Re: Finding asymmetric path

[William Herrin <herrin-nanog () dirtside com>]

On Fri, Nov 27, 2009 at 10:43 PM, ML <ml () kenweb org> wrote:
> I'm reasonable certain a customer of ours who is using one of our netblocks
> is using a different reverse path to reach us.  How might I figure out who
> is allowing them to source traffic from IPs that belong to us?

Hi,

Are they complaining about somehting? If so, ask for a traceroute.

You might also try calling and asking. "We're seeing some strange
traffic purporting to be from your addresses but not coming from your
circuit. We're concerned that someone might be attacking your network.
Before taking action to protect you, we want to eliminate the
possibility that you have a second ISP through which you're
accidentally sourcing the packets."

Beyond that, what's your game plan once you know the answer? Threaten
to cut them off? That's a great way to lose a customer who you know
*already* has a second ISP.  Maybe you'll call their second ISP and
complain about their filtering practices? I'd love to get that call
from you. Tells me exactly which name to pass to my upsell specialist.
Yes Mr. Customer, your other ISP is trying to cut you off. They even
asked us to block your packets. But for just a little more we'll give
you IP addresses that you can use with any ISP.

Regards,
Bill Herrin



-- 
William D. Herrin ................ herrin () dirtside com  bill () herrin us
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004