More info

[Drsolly <drsollyp () drsolly com>]

I've determined two more byte sequences that trigger the block, in 
addition to bc bc bc bc bc bc

There's also

1c 1c 1c 1c 1c 1c

and

e4 64 1c 1c 1c 1c

Which means there's probably other sequences that I hven't narrowed down 
on yet.

Please keep supplying the Works/not works info and the traceroutes. I've
got a hypothesis now that the culprit is the London Internet Exchange
(linx), because that's the common factor in the bad ones, and it's in none
of the good ones. They run 100 gbit/sec. It's unthinkable that they would
be doing any sort of packet inspection, though, so I'm still very much of
an open mind.


_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.