As you can see from the graph https://gw.ampr.org/router/encapinpkt.svg, there was a precipitous decline in inbound encap traffic about 19:00 UTC on May 16th. I've been wondering what happened to all that traffic.

Well, it turns out that the amount of traffic coming in before that cutoff was anomalously high. There was a host called chocolate-nebula.mit.edu (18.96.0.110) which was sending over 95% of the inbound traffic to amprgw, and had been for several days, before the graph started. I jumped to the conclusion that that amount of traffic was normal, when in fact it was not.

So what has really happened was that inbound traffic has returned to normal after 16 May at 19:10.

chocolate-nebula.mit.edu is registered on the portal as amprnet-gateway1.amolbhave.com, the gateway for subnet 44.44.7.224/28, belonging to KC1EDX. I don't yet know why it was sending all that traffic, nor why it suddenly stopped.

So most of the mystery is solved. Maybe KC1EDX will pop up here and explain what was going on. - Brian