On 2004-07-01-22:35:22, Richard A Steenbergen <ras@e-gerbil.net> wrote: [...]
At the very least, you can tell the difference between Juniper and Cisco (pos2-3 vs. so-2-3-0).
...unless you're dealing with networks who uniformly use the "p[os]" or "so" suffix for Packet-over-SONET interfaces, regardless of what kind of hardware it's terminating on. In example: 5 so-0-0-0.mp1.Weehawken1.Level3.net (64.159.1.66) 1.065 ms 0.997 ms 1.046 ms 6 so-9-0.hsa2.Weehawken1.Level3.net (209.247.8.14) 1.563 ms 0.984 ms 1.047 ms Hmmm. Not knowing anything about what kind of hardware this actually is, and judging solely from TCP fingerprinting and response behavior, #5 smells like a Juniper and #6 smells like a Cisco. Then there are those who use the same designator ("s") for SONET interface as they do for serial/T1 interfaces. Or those who make a vendor-indicative PTR entry for a PNI, then move the link to a different platform, and don't bother updating DNS. Or those who find it cool to have gigabit-speed /30's reverse to something with "dsl" or "dialup" in it, out of incompetence or modesty. Or those who play the old "ip addr ... secondary" game on Cisco gear, along with bogus /30's and PTR's as the primary address to lie about link speed in traceroute replies. Or those who are outright deceptive in what their PTR's say vs. reality. (Nobody on this list, of course!) As always, DNS doesn't tell the full story. But we're preaching to the choir here... -a