On Wed, Nov 13, 2019 at 4:35 PM Toke Høiland-Jørgensen <toke@toke.dk> wrote:

> "Rodney W. Grimes" <4bone@gndrsh.dnsmgr.net> writes:
>
> >> -t is the TOS value; so those two happen to correspond to ECT(1) and
> >> ECT(0); and as you can see they go two different paths. Which would be
> >> consistent with the SYN going one way and the data packets going
> >> another.
> >
> > Perhaps Old enough that maybe they are treating that as TOS byte?
> >
> > Looks like you have nailed it though, someone has a broken hash.
>
> Yup, seems like it. Posted a writeup to the NANOG list in response to
> the guy asking; it hasn't showed up in the archive, though, so I guess
> it's still in the moderation queue.
>
> I think I'll write the whole thing up as a blog post as well, once it's
> resolved. I'll see if I can get them to tell me which router make and
> model is doing this.
>
> Thanks everyone who helped with ideas etc! :)
>
>
great! You'll get a free subscription for a full year!




> -Toke
>