[137843] in North American Network Operators' Group
Re: Traffic to 5/8 and 37/8 - stats on RIPE Labs
daemon@ATHENA.MIT.EDU (Ryan Rawdon)
Mon Feb 21 09:25:46 2011
From: Ryan Rawdon <ryan@u13.net>
In-Reply-To: <4D626A53.9060808@ripe.net>
Date: Mon, 21 Feb 2011 09:24:47 -0500
To: Mirjam Kuehne <mir@ripe.net>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Doesn't the LogMeIn Hamachi "VPN service" use 5.0.0.0/8? Perhaps the =
spikes to 5.5.5.0/24 or the space in general are from fluctuations or =
waves of disconnects of Hamachi users, so when they are disconnected =
their Hamachi traffic heads out in to the DFZ? This service is =
particularly popular amongst gamers who like to play LAN games over the =
Internet when Internet play is not possible, which could account for the =
diverse set of source addresses and UDP traffic (and I'm sure a long =
tail of other applications/uses)
I can't say I am terribly familiar with the service, but it is one of =
the first things that came to mind when reading the RIPE writeup.
It would be interesting to see what the distribution of =
source/destination ports are in the traffic headed into 5/8 or =
5.5.5.0/24 to see if they can be correlated to common games or =
applications that may be used over Hamachi.
On Feb 21, 2011, at 8:36 AM, Mirjam Kuehne wrote:
> Hello,
>=20
> During NANOG 51, Manish Karir gave a Lightning Talk showing how much =
and what kind of traffic is going to unallocated address space in 5/8 =
and 37/8 (among other ranges he tested).
>=20
> This is now also available on RIPE Labs:
>=20
> =
http://labs.ripe.net/Members/mkarir/first-impressions-of-pollution-in-two-=
ripe-ncc-darknets
>=20
> Kind Regards,
> Mirjam Kuehne
> RIPE NCC
>=20
