10 May
2017
10 May
'17
4:57 a.m.
I'm seeing around 30 million packets a minute here, but of course a /8
is going to see more than narrower subnets. What's startling is the
number of source addresses. I've seen over 25,000 different sources
in the space of just minutes at the storm's peak. Just a moment ago,
there were 6,000 different sources in 100 million incoming packets.
It's running about 30 MB/s, most of which is very short TCP connect
requests to seemingly random 44-net addresses. Our normal (non-storm)
inbound is around 18 MB/s. This past weekend, I saw peaks of 60 MB/s
or higher.
- Brian
On Wed, May 10, 2017 at 04:56:50AM -0400, Bryan Fields wrote:
I'm not seeing anything out of the ordinary on any
of our blocks here in the
bay area.
Seeing about ~1kpps here on our upstream and we have several "high traffic"
voip hubs on here.