I've seen packets originating from RFC1918 addresses from two fairly large european ISP's (ASN1257 & smaller ASN35706) coming in on eBGP transit links lately, and I'm a bit puzzled why it wouldn't be dropped by an ACL first entrance in my ISP's network (or really, entrance in ANY ISP's network).
While I recognize that this is not a threat, I find it interesting and I would like to know what experience other people have of this.
In this example, 192.168.146.0/24 is a RFC1918 network of mine, and port 8111 hosts a HTTP Push service for a pretty large customer.
# "FINSYN" packet
10:58:07.069638 IP 192.168.1.2.58211 > 192.168.146.101.8111: Flags [FS], seq 737341754, win 65535, options [mss 1392,nop,wscale 4,nop,nop,TS val 1648454418 ecr 0,sackOK,eol], length 0
10:59:37.115697 IP 192.168.146.101.8111 > 192.168.1.2.58214: Flags [S.], seq 49951854, ack 1797656853, win 5792, options [mss 1460,sackOK,TS val 3490717429 ecr 1648449264,nop,wscale 7], length 0
# traceroute 192.168.1.2
traceroute to 192.168.1.2 (192.168.1.2), 30 hops max, 60 byte packets
1 192.168.146.2 (192.168.146.2) 0.142 ms 0.145 ms 0.164 ms
2 a.b.c.d (a.b.c.d) 1.215 ms 1.535 ms 1.713 ms
3 * * *
4 user7x.217-10-127.netatonce.net (217.10.127.7x) 4.723 ms 4.693 ms 4.881 ms
Are my expectations sane?
Would you expect such packets to even enter your ISP's network?
Would you change ISP?
Additional feedback?