Bah, Humbug. Optical taps don't decrement TTLs or generate ICMP packets. San Francisco Bay Area cable modem networks have transitioned from @Home to AT&T Broadband to Comcast, so there is probably all sorts of expedient things done to keep it working through those transitions and IP addresses and IN-ADDR.ARPA files don't always align with how routers were divided up when companies buy/sell/exchange networks. There are probably still networks in NCR/Lucent/Olivette/AT&T that have odd IP addresses from various mergers and splits over the years. Occam's razor suggests those two hops are two routers in San Francisco connecting Comcast regional network to the AT&T common IP backbone for transit to AT&T's peering connections with other Internet backbones. Besides, why do you believe the text in an in-addr.arpa record? Or why do you think the absence of an in-addr.arpa record is meaningful? On Thu, 14 Dec 2006, bmanning@karoshi.com wrote:

i'm sure someone knows -exactly- what those two hops are, but they may not be willing to say. http://lists.elistx.com/archives/interesting-people/200605/msg00250.html might be an explaination for the paranoid.

On Thu, Dec 14, 2006 at 07:24:52AM +0000, Fergie wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

This may be far afield insofar as topic fodder, but I am curious if anyone knows exactly what these two hops [9] [10] below, actually are?

[snip]

[...]

5 165 ms 161 ms 183 ms 10g-9-1-ur04.sanjose.ca.sfba.comcast.net [68.87. 192.49] 6 155 ms 156 ms 149 ms 10g-7-1-ur03.sanjose.ca.sfba.comcast.net [68.87. 192.41] 7 * * 163 ms 10g-9-1-ar01.sfsutro.ca.sfba.comcast.net [68.87. 192.37] 8 161 ms 157 ms * 68.87.226.130 9 169 ms 185 ms 171 ms 12.116.90.17 10 197 ms 198 ms 196 ms 12.122.114.66 11 157 ms 169 ms 175 ms ggr3-ge110.sffca.ip.att.net [12.122.82.169] 12 145 ms 149 ms 148 ms 192.205.33.82 13 182 ms 196 ms 209 ms ae-2-54.bbr2.SanJose1.Level3.net [4.68.123.97] 14 344 ms 332 ms 339 ms as-0-0.mp2.Stockholm1.Level3.net [4.68.128.70] 15 330 ms 343 ms 390 ms ge-1-1.car2.Stockholm1.Level3.net [4.68.96.226]

[...]

[snip]

I have asked SBC/AT&T folks and received no reply at all...

Cheers,

- - ferg

-----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.1 (Build 1557)

wj8DBQFFgPw+q1pz9mNUZTMRAiFEAJ9y481aCutAqVuQrLcMPa3iC6SoXwCgigNC ZE+BBNraVc4VMlUKfyzYNJg= =34zg -----END PGP SIGNATURE-----

-- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

Besides, why do you believe the text in an in-addr.arpa record? Or why do you think the absence of an in-addr.arpa record is meaningful?

Back in the old days, say 10 years ago, you could run a network by the seat of your pants using rules of thumb about interpretation of in-addr.arpa records. And you could be quite successful at running a network using such techniques because everybody else was doing pretty much the same thing. Because of this uniformity, you could make a lot of intelligent guesses and resolve problems. However, I think times have changed, there is no longer uniformity among the people making technical decisions about Internet networks and many rules of thumb don't work any more even though they are still out there in network operator folklore. In fact, most people making network architectural decisions about Internet networks don't participate in NANOG any more. Most people making network operational decisions also do not participate in NANOG anymore. It's not just that many people have left NANOG behind, but a lot of newcomers to the industry over the past few years have not joined NANOG because they don't get why it is relevant to them. Not that I'm complaining about the message quoted above. It is a great example of the useful information that one can find in this mailing list. I wish there were more messages like this one, i.e. people sharing info rather than complaints and pleas for help. --Michael Dillon