Anycast measurement lab
This is the non-commercial side of a small project that measures anycast catchments: which networks reach which node of an anycast service, over IPv4 and IPv6. The lab runs its own ASN and prefixes and announces them from a handful of locations. Today those prefixes carry only our own authoritative DNS; once measurement starts, they will also send low-rate probe packets to the Internet. This page documents exactly what that traffic will be, how to recognise it, and how to make it stop for your networks — the opt-out works before the first packet.
If you got here from a firewall log or a reverse-DNS lookup: here is how to confirm it was us, and here is the opt-out. No reason required, no questions asked.
Operated by Portalix UG (haftungsbeschränkt), München, Germany. The same team sells measurement services at anycast.dev; this lab is where the method is developed and published. The two are kept apart on purpose: the lab's prefixes carry no commercial service and no customer traffic.
Current status
| Active probing | not started No measurement packets have been sent from lab prefixes yet. The prefixes below currently carry only authoritative DNS for our own domains. |
|---|---|
| ASN | AS218833 (ANYCAST-LAB), assigned by RIPE NCC on 2026-08-28 via sponsoring LIR Via-Registry / Virtua Systems. Organisation: Portalix UG, abuse contact abuse@anycast.org. |
| IPv4 prefix | 94.249.165.0/24, announced since 2026-08-29. Leased from GHOSTnet GmbH (AS12586); RPKI ROA and IRR route object registered for AS218833. Carries 94.249.165.53 (authoritative DNS for our own domains) and 94.249.165.1. |
| IPv6 prefix | 2a03:5840:161::/48, announced since 2026-08-28. RPKI ROA and route6 object registered for AS218833. Carries 2a03:5840:161::53 (authoritative DNS) and 2a03:5840:161::1. |
| What the prefixes carry | Authoritative DNS for domains we own ourselves, dual-stack. No customer traffic, no probing yet. When active probing starts, the source addresses will be listed here before the first packet leaves. |
| Locations | live: Frankfurt (Virtua Systems / AS35661 upstream), New Jersey (Vultr / AS20473 upstream), both announcing both prefixes. Further locations are added as documented experiments. |
| External measurements | We also run DNS measurements through RIPE Atlas. Those packets come from Atlas probes, not from our prefixes, and are governed by RIPE Atlas' own rules. |
| Last updated | 2026-08-29 |
What our probes do
We use the Verfploeter method (de Vries et al., IMC 2017; used in production at B-Root and for .nl): one lab node sends ICMP echo requests with the anycast address as the source; every lab node records which replies arrive there. The node that receives your reply is the node BGP routes you to. That is the whole measurement.
- Packet type: ICMP echo request (IPv4) and ICMPv6 echo request. Nothing else. No TCP, no UDP, no port scans, no application-layer payloads.
- Targets: one address per routed /24 (IPv4) or per /48 (IPv6), taken from public responsive-address lists, minus our exclusion list.
- Rate: at most a few hundred packets per second in total across the whole Internet; one packet per target network per run. A full run takes several hours. 1–2 runs per day, occasionally an extra run after a routing event.
- Size: small packets (under 100 bytes). The payload carries a plain-text identifier with this page's address.
- Identification: source addresses have reverse DNS under
anycast.org, the prefixes are registered to the lab ASN with an abuse contact, and this page is linked from the payload. - No exploitation, no persistence: we never connect to services, never retry a target that does not answer within a run, never follow up on anything we learn about a host.
For the commercial Health Check we do not probe customer networks from here at all; those measurements are DNS queries from RIPE Atlas to the customer's own nameservers, ordered by that customer.
How to confirm it was us
- The source address is inside one of the prefixes listed under Status.
dig -x <source address>returns a name ending in.anycast.org, for exampleprobe-fra1.anycast.org. (Reverse DNS for the probe addresses is set before the first run; until then no probe traffic exists to check.)- The RIPE database (
whois <source address>) shows the lab ASNANYCAST-LAB, organisation Portalix UG, andabuse@anycast.orgas abuse contact. - The ICMP payload contains the string
anycast.org measurement - opt-out: https://anycast.org/#opt-out.
If a packet claims to be from us and fails these checks, it was not us. Please tell us at abuse@anycast.org; spoofed measurement traffic is something we want to know about.
Opt out
Send the prefixes or AS numbers you want excluded to optout@anycast.org, or use the form. We add them to the exclusion list within two business days, confirm by e-mail, and never probe them again. The list applies to every future run and to every lab node. No justification needed.
We keep the exclusion list private (it is a list of networks that asked not to be contacted). We verify that the requester is plausibly responsible for the prefix (RIPE/ARIN/APNIC contact, or mail from the network's domain) only to prevent someone from excluding networks they do not operate; we do not challenge the request itself.
What we store and publish
- Stored per run: target network (/24 or /48), which lab node received the reply, round-trip time, timestamp. That is the entire record. We do not store packet contents, and we do not keep per-host information beyond the one probed address per network.
- Enrichment: origin AS and country per network from public routing data and a commercial geolocation database, used for aggregation only.
- Published: aggregated catchment maps and statistics (per country, per AS, per node). Findings about a specific third-party network are shared with that network's operator first and published only in aggregate or with the operator's consent.
- Retention: raw run data for 12 months, aggregates indefinitely.
- Personal data: measurement records concern network infrastructure, not people. Opt-out requests (e-mail address, prefixes) are kept as long as the exclusion is in force. Privacy policy: anycast.org/privacy.
Why we do this
Anycast is how most of the Internet's DNS (and a good part of its CDNs) is delivered, and operators mostly cannot see where their traffic actually lands. The measurement method is published and well understood, but it has never been available to small operators. The lab exists to build that tooling in the open: the measurement agent is open source at github.com/portalix/anycast-agent, the method and results are published, and BGP traffic-engineering experiments on the lab's own prefixes are documented so others can learn from them.
References
- W. de Vries, R. de O. Schmidt, W. Hardaker, J. Heidemann, P.-T. de Boer, A. Pras: Broad and Load-Aware Anycast Mapping with Verfploeter, ACM IMC 2017.
- A. S. M. Rizvi, L. Bertholdo, J. Ceron, J. Heidemann: Anycast Agility: Network Playbooks to Fight DDoS, USENIX Security 2022.
- RIPE NCC: RIPE Atlas, atlas.ripe.net.
Contact
| Abuse | abuse@anycast.org (also the abuse-c in the RIPE database) |
|---|---|
| Opt-out | optout@anycast.org |
| Network operations | noc@anycast.org |
| Peering | PeeringDB: AS218833 — open peering policy, no exchange presence yet |