayo in Phoenix which is setting the next step in the route beyond Phoenix, right?

4. What explains why 4.68.68.41 (also AS3356, Lumen) doesn't seem to have a reverse IP address? Is there some benefit or other reason that could explain why Lumen doesn't have a reverse IP address set on 4.68.68.41 but does have a reverse IP address set on 4.69.216.209?

5. Is there something special, different, or interesting about 4.68.68.41 within Lumen's overall network structure?

Thanks!

Not_Oles

As was kindly suggested to me by @bobert on OGF, the difference between the "best ping" to Phoenix and the "best ping" to 4.68.68.41 is 0.1. This means that 4.68.68.41 probably also is in Phoenix and the geolocation database might need an update.

AuroraZero

1. Yes what you have heard is mostly correct.

It could be due to rate imiting, control plane prioritization, or selctive processing. The packet loss you are seeing is most likely not really packet loss but due to the router's handling of ICMP packets atm.

2. No probably not the GEOIP location is probably borked.

3. Your reasoning is correct but it could be due to borked GEOIP, MPLS or other tunneling, Intermediate AS handoff, traceroute wonkiness.

4. Some think no rdns is more secure, it easier to maintain, or they are just incompentent.

5. No real way to tell unless Lumen spills the beans, but as far as I am aware that would be a no.

sh97

You can use ipinfo.io
They use pings to find location and is usually very accurate

Not_Oles

@sh97 said:
You can use ipinfo.io
They use pings to find location and is usually very accurate

Hi @sh97! I went to the ipinfo.io website. I couldn't figure out how to use their site for my single inquiry about 4.68.68.41. There didn't seem to be an IP to location search box. Maybe that's because I didn't make an account and log in? Maybe I just missed something totally obvious to everyone else? Maybe I need to send an inquiry to their API with curl? How do you use ipinfo.io? Thanks!

---

Edit to add: https://ipinfo.info/html/ip_checker.php

I found that by asking Google how to look up a location on ipinfo.io. I still don't get how to find out on ipinfo.io how to use their site to look up a single location on their site.

---

Edit to add: It says Pittsburgh for 4.68.68.41. Pittsburgh still doesn't make sense based on the 0.1 ms best ping time difference from Phoenix in the above mtr.

Not_Oles

Oh! Wait! Haha!

Every once in awhile, there is something that just disappears due to my use of Chrome's High Contrast Accessibility Extension.

ipinfo.io has a big search box on their home page. But, with the Accessibility Extension, the big search box is effectively invisible to my super-myopic, astigmatic, catactified self. Sorry for the noise. In case anybody is interested, I will try to post some screenshots.

zgato

@Not_Oles said:
Oh! Wait! Haha!

Every once in awhile, there is something that just disappears due to my use of Chrome's High Contrast Accessibility Extension.

ipinfo.io has a big search box on their home page. But, with the Accessibility Extension, the big search box is effectively invisible to my super-myopic, astigmatic, catactified self. Sorry for the noise. In case anybody is interested, I will try to post some screenshots.

Easiest IMO is just https://ipinfo.io/IP (e.g https://ipinfo.io/1.1.1.1)

Not_Oles

I can read the white or green text against the black background, but not the light gray or magenta text against the white background. Every once in awhile I just can't see stuff and I miss something super obvious to everyone who can see normally.

Normal -- no High Contrast Accessibility Extension

Accessible -- with High Contrast Accessibility Extension enabled and active

Not_Oles

@Not_Oles said: Edit to add: It says Pittsburgh for 4.68.68.41. Pittsburgh still doesn't make sense based on the 0.1 ms best ping time difference from Phoenix in the above mtr.

Here's a screenshot of ipinfo.io saying the location of 4.68.68.41 is Pittsburgh, if I understand correctly.

sh97

@Not_Oles said:

@Not_Oles said: Edit to add: It says Pittsburgh for 4.68.68.41. Pittsburgh still doesn't make sense based on the 0.1 ms best ping time difference from Phoenix in the above mtr.

Here's a screenshot of ipinfo.io saying the location of 4.68.68.41 is Pittsburgh, if I understand correctly.

Weird, shows phoenix for me

Wonder_Woman

@Not_Oles

~$ curl -SsLf ipinfo.io/4.68.68.41
{
  "ip": "4.68.68.41",
  "city": "Phoenix",
  "region": "Arizona",
  "country": "US",
  "loc": "33.4484,-112.0740",
  "org": "AS3356 Level 3 Parent, LLC",
  "postal": "85001",
  "timezone": "America/Phoenix",
  "readme": "https://ipinfo.io/missingauth"
}

Jab

@Not_Oles said: Here's a screenshot of ipinfo.io saying the location of 4.68.68.41 is Pittsburgh, if I understand correctly.

This is not ipinfo.io, this more looks like ipinfo.info.
Different websites.

Not_Oles

@Jab said:

@Not_Oles said: Here's a screenshot of ipinfo.io saying the location of 4.68.68.41 is Pittsburgh, if I understand correctly.

This is not ipinfo.io, this more looks like ipinfo.info.
Different websites.

You are right! I still had the tab open, so I looked again. The link for the screenshot is https://ipinfo.info/html/ip_checker.php.

ipinfo.io versus ipinfo.info

Thanks @jab!