I'm seeing around 30 million packets a minute here, but of course a /8 is going to see more than narrower subnets. What's startling is the number of source addresses. I've seen over 25,000 different sources in the space of just minutes at the storm's peak. Just a moment ago, there were 6,000 different sources in 100 million incoming packets.
It's running about 30 MB/s, most of which is very short TCP connect requests to seemingly random 44-net addresses. Our normal (non-storm) inbound is around 18 MB/s. This past weekend, I saw peaks of 60 MB/s or higher. - Brian
On Wed, May 10, 2017 at 04:56:50AM -0400, Bryan Fields wrote:
I'm not seeing anything out of the ordinary on any of our blocks here in the bay area.
Seeing about ~1kpps here on our upstream and we have several "high traffic" voip hubs on here.