22 Sep
2018
22 Sep
'18
4:58 p.m.
I believe a significant number of people who have
AMPRNet addresses
and are BGP-connected really don't care much about communicating
with other IPIP mesh-connected hosts; their interest is the rest
of the Internet.
Of course traffic mostly tends to be local and we see some IPIP mesh
traffic to stations in the area that are IPIP mesh connected, including
country networks like Germany.
Most traffic is between AMPRnet addresses connected on radio or VPN,
and between those and internet.
It is understandable, because many IPIP mesh stations are small islands
at the other side of the world and there is little chance that someone
here would want to send a lot of data to them.
On the other hand, connections internal to our network are used to
interconnect repeaters (both voice and ATV) and for things like echolink
and they transport a lot of data, mostly local.
Since there's no way to capture flow data for
these folks, we'll
never know where their traffic is going. All we can do is guess
from anecdotal data.
Maybe we can setup some ip flow export...
Rob
22 Sep
22 Sep
5:26 p.m.
New subject: beware of IPIP scanner...
I would recommend getting netflow on at least the internet entry/exit points to/from 44
space. Mikrotik has it out of the box but you’ll need a netflow collector. I’ve been using
an ELK stack for this with logstash as the netflow collector and elasticsearch and kibana
for displaying the logs etc.
Free, not too hard to setup and a good overview imo
Ruben - ON3RVH
On 22 Sep 2018, at 11:59, Rob Janssen <pe1chl(a)amsat.org> wrote:
I believe a
significant number of people who have AMPRNet addresses
and are BGP-connected really don't care much about communicating
with other IPIP mesh-connected hosts; their interest is the rest
of the Internet.
Of course traffic mostly tends to be local and we see some IPIP mesh
traffic to stations in the area that are IPIP mesh connected, including
country networks like Germany.
Most traffic is between AMPRnet addresses connected on radio or VPN,
and between those and internet.
It is understandable, because many IPIP mesh stations are small islands
at the other side of the world and there is little chance that someone
here would want to send a lot of data to them.
On the other hand, connections internal to our network are used to
interconnect repeaters (both voice and ATV) and for things like echolink
and they transport a lot of data, mostly local.
Since there's no way to capture flow data for
these folks, we'll
never know where their traffic is going. All we can do is guess
from anecdotal data.
Maybe we can setup some ip flow export...
Rob
_________________________________________
44Net mailing list
44Net(a)mailman.ampr.org
https://mailman.ampr.org/mailman/listinfo/44net
2283
days inactive
2283
days old
1 comments
2 participants
participants (2)
-
Rob Janssen -
Ruben ON3RVH