Skip to content

Instantly share code, notes, and snippets.

@sdstrowes
Last active May 14, 2018 20:39
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save sdstrowes/d2c6adb7d584d44eec36ca8691553d50 to your computer and use it in GitHub Desktop.
Save sdstrowes/d2c6adb7d584d44eec36ca8691553d50 to your computer and use it in GitHub Desktop.

Non-deterministic behaviour:

The MSS from an address is not always the same; across about 1500 hosts (collapsed to /64s here, can regenerate), different MSS values are observed in the full scan for 2018-04-30 from these:

Distinctive behaviour within the same MSS=1 sweep: these /64s have addresses that respond differently to the two TCP SYNs (time based? load balancer behaviour? unclear)

Columns are: IPs in /64, /64, mss1, mss2, holder details from stat.ripe.net

542 2406:da00:ff00:0000 8921 1420 [{"holder":"AMAZON-AES - Amazon.com","asn":14618}]
395 2620:0108:700f:0000 8921 1420 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
244 2a01:0578:0003:0000 8921 1420 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
51 2600:9000:200e:6200 1440 1220 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
37 2600:9000:200e:9800 1440 1220 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
32 2600:9000:2028:5a00 1440 1220 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
16 2620:0107:300f:0000 8921 1420 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
13 2a01:0578:0013:0000 8921 1420 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
11 2400:6500:ff00:0000 8921 1420 [{"holder":"AMAZON-02 - Amazon.com","asn":16509},{"holder":"AMAZON-AS-AP Amazon.com Tech Telecom","asn":38895}]
9 2600:9000:2028:0200 1440 1220 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
7 2400:cb00:2048:0001 1440 1220 [{"holder":"CLOUDFLARENET - Cloudflare","asn":13335}]
7 2403:b300:ff00:0000 8921 1420 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
6 2001:0470:6e0a:0000 1300 1292 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
6 2001:0638:0a06:0020 1440 1400 [{"holder":"DFN - Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.","asn":680}]
5 2001:0470:1f15:00f1 1420 1370 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
4 2400:6700:ff00:0000 8921 1420 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
3 2001:0638:0a06:3129 1440 1400 [{"holder":"DFN - Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.","asn":680}]
3 2401:2f00:ffff:ffff 1432 1420 [{"holder":"NYP-AS-AP Nanyang Polytechnic","asn":17617}]
3 2620:0108:d00f:0000 8921 1420 [{"holder":"Amazon Data Services Ireland Ltd","asn":8987}]
2 2001:0470:1f09:0d68 1420 1398 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
2 2001:0470:1f14:0525 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
2 2001:0470:1f15:0525 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
2 2001:0470:5992:0000 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
2 2600:1f11:0baa:8a00 8941 1440 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
2 2600:9000:2023:c200 1440 1220 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
2 2a02:06b8:0000:0000 1420 1390 [{"holder":"YANDEX - YANDEX LLC","asn":13238}]
1 2001:0470:000a:0147 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:000b:0461 8921 1420 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:0019:0855 1420 1362 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:001c:0288 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:001d:0288 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:0023:08ae 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:0024:08ae 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:0025:00b8 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:0039:0225 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:006d:05f7 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:006d:0976 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:006f:0765 1420 1404 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f05:0678 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f05:06db 8921 1420 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f06:083b 8921 1420 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f06:094c 8921 1420 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f08:0acb 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f08:0d8d 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f08:10f5 8921 1420 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f08:1159 8921 1420 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f09:09f0 1420 1320 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f09:0acb 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f0a:0c34 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f0a:0da2 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f0a:0f91 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f0b:0020 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f0b:0926 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f10:1007 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f12:1306 1420 1376 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f13:03ce 1420 1392 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f14:0060 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f14:0395 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f15:0085 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f15:0770 1420 1220 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f1b:05b3 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:1f1d:026c 1440 1220 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:6899:0666 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:6af9:0000 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:8afc:0000 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:8afc:cafe 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:91d7:0000 1412 1408 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:c062:0000 1420 1412 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0470:c0c7:0000 1420 1220 [{"holder":"HURRICANE - Hurricane Electric LLC","asn":6939}]
1 2001:0638:0a06:2094 1440 1400 [{"holder":"DFN - Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.","asn":680}]
1 2001:4998:000c:900e 1440 1220 [{"holder":"YAHOO-GQ1 - Yahoo","asn":36647}]
1 2001:4998:0018:0800 1440 1220 [{"holder":"YAHOO-BCST-AC2 - Yahoo","asn":36088}]
1 2001:4c78:caca:0000 1420 1408 [{"holder":"VTX-NETWORK - VTX Services SA","asn":12350}]
1 2001:4c78:caca:0001 1420 1408 [{"holder":"VTX-NETWORK - VTX Services SA","asn":12350}]
1 2401:2f00:ffff:ffff 1420 1432 [{"holder":"NYP-AS-AP Nanyang Polytechnic","asn":17617}]
1 2401:3900:0002:0100 1420 1412 [{"holder":"TRANSACT-SDN-AS TransACT Capital Communications Pty Limited","asn":7718}]
1 2403:5800:a001:6e00 65475 1440 [{"holder":"WIDEBAND-AS-AU Aussie Broadband","asn":4764}]
1 2600:1f16:0e76:b100 8941 1440 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
1 2600:1f18:66f0:9405 8941 1440 [{"holder":"AMAZON-AES - Amazon.com","asn":14618}]
1 2603:1020:0201:0002 0 1440 [{"holder":"MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation","asn":8075}]
1 2607:f178:0000:0013 216 1440 [{"holder":"DESYNC - Desync Networks","asn":30217}]
1 2801:00c4:0015:0200 1440 1460 [{"holder":"Gobierno del Estado de Mexico","asn":262922}]
1 2a00:0801:02c0:a8aa 1400 0 [{"holder":"SWIPNET - TELE2","asn":1257}]
1 2a01:00d0:8536:0000 1420 1400 [{"holder":"NASSIST-AS - NetAssist LLC","asn":29632}]
1 2a01:00d0:df25:f4ee 1420 1400 [{"holder":"NASSIST-AS - NetAssist LLC","asn":29632}]
1 2a01:0111:2005:0006 0 1440 [{"holder":"MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation","asn":8075}]
1 2a01:04f8:0201:60ce 1440 1220 [{"holder":"HETZNER-AS - Hetzner Online GmbH","asn":24940}]
1 2a01:4dc0:0000:4f00 1440 1220 [{"holder":"VOLKSWAGEN - Volkswagen AG","asn":206618}]
1 2a02:06b8:0000:0000 8890 1390 [{"holder":"YANDEX - YANDEX LLC","asn":13238}]
1 2a05:d014:0ad0:4e00 8941 1440 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
1 2a05:d014:0ad0:4e01 8941 1440 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
1 2a05:d014:0f95:3e01 8941 1440 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
1 2a05:d018:0035:5a14 8941 1440 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
1 2a05:d018:04b1:a000 8941 1440 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
1 2a05:d018:0faf:5f82 8941 1440 [{"holder":"AMAZON-02 - Amazon.com","asn":16509}]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment