Summary

  • RIPE 90’s official minutes say one ICMP Echo Request in Maynard Koch’s research could produce more than 250,000 replies when an IPv6 routing loop met packet duplication.
  • His NANOG 98 slides trace a common loop to a partially used provider aggregate, a customer default route and no NULL route for unused space. Operators can test their own network and stop that path at the unused prefix.

One request; more than 250,000 replies. The number appears in the official minutes of RIPE 90, where Maynard Koch described an IPv6 loop that amplified an ICMP probe. It is a specific observed case, not a typical multiplier. Its value is that it makes a neglected routing choice difficult to dismiss as housekeeping.

At NANOG 98 in Miami on 20 October, Koch walked through the smaller mistake that gives the loop a stage. A provider delegates a larger IPv6 aggregate, a customer uses only part of it, and traffic for an unused part arrives. The customer has no matching interface and sends the packet along a default route. The upstream sends it back toward the customer’s aggregate. The packet circles until its hop limit runs out. When a faulty router duplicates packets in that loop, each copy can generate another ICMP Time Exceeded response. The operational bill shifts from wasted forwarding to an amplification path.

Koch and colleagues did not learn this only from a diagram. Their Subnet-Router Anycast measurement probes router addresses across routable IPv6 space and reveals loops as a side effect. Their original measurement service lets an operator check an AS. Its 3 November 2026 page showed approximate live totals of 413 million /64 subnets that trigger loops and 779,000 that trigger amplification, across roughly 6,500 and 1,500 affected ASes respectively. Those counters describe the team’s measurement view at that snapshot.

The article’s operating question is simpler than the global totals: is your own unused space returning traffic to the upstream that sends it back?

The NANOG slides give a local check: send one ping toward an unused subnet in the network and watch the ICMP replies with a packet capture. One Time Exceeded response points to a loop; a stream of responses points to the more dangerous duplication behavior. The slides then show the fix at the place where the bad decision is made: configure a NULL route for the unused portion of the assigned aggregate so the packet stops instead of taking the default path. The team’s original measurement site repeats that instruction.

Koch’s charts put more than 90% of the loop cases and affected router IP addresses in the United States within his ARIN-region country view. That is a geographic distribution in the measured set, not a verdict on every US network. His presentation asks operators to check their own AS and correct the configuration. The job belongs at the forwarding decision, where the route either terminates the unused destination or passes the problem to a neighbor.

Sources: NANOG 98 session · Koch’s original slides · research team’s live measurements · RIPE 90 official minutes.