Closed paulmenzel closed 1 year ago
Hey @paulmenzel!
here's a run down of what I think is happening:
1) the path to your target crosses a bunch of hops (the 88.220.x.x ones) which belong to unannounced prefixes (likely used internally for a PNI/internal network handover between the "main" ASN-TELENERGO network and the EXATEL-NET one - which I assume is some subdivision of the former - not really familiar with Polish ISPs). Therefore Team Cymru has no data about the 80.220.x.x IPs.
2) Since 80.220.x.x is unannounced and unknown, asn
tries to detect if it's an IXP prefix, by querying PeeringDB
3) PeeringDB has recently introduced throttling if you query them without an API key (which I honestly deem overkill), so while this should not happen very often during daily use (it's rare to find more unannounced subsequent IPs in a traceroute, they're more likely private IPs than unannounced public ones), in your scenario we're querying PeeringDB continuously.
4) After two/three queries in rapid succession, PeeringDB will fail on you with a "throttled" error - you can quickly verify this by running this command in a shell and repeating it for 3/4 times : curl -s "https://www.peeringdb.com/api/ixpfx?prefix__startswith=88.220&protocol__in=IPv4"
I think it's not worth it to introduce the burden of yet another API key just for PeeringDB (I strive to focus on free, public APIs that require no key - that's why I added shodan only after I found out about their "no API key" service aka InternetDB)
Nevertheless, it's an error and it has to be handled. I could either cache the previous queries so as to not run them more than once on the same subnet (i.e. it would query 88.220.x.x only once, and thus not get throttled), or simply choose to ignore the "throttled" json response, and get a clean output even though under the hood it's not really getting anything from PeeringDB anymore and can potentially miss a real IXP later in the trace. It's an edge case from what I can tell, so it may not be worth it, but I'm open for suggestions in case you had this happen on you more often - as I said I'm not familiar with how they "do it" in Poland, so I may have a wrong bias here :-)
Thanks for reporting!
From a Hotel Wifi I get: