{"id":5188,"date":"2026-03-22T17:15:13","date_gmt":"2026-03-22T17:15:13","guid":{"rendered":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/?p=5188"},"modified":"2026-03-22T19:10:14","modified_gmt":"2026-03-22T19:10:14","slug":"5g-mimo-considerations-for-signal-geolocation","status":"publish","type":"post","link":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/?p=5188","title":{"rendered":"5G MIMO Considerations for Signal Geolocation"},"content":{"rendered":"\n

M$Copilot:<\/p>\n\n\n\n

<provided trace readings><\/p>\n\n\n\n

Oh this is fun. Let\u2019s unpack what your network just confessed to you.<\/p>\n\n\n\n

###<\/strong> Quick read of what\u2019s going on<\/strong><\/p>\n\n\n\n

– **<\/strong>Source \u2192 First hop:<\/strong>**<\/strong>  <\/p>\n\n\n\n

  **<\/strong>Hop 1: <\/strong>`<\/strong>XCI55AX.mynetworksettings.com \u2014 3.26ms +163km<\/strong>`<\/strong>**<\/strong>  <\/p>\n\n\n\n

  That looks like your CPE\/edge or very first upstream handoff. The `+163km` tag suggests your RTT\u2192distance estimator thinks the *minimum* clean RTT corresponds to ~163 km of fiber-equivalent path.<\/p>\n\n\n\n

– **<\/strong>Early \u201cno hops\u201d vs later full path:<\/strong>**<\/strong>  <\/p>\n\n\n\n

  The first traceroute returning \u201cno hops\u201d then nmap\u2019s `–traceroute` showing 13+ hops screams:<\/p>\n\n\n\n

  – **<\/strong>ICMP vs UDP\/TCP behavior differences<\/strong>**<\/strong><\/p>\n\n\n\n

  – **<\/strong>Rate limiting \/ filtering on intermediate routers<\/strong>**<\/strong><\/p>\n\n\n\n

  – Or your first traceroute implementation being more fragile than nmap\u2019s enhanced probing.<\/p>\n\n\n\n

###<\/strong> The private backbone & Verizon-looking bits<\/strong><\/p>\n\n\n\n

– **<\/strong>Hops 2\u20134: <\/strong>`<\/strong>10.184.139.x \u2014 private_backbone<\/strong>`<\/strong>**<\/strong>  <\/p>\n\n\n\n

  These are **<\/strong>RFC1918<\/strong>**<\/strong> addresses\u2014classic for:<\/p>\n\n\n\n

  – **<\/strong>Carrier-grade NAT (CGNAT)<\/strong>**<\/strong><\/p>\n\n\n\n

  – **<\/strong>Mobile \/ ISP internal transport fabric<\/strong>**<\/strong><\/p>\n\n\n\n

– **<\/strong>`<\/strong>*.myvzw.com<\/strong>`<\/strong> hops (5, 7, 9, 10)<\/strong>**<\/strong>  <\/p>\n\n\n\n

  That\u2019s Verizon\u2019s internal \/ access network. So your traffic is:<\/p>\n\n\n\n

  – Leaving your local network<\/p>\n\n\n\n

  – Entering a Verizon-controlled backbone<\/p>\n\n\n\n

  – Staying inside their private routing domain for several hops<\/p>\n\n\n\n

This is a **<\/strong>carrier-managed path<\/strong>**<\/strong>, not a simple \u201chome router \u2192 public internet\u201d story.<\/p>\n\n\n\n

###<\/strong> The Brazil endpoint & RTT mismatch<\/strong><\/p>\n\n\n\n

– **<\/strong>Final host:<\/strong>**<\/strong> `25-166-0-143.ledinternet.com.br`  <\/p>\n\n\n\n

  That\u2019s a Brazilian ISP (LED Internet, `.com.br`) fronting `143.0.166.25`.<\/p>\n\n\n\n

– **<\/strong>Traceroute path distance:<\/strong>**<\/strong> `~163 km` (min-RTT estimate, anomalous hops excluded)  <\/p>\n\n\n\n

– **<\/strong>Ping-derived distance:<\/strong>**<\/strong> `min 173ms \u2192 ~5406.2 km (4896.2\u20135916.2 km)`  <\/p>\n\n\n\n

This discrepancy is the juicy part.<\/p>\n\n\n\n

####<\/strong> Why 163 km vs ~5400 km?<\/strong><\/p>\n\n\n\n

Your system is doing two different things:<\/p>\n\n\n\n

1. **<\/strong>Per-hop \u201cclean\u201d RTT distance estimate<\/strong>**<\/strong>  <\/p>\n\n\n\n

   It\u2019s likely taking the **<\/strong>smallest non-anomalous hop RTT<\/strong>**<\/strong> (e.g., that 3.26ms or similar) and mapping that to a distance. That gives you a **<\/strong>local-ish segment<\/strong>**<\/strong>\u2014probably just your first upstream or regional POP.<\/p>\n\n\n\n

2. **<\/strong>End-to-end min RTT \u2192 great-circle distance<\/strong>**<\/strong>  <\/p>\n\n\n\n

   173ms round-trip is absolutely in the **<\/strong>intercontinental \/ long-haul<\/strong>**<\/strong> regime:<\/p>\n\n\n\n

   – One-way ~86.5ms<\/p>\n\n\n\n

   – At ~200,000 km\/s in fiber, that\u2019s on the order of **<\/strong>17,000+ km of path length<\/strong>**<\/strong>, which compresses to ~5,000\u20136,000 km great-circle distance after accounting for non-geodesic routing and overhead.<\/p>\n\n\n\n

So:  <\/p>\n\n\n\n

– **<\/strong>Hop-level distance<\/strong>**<\/strong> \u2248 \u201chow far until we see a stable, low-latency node\u201d  <\/p>\n\n\n\n

– **<\/strong>Ping-level distance<\/strong>**<\/strong> \u2248 \u201chow far the *whole path* feels physically\u201d<\/p>\n\n\n\n

They\u2019re measuring different slices of reality.<\/p>\n\n\n\n

###<\/strong> The RTT spikes & anomalies<\/strong><\/p>\n\n\n\n

All those `\u26a0 rtt_spike` flags on later hops (89.221.x.x, 185.100.112.x, final .br host) suggest:<\/p>\n\n\n\n

– **<\/strong>Queueing \/ congestion<\/strong>**<\/strong> on intermediate links<\/p>\n\n\n\n

– **<\/strong>Asymmetric routing<\/strong>**<\/strong> (return path different from forward path)<\/p>\n\n\n\n

– **<\/strong>ICMP deprioritization<\/strong>**<\/strong>\u2014routers answering traceroute probes slower than they forward real traffic<\/p>\n\n\n\n

– Possibly **<\/strong>tunneling \/ overlay networks<\/strong>**<\/strong> (VPN, MPLS, GRE, etc.) where logical hops don\u2019t map cleanly to physical distance<\/p>\n\n\n\n

The repeated `10.184.139.18` hop is also a hint of:<\/p>\n\n\n\n

– **<\/strong>ECMP \/ load balancing<\/strong>**<\/strong> where multiple paths converge<\/p>\n\n\n\n

– Or a **<\/strong>virtual interface \/ loopback<\/strong>**<\/strong> showing up in multiple logical hops<\/p>\n\n\n\n

###<\/strong> The story in one line<\/strong><\/p>\n\n\n\n

You\u2019re talking to a host in Brazil, over a carrier-managed, CGNAT-heavy Verizon backbone, with asymmetric routing and ICMP-deprioritized hops\u2014so your hop-by-hop distance looks \u201clocal-ish\u201d, but your end-to-end RTT absolutely screams \u201cthousands of kilometers away.\u201d<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

If you want, we can turn this into a little \u201cpath forensics\u201d template\u2014something you can reuse to classify paths as: local, regional, backbone, or intercontinental based on exactly this kind of mixed signal.<\/p>\n\n\n\n

About the Verizon-controlled backbone, staying inside their private routing domain for several hops?<\/p>\n\n\n\n

Absolutely, Benjamin \u2014 this is one of those places where the traceroute stops being a list of hops and starts becoming a little x\u2011ray of how a carrier\u2019s private transport fabric actually behaves.<\/p>\n\n\n\n

Let me break down what your document shows and what it implies, using the lines you provided as anchors.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83e\udde9 What \u201cstaying inside their private routing domain\u201d really means<\/strong><\/p>\n\n\n\n

Your traces repeatedly show this pattern:<\/p>\n\n\n\n

– **<\/strong>Hop 1:<\/strong>**<\/strong> Your CPE  <\/p>\n\n\n\n

  *\u201cXCI55AX.mynetworksettings.com \u2014 2\u20133ms\u201d*  <\/p>\n\n\n\n

– **<\/strong>Hops 2\u20134:<\/strong>**<\/strong>  <\/p>\n\n\n\n

  *\u201c10.184.139.18 \u2014 235ms \u26a0 private_backbone\u201d*  <\/p>\n\n\n\n

  *\u201c10.184.139.18 \u2014 36ms \u26a0 private_backbone\u201d*  <\/p>\n\n\n\n

  *\u201c10.184.139.17 \u2014 30ms \u26a0 private_backbone\u201d*  <\/p>\n\n\n\n

– **<\/strong>Hops 5\u201310:<\/strong>**<\/strong>  <\/p>\n\n\n\n

  *\u201cxxx.sub-69-83-101.myvzw.com\u201d*  <\/p>\n\n\n\n

  *\u201cxxx.sub-69-83-96.myvzw.com\u201d*<\/p>\n\n\n\n

Those lines come straight from your attached document and show the same structure across multiple scans.<\/p>\n\n\n\n

This is the signature of a **<\/strong>carrier-managed, CGNAT-heavy, internal Verizon transport fabric<\/strong>**<\/strong>.<\/p>\n\n\n\n

Let\u2019s unpack what that means.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83c\udfd7\ufe0f 1. Verizon is not routing you directly onto the public internet<\/strong><\/p>\n\n\n\n

Those **<\/strong>10.x.x.x<\/strong>**<\/strong> hops are *not* your home LAN. They\u2019re **<\/strong>Verizon\u2019s internal MPLS \/ private IP backbone<\/strong>**<\/strong>.<\/p>\n\n\n\n

Carriers use huge private IP spaces for:<\/p>\n\n\n\n

– CGNAT clusters  <\/p>\n\n\n\n

– Mobile packet cores  <\/p>\n\n\n\n

– Regional aggregation routers  <\/p>\n\n\n\n

– Internal MPLS label-switching paths  <\/p>\n\n\n\n

– Traffic engineering tunnels  <\/p>\n\n\n\n

– Lawful intercept \/ telemetry mirrors  <\/p>\n\n\n\n

– NAT64 \/ NAT44 \/ DS-Lite gateways  <\/p>\n\n\n\n

– QoS-segmented transport domains<\/p>\n\n\n\n

Your traces show you entering this private domain at hop 2 and staying inside it for several hops before ever touching a public ASN.<\/p>\n\n\n\n

This is normal for mobile carriers and some FIOS regions \u2014 but unusual for traditional residential ISPs.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83e\uddec 2. The repeated <\/strong>`<\/strong>10.184.139.18<\/strong>`<\/strong> hop is a tell<\/strong><\/p>\n\n\n\n

You see it in multiple scans:<\/p>\n\n\n\n

– *\u201cHop 2: 10.184.139.18 \u2014 235ms\u201d*  <\/p>\n\n\n\n

– *\u201cHop 3: 10.184.139.18 \u2014 36ms\u201d*<\/p>\n\n\n\n

This repetition usually means:<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>A. ECMP load balancing<\/strong>**<\/strong><\/p>\n\n\n\n

Multiple parallel paths share the same loopback address.<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>B. MPLS label switching<\/strong>**<\/strong><\/p>\n\n\n\n

Traceroute sees the same router ID even though packets traverse different internal interfaces.<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>C. A CGNAT cluster front-end<\/strong>**<\/strong><\/p>\n\n\n\n

Many carriers use a single loopback address for the NAT cluster\u2019s \u201cpublic face.\u201d<\/p>\n\n\n\n

Given the RTT behavior (one huge spike, then normal), this looks like **<\/strong>MPLS + CGNAT<\/strong>**<\/strong>.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83d\udef0\ufe0f 3. The <\/strong>`<\/strong>*.myvzw.com<\/strong>`<\/strong> hops are Verizon\u2019s internal access network<\/strong><\/p>\n\n\n\n

Examples from your document:<\/p>\n\n\n\n

– *\u201c236.qarestr.sub-172-19-2.myvzw.com \u2014 30ms\u201d*  <\/p>\n\n\n\n

– *\u201c187.sub-69-83-101.myvzw.com \u2014 30ms\u201d*  <\/p>\n\n\n\n

– *\u201c212.sub-69-83-96.myvzw.com \u2014 26ms\u201d*<\/p>\n\n\n\n

These are **<\/strong>Verizon Wireless internal routers<\/strong>**<\/strong>, not public internet routers.<\/p>\n\n\n\n

They sit in the \u201cmiddle mile\u201d between:<\/p>\n\n\n\n

– The CGNAT cluster  <\/p>\n\n\n\n

– The regional packet core  <\/p>\n\n\n\n

– The handoff to external peers (GTT, Alter.net, Embratel, etc.)<\/p>\n\n\n\n

This is why your early hops look \u201clocal-ish\u201d (20\u201330ms) even though the final destination is thousands of kilometers away.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83d\udd12 4. Why Verizon keeps you inside their private domain for so long<\/strong><\/p>\n\n\n\n

There are several structural reasons:<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>A. CGNAT architecture<\/strong>**<\/strong><\/p>\n\n\n\n

Mobile carriers NAT *everything* through centralized clusters.<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>B. MPLS traffic engineering<\/strong>**<\/strong><\/p>\n\n\n\n

They steer flows through internal tunnels optimized for:<\/p>\n\n\n\n

– Congestion  <\/p>\n\n\n\n

– Cost  <\/p>\n\n\n\n

– Peering agreements  <\/p>\n\n\n\n

– Lawful intercept  <\/p>\n\n\n\n

– QoS classes  <\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>C. Internal segmentation<\/strong>**<\/strong><\/p>\n\n\n\n

Mobile packet cores have layers:<\/p>\n\n\n\n

– eNodeB \/ gNodeB  <\/p>\n\n\n\n

– S-GW  <\/p>\n\n\n\n

– P-GW  <\/p>\n\n\n\n

– NAT cluster  <\/p>\n\n\n\n

– DPI \/ telemetry  <\/p>\n\n\n\n

– Peering edge  <\/p>\n\n\n\n

Traceroute often can\u2019t see the real physical path \u2014 only the logical loopbacks.<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>D. ICMP deprioritization<\/strong>**<\/strong><\/p>\n\n\n\n

Many internal routers treat traceroute probes as \u201cbackground noise,\u201d so RTTs don\u2019t reflect real forwarding latency.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83c\udf0e 5. Why the hop-by-hop distance looks local, but the ping distance looks intercontinental<\/strong><\/p>\n\n\n\n

Your document shows:<\/p>\n\n\n\n

– *\u201c\ud83d\udccf Path distance: ~126\u2013168 km (min-RTT estimate)\u201d*  <\/p>\n\n\n\n

– *\u201c\ud83c\udfaf Ping: min 161\u2013173ms \u2192 ~5000\u20135400 km\u201d*<\/p>\n\n\n\n

This mismatch is expected because:<\/p>\n\n\n\n

– The **<\/strong>first clean hop<\/strong>**<\/strong> is local\/regional  <\/p>\n\n\n\n

– The **<\/strong>end-to-end RTT<\/strong>**<\/strong> includes the entire path to Brazil  <\/p>\n\n\n\n

– Intermediate hops are ICMP-deprioritized, so they can\u2019t be used for distance estimation  <\/p>\n\n\n\n

– MPLS hides physical distance<\/p>\n\n\n\n

So your system is correctly detecting:<\/p>\n\n\n\n

– **<\/strong>Local first-hop<\/strong>**<\/strong>  <\/p>\n\n\n\n

– **<\/strong>Long-haul final destination<\/strong>**<\/strong>  <\/p>\n\n\n\n

– **<\/strong>Opaque middle section<\/strong>**<\/strong> (Verizon\u2019s private backbone)<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83e\udde0 6. The big picture<\/strong><\/p>\n\n\n\n

Your traces reveal a consistent architecture:<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

[Your LAN]<\/p>\n\n\n\n

   \u2193<\/p>\n\n\n\n

[Verizon CGNAT \/ MPLS private backbone]<\/p>\n\n\n\n

   \u2193<\/p>\n\n\n\n

[Verizon internal access routers (*.myvzw.com)]<\/p>\n\n\n\n

   \u2193<\/p>\n\n\n\n

[Peering edge: Alter.net, GTT, etc.]<\/p>\n\n\n\n

   \u2193<\/p>\n\n\n\n

[International transit]<\/p>\n\n\n\n

   \u2193<\/p>\n\n\n\n

[Brazilian ISP (Embratel, ATC Multim\u00eddia, CNTFiber, USBInternet)]<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

This is exactly what a mobile-carrier-style packet core looks like when exposed through traceroute.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

If you want, I can map this into a **<\/strong>graph-layer classifier<\/strong>**<\/strong> you can plug directly into your hypergraph engine \u2014 something that tags each hop with:<\/p>\n\n\n\n

– `carrier_private_backbone`<\/p>\n\n\n\n

– `cg_nat_cluster`<\/p>\n\n\n\n

– `mpls_label_switch`<\/p>\n\n\n\n

– `mobile_packet_core`<\/p>\n\n\n\n

– `regional_access_router`<\/p>\n\n\n\n

– `peering_edge`<\/p>\n\n\n\n

– `international_transit`<\/p>\n\n\n\n

– `destination_asn`<\/p>\n\n\n\n

It would make your recon entities *much* more semantically aware.<\/p>\n\n\n\n

My ISP is Verizon Home 5G. How does MIMO Connections factor into these readings?<\/p>\n\n\n\n

MIMO is *absolutely* part of the story here, Benjamin \u2014 but not in the na\u00efve \u201cmore antennas = more speed\u201d sense. On Verizon Home 5G, MIMO becomes a **<\/strong>transport\u2011layer illusionist<\/strong>**<\/strong>, shaping the RTT profile you see long before your packets ever hit the Verizon private backbone.<\/p>\n\n\n\n

Let me walk you through how it actually manifests in the traceroutes you shared.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83d\udce1 1. Your first hop is <\/strong>*<\/strong>already<\/strong>*<\/strong> a MIMO\u2011composed link  <\/strong><\/p>\n\n\n\n

From your document:<\/p>\n\n\n\n

– *\u201cHop 1: XCI55AX.mynetworksettings.com \u2014 2.53\u20133.36ms +126\u2013168 km\u201d*<\/p>\n\n\n\n

That hop is not a copper or fiber hop.  <\/p>\n\n\n\n

It\u2019s your **<\/strong>CPE \u2192 gNodeB<\/strong>**<\/strong> air interface.<\/p>\n\n\n\n

And that air interface is built from:<\/p>\n\n\n\n

– **<\/strong>Multiple spatial streams<\/strong>**<\/strong>  <\/p>\n\n\n\n

– **<\/strong>Multiple frequency blocks (NR carriers)<\/strong>**<\/strong>  <\/p>\n\n\n\n

– **<\/strong>Multiple beamforming layers<\/strong>**<\/strong>  <\/p>\n\n\n\n

– **<\/strong>Dynamic link adaptation per layer<\/strong>**<\/strong><\/p>\n\n\n\n

So the \u201cRTT\u201d you see at hop 1 is already a **<\/strong>composite<\/strong>**<\/strong> of:<\/p>\n\n\n\n

– RF propagation  <\/p>\n\n\n\n

– Beamforming alignment  <\/p>\n\n\n\n

– HARQ retransmissions  <\/p>\n\n\n\n

– Layer scheduling  <\/p>\n\n\n\n

– MIMO stream aggregation  <\/p>\n\n\n\n

– Carrier aggregation timing offsets  <\/p>\n\n\n\n

This is why your hop\u20111 distance estimator keeps landing around **<\/strong>126\u2013168 km<\/strong>**<\/strong> \u2014 it\u2019s not measuring geography, it\u2019s measuring the *effective propagation + processing delay* of a multi\u2011layer RF link.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83e\uddec 2. MIMO makes the first hop <\/strong>*<\/strong>stable<\/strong>*<\/strong>, but the second hop <\/strong>*<\/strong>chaotic<\/strong>*<\/strong>  <\/strong><\/p>\n\n\n\n

Look at your document again:<\/p>\n\n\n\n

– Hop 1: ~3ms  <\/p>\n\n\n\n

– Hop 2: **<\/strong>206\u2013246ms<\/strong>**<\/strong>  <\/p>\n\n\n\n

– Hop 3: **<\/strong>36ms<\/strong>**<\/strong>  <\/p>\n\n\n\n

– Hop 4: **<\/strong>30ms<\/strong>**<\/strong><\/p>\n\n\n\n

That huge spike at hop 2 is not physical distance.  <\/p>\n\n\n\n

It\u2019s the **<\/strong>5G packet core doing scheduling + NAT + tunnel handling<\/strong>**<\/strong>.<\/p>\n\n\n\n

Why does MIMO matter here?<\/p>\n\n\n\n

Because the packet core sees your traffic as **<\/strong>multiple parallel RF flows<\/strong>**<\/strong> that must be:<\/p>\n\n\n\n

– Reassembled  <\/p>\n\n\n\n

– Ordered  <\/p>\n\n\n\n

– Buffered  <\/p>\n\n\n\n

– Classified  <\/p>\n\n\n\n

– Forwarded into the private backbone  <\/p>\n\n\n\n

This is why hop 2 often shows:<\/p>\n\n\n\n

– A single massive RTT  <\/p>\n\n\n\n

– Followed by \u201cnormal\u201d RTTs on hops 3\u201310  <\/p>\n\n\n\n

– Even though they\u2019re all inside the same Verizon private domain<\/p>\n\n\n\n

MIMO \u2192 multiple RF paths \u2192 reassembly \u2192 jitter \u2192 traceroute chaos.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83d\udef0\ufe0f 3. MIMO hides physical distance inside Verizon\u2019s private backbone  <\/strong><\/p>\n\n\n\n

Once your packets leave the gNodeB, they enter:<\/p>\n\n\n\n

– **<\/strong>MPLS tunnels<\/strong>**<\/strong><\/p>\n\n\n\n

– **<\/strong>Segment\u2011routed paths<\/strong>**<\/strong><\/p>\n\n\n\n

– **<\/strong>CGNAT clusters<\/strong>**<\/strong><\/p>\n\n\n\n

– **<\/strong>QoS\u2011segmented slices<\/strong>**<\/strong><\/p>\n\n\n\n

Because the RF link is already multi\u2011path, the backbone treats your traffic as **<\/strong>flow\u2011based<\/strong>**<\/strong>, not hop\u2011based. That means:<\/p>\n\n\n\n

– ICMP probes don\u2019t follow the same internal path as your data  <\/p>\n\n\n\n

– Load balancing happens per\u2011flow, not per\u2011packet  <\/p>\n\n\n\n

– MIMO jitter gets amplified by MPLS jitter  <\/p>\n\n\n\n

– RTT spikes appear at \u201crandom\u201d hops  <\/p>\n\n\n\n

This is why your traceroutes show:<\/p>\n\n\n\n

– *\u201c10.184.139.18 \u2014 235ms\u201d*  <\/p>\n\n\n\n

– *\u201c10.184.139.18 \u2014 36ms\u201d*  <\/p>\n\n\n\n

– *\u201c10.184.139.17 \u2014 30ms\u201d*<\/p>\n\n\n\n

Same router ID, wildly different RTTs.  <\/p>\n\n\n\n

That\u2019s MIMO + MPLS + CGNAT interacting.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83d\udd2c 4. MIMO makes the <\/strong>*<\/strong>early<\/strong>*<\/strong> hops look local, even when the <\/strong>*<\/strong>final<\/strong>*<\/strong> hop is thousands of kilometers away  <\/strong><\/p>\n\n\n\n

Your document shows:<\/p>\n\n\n\n

– Path distance: **<\/strong>~126\u2013168 km<\/strong>**<\/strong>  <\/p>\n\n\n\n

– Ping distance: **<\/strong>~5000\u20135400 km<\/strong>**<\/strong><\/p>\n\n\n\n

This mismatch is classic for 5G MIMO:<\/p>\n\n\n\n

###<\/strong> Why hop\u20111 looks local  <\/strong><\/p>\n\n\n\n

Because the RF link is short and beamformed.<\/p>\n\n\n\n

###<\/strong> Why the final RTT looks intercontinental  <\/strong><\/p>\n\n\n\n

Because the destination is in Brazil.<\/p>\n\n\n\n

###<\/strong> Why the middle hops tell you nothing  <\/strong><\/p>\n\n\n\n

Because MIMO + MPLS + CGNAT destroys hop\u2011level timing fidelity.<\/p>\n\n\n\n

Traceroute assumes:<\/p>\n\n\n\n

> \u201cEach hop adds incremental latency.\u201d<\/p>\n\n\n\n

5G MIMO breaks that assumption completely.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83e\udde0 5. The real mental model  <\/strong><\/p>\n\n\n\n

Here\u2019s the correct way to think about your path:<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

[Your device]<\/p>\n\n\n\n

   \u2193  (MIMO, CA, beamforming, HARQ, scheduling)<\/p>\n\n\n\n

[5G CPE]<\/p>\n\n\n\n

   \u2193  (MIMO reassembly + packet core)<\/p>\n\n\n\n

[gNodeB \u2192 UPF \u2192 CGNAT cluster]<\/p>\n\n\n\n

   \u2193  (MPLS private backbone)<\/p>\n\n\n\n

[Verizon internal routers (*.myvzw.com)]<\/p>\n\n\n\n

   \u2193<\/p>\n\n\n\n

[Peering edge]<\/p>\n\n\n\n

   \u2193<\/p>\n\n\n\n

[International transit]<\/p>\n\n\n\n

   \u2193<\/p>\n\n\n\n

[Destination ASN]<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

MIMO affects **<\/strong>everything above the gNodeB<\/strong>**<\/strong>, because it determines:<\/p>\n\n\n\n

– How packets arrive  <\/p>\n\n\n\n

– How they\u2019re buffered  <\/p>\n\n\n\n

– How they\u2019re reordered  <\/p>\n\n\n\n

– How they\u2019re timestamped  <\/p>\n\n\n\n

– How they\u2019re classified into flows  <\/p>\n\n\n\n

– How they\u2019re inserted into MPLS tunnels  <\/p>\n\n\n\n

Traceroute is blind to all of this.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83c\udfaf 6. The punchline  <\/strong><\/p>\n\n\n\n

Your traceroutes look \u201cweird\u201d not because the path is weird, but because **<\/strong>5G MIMO makes the first 2\u20134 hops fundamentally non\u2011Euclidean<\/strong>**<\/strong>.<\/p>\n\n\n\n

You\u2019re measuring:<\/p>\n\n\n\n

– A multi\u2011layer RF link  <\/p>\n\n\n\n

– Feeding a multi\u2011layer packet core  <\/p>\n\n\n\n

– Feeding a multi\u2011layer MPLS backbone  <\/p>\n\n\n\n

Traceroute was designed for:<\/p>\n\n\n\n

– Single\u2011path  <\/p>\n\n\n\n

– Wired  <\/p>\n\n\n\n

– Non\u2011NAT  <\/p>\n\n\n\n

– Non\u2011MPLS  <\/p>\n\n\n\n

– Non\u2011MIMO  <\/p>\n\n\n\n

– Non\u2011mobile  <\/p>\n\n\n\n

– Non\u2011tunneled  <\/p>\n\n\n\n

– Non\u2011flow\u2011hashed  <\/p>\n\n\n\n

– Non\u2011beamformed networks  <\/p>\n\n\n\n

So your readings are *exactly* what a 5G MIMO + CGNAT + MPLS carrier network should look like.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

If you want, I can build you a **<\/strong>MIMO\u2011aware hop classifier<\/strong>**<\/strong> that tags each hop as:<\/p>\n\n\n\n

– `rf_link`<\/p>\n\n\n\n

– `mimo_reassembly`<\/p>\n\n\n\n

– `packet_core`<\/p>\n\n\n\n

– `cgnat_cluster`<\/p>\n\n\n\n

– `mpls_private_backbone`<\/p>\n\n\n\n

– `access_router`<\/p>\n\n\n\n

– `peering_edge`<\/p>\n\n\n\n

– `international_transit`<\/p>\n\n\n\n

– `destination`<\/p>\n\n\n\n

It would make your hypergraph recon pipeline dramatically more accurate.<\/p>\n\n\n\n

Benjamin, let\u2019s build this thing the way an operator would want it: **<\/strong>deterministic, explainable, and directly grounded in the traceroute evidence you fed me.<\/strong>**<\/strong>  <\/p>\n\n\n\n

I\u2019ll give you:<\/p>\n\n\n\n

1. **<\/strong>A full MIMO\u2011aware hop classifier taxonomy<\/strong>**<\/strong>  <\/p>\n\n\n\n

2. **<\/strong>Clear decision rules<\/strong>**<\/strong> (so your hypergraph engine can auto\u2011tag hops)  <\/p>\n\n\n\n

3. **<\/strong>Examples applied to your actual traceroutes<\/strong>**<\/strong>, with citations from the document you uploaded.<\/p>\n\n\n\n

This is not a toy classifier \u2014 it\u2019s an operator\u2011grade, packet\u2011core\u2011aware model of how Verizon Home 5G paths behave.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83e\udde9 1. The MIMO\u2011Aware Hop Classifier (taxonomy)<\/strong><\/p>\n\n\n\n

Here are the nine hop classes you requested, defined precisely:<\/p>\n\n\n\n

| Class | Meaning | Where it appears |<\/p>\n\n\n\n

|——-|———|——————|<\/p>\n\n\n\n

| **<\/strong>rf_link<\/strong>**<\/strong> | The CPE \u2192 gNodeB air interface, including MIMO, beamforming, HARQ, and scheduling effects | Hop 1 |<\/p>\n\n\n\n

| **<\/strong>mimo_reassembly<\/strong>**<\/strong> | The UPF\/S\u2011GW\/P\u2011GW layer where multiple RF spatial streams are reassembled into a single IP flow | Hop 2 (the huge RTT spike) |<\/p>\n\n\n\n

| **<\/strong>packet_core<\/strong>**<\/strong> | Internal 5G core routers before NAT, often MPLS\u2011encapsulated | Hops 3\u20134 |<\/p>\n\n\n\n

| **<\/strong>cgnat_cluster<\/strong>**<\/strong> | The NAT44\/CGNAT gateway where private backbone traffic becomes public | First hop after 10.x.x.x space |<\/p>\n\n\n\n

| **<\/strong>mpls_private_backbone<\/strong>**<\/strong> | Verizon\u2019s internal MPLS transport fabric, often with repeated loopback IPs | 10.184.x.x and *.myvzw.com |<\/p>\n\n\n\n

| **<\/strong>access_router<\/strong>**<\/strong> | Regional Verizon routers near peering edges | *.myvzw.com with stable RTT |<\/p>\n\n\n\n

| **<\/strong>peering_edge<\/strong>**<\/strong> | Where Verizon hands traffic to GTT, Alter.net, etc. | ae*.gtt.net, ALTER.NET |<\/p>\n\n\n\n

| **<\/strong>international_transit<\/strong>**<\/strong> | Long\u2011haul carriers (Embratel, ATC Multim\u00eddia, etc.) | *.embratel.net.br, *.atcmultimidia.com.br |<\/p>\n\n\n\n

| **<\/strong>destination<\/strong>**<\/strong> | Final ASN \/ host | The .br or AWS endpoint |<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83e\udde0 2. Decision Rules (for your hypergraph engine)<\/strong><\/p>\n\n\n\n

These rules are deterministic and can be encoded directly into your recon pipeline.<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>rf_link<\/strong>**<\/strong><\/p>\n\n\n\n

– Hop index = 1  <\/p>\n\n\n\n

– Hostname resembles CPE  <\/p>\n\n\n\n

– RTT 2\u20135 ms  <\/p>\n\n\n\n

– Example:  <\/p>\n\n\n\n

  \u201cHop 1: XCI55AX.mynetworksettings.com \u2014 2.53ms\u201d<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>mimo_reassembly<\/strong>**<\/strong><\/p>\n\n\n\n

– Hop index = 2  <\/p>\n\n\n\n

– Private IP (10.x.x.x)  <\/p>\n\n\n\n

– RTT spike > 150 ms  <\/p>\n\n\n\n

– Example:  <\/p>\n\n\n\n

  \u201cHop 2: 10.184.139.18 \u2014 235.44ms\u201d<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>packet_core<\/strong>**<\/strong><\/p>\n\n\n\n

– Private IP (10.x.x.x)  <\/p>\n\n\n\n

– RTT returns to 20\u201340 ms  <\/p>\n\n\n\n

– Same router ID may repeat  <\/p>\n\n\n\n

– Example:  <\/p>\n\n\n\n

  \u201cHop 3: 10.184.139.18 \u2014 36.29ms\u201d<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>cgnat_cluster<\/strong>**<\/strong><\/p>\n\n\n\n

– First hop after 10.x.x.x  <\/p>\n\n\n\n

– Hostnames like `qarestr.sub-172-19-2.myvzw.com`  <\/p>\n\n\n\n

– Example:  <\/p>\n\n\n\n

  \u201cHop 5: 236.qarestr.sub-172-19-2.myvzw.com \u2014 30.41ms\u201d<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>mpls_private_backbone<\/strong>**<\/strong><\/p>\n\n\n\n

– Internal Verizon routers  <\/p>\n\n\n\n

– Hostnames: `*.myvzw.com`  <\/p>\n\n\n\n

– RTT 20\u201335 ms  <\/p>\n\n\n\n

– Example:  <\/p>\n\n\n\n

  \u201cHop 7: 187.sub-69-83-101.myvzw.com \u2014 30.85ms\u201d<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>access_router<\/strong>**<\/strong><\/p>\n\n\n\n

– Verizon routers near peering  <\/p>\n\n\n\n

– RTT begins to rise (40\u201360 ms)  <\/p>\n\n\n\n

– Example:  <\/p>\n\n\n\n

  \u201cHop 11: 0.ae12.GW1.MIA19.ALTER.NET \u2014 51.24ms\u201d<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>peering_edge<\/strong>**<\/strong><\/p>\n\n\n\n

– First non\u2011Verizon ASN  <\/p>\n\n\n\n

– GTT, Alter.net, etc.  <\/p>\n\n\n\n

– Example:  <\/p>\n\n\n\n

  \u201cHop 12: Internet-gw.customer.alter.net \u2014 55.07ms\u201d<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>international_transit<\/strong>**<\/strong><\/p>\n\n\n\n

– Brazilian carriers  <\/p>\n\n\n\n

– RTT jumps to 150\u2013170 ms  <\/p>\n\n\n\n

– Example:  <\/p>\n\n\n\n

  \u201cHop 13: ebt-B101-intl01.mianap.embratel.net.br \u2014 170.29ms\u201d<\/p>\n\n\n\n

###<\/strong> <\/strong>**<\/strong>destination<\/strong>**<\/strong><\/p>\n\n\n\n

– Final host  <\/p>\n\n\n\n

– Example:  <\/p>\n\n\n\n

  \u201cHop 22: 191-37-72-46.cntfiber.net.br \u2014 167.18ms\u201d<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83d\udd2c 3. Applying the classifier to your actual traceroute<\/strong><\/p>\n\n\n\n

Let\u2019s classify the first few hops of the 191.37.72.46 trace:<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

Hop 1: XCI55AX.mynetworksettings.com \u2014 2.53ms  <\/p>\n\n\n\n

\u2192 rf_link<\/p>\n\n\n\n

Hop 2: 10.184.139.18 \u2014 235.44ms  <\/p>\n\n\n\n

\u2192 mimo_reassembly<\/p>\n\n\n\n

Hop 3: 10.184.139.18 \u2014 36.29ms  <\/p>\n\n\n\n

\u2192 packet_core<\/p>\n\n\n\n

Hop 4: 10.184.139.17 \u2014 30.9ms  <\/p>\n\n\n\n

\u2192 packet_core<\/p>\n\n\n\n

Hop 5: 236.qarestr.sub-172-19-2.myvzw.com \u2014 30.41ms  <\/p>\n\n\n\n

\u2192 cgnat_cluster<\/p>\n\n\n\n

Hop 7: 187.sub-69-83-101.myvzw.com \u2014 30.85ms  <\/p>\n\n\n\n

\u2192 mpls_private_backbone<\/p>\n\n\n\n

Hop 11: 0.ae12.GW1.MIA19.ALTER.NET \u2014 51.24ms  <\/p>\n\n\n\n

\u2192 access_router<\/p>\n\n\n\n

Hop 12: Internet-gw.customer.alter.net \u2014 55.07ms  <\/p>\n\n\n\n

\u2192 peering_edge<\/p>\n\n\n\n

Hop 13: ebt-B101-intl01.mianap.embratel.net.br \u2014 170.29ms  <\/p>\n\n\n\n

\u2192 international_transit<\/p>\n\n\n\n

Hop 22: 191-37-72-46.cntfiber.net.br \u2014 167.18ms  <\/p>\n\n\n\n

\u2192 destination<\/p>\n\n\n\n

“`<\/p>\n\n\n\n

All of these lines come directly from your uploaded document and are cited accordingly.<\/p>\n\n\n\n

—<\/strong><\/p>\n\n\n\n

#<\/strong> \ud83e\uddf1 4. Ready for integration<\/strong><\/p>\n\n\n\n

If you want, I can now:<\/p>\n\n\n\n

– Generate a **<\/strong>JSON schema<\/strong>**<\/strong> for this classifier  <\/p>\n\n\n\n

– Produce a **<\/strong>Python or Go implementation<\/strong>**<\/strong>  <\/p>\n\n\n\n

– Build a **<\/strong>hypergraph tagging pipeline<\/strong>**<\/strong> that auto\u2011labels nodes  <\/p>\n\n\n\n

– Add **<\/strong>confidence scoring<\/strong>**<\/strong> based on RTT variance, hostname patterns, and ASN lookups  <\/p>\n\n\n\n

– Extend the classifier to detect **<\/strong>tunnels, overlays, and ECMP artifacts<\/strong>**<\/strong><\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

M$Copilot: <provided trace readings> Oh this is fun. Let\u2019s unpack what your network just confessed to you. ### Quick read of what\u2019s going on – **Source \u2192 First hop:**     **Hop 1: `XCI55AX.mynetworksettings.com \u2014 3.26ms +163km`**     That looks like your CPE\/edge or very first upstream handoff. The `+163km` tag suggests your RTT\u2192distance… 5G MIMO Considerations for Signal Geolocation<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":4325,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[5,7],"tags":[],"class_list":["post-5188","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sigscythe","category-the-truben-show"],"_links":{"self":[{"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/posts\/5188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5188"}],"version-history":[{"count":2,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/posts\/5188\/revisions"}],"predecessor-version":[{"id":5190,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/posts\/5188\/revisions\/5190"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=\/wp\/v2\/media\/4325"}],"wp:attachment":[{"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/172-234-197-23.ip.linodeusercontent.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}