[AusNOG] Report on 1/8 traffic

[Geoff Huston]

On 08/04/2010, at 1:24 PM, Narelle wrote:

> Am I missing something, is there really no analysis of where the
> traffic is coming from?

"everywhere" in the first instance. Further reports on this are in the process of being prepared. 

> 
> Fascinating. That's pretty high, and the impact on smaller APNIC
> region ISPs and organisations could be significant, considering out
> backhaul and international bandwidth costs.
> 

The study looks at both network 1/8 and also looks at another address block to get a "normal" level of traffic. 

What appears to be "normal" is that in a /12 block drawn from network 27/8 there were 4087 /24s (or 99.8% of the /24s) that received less than 258 bits per second, or the equivalent of 1 packet every 3 seconds (the average packet size for the 27.128.0.0/12 packet capture was 97 bytes).

By comparison, what we observed in network 1/8 was that using a benchmark threshold level of 1 average-sized packet per second, or 1.056 Kbps, 98.8% of all /24s in 1.0.0.0/8 receive less than this threshold, and 1,344 /24s that receive a higher incoming traffic rate. There are 428 /24s that receive more than 2.112kbps of incoming traffic, or more than 2 average-sized packets per second. There are 233 /24s that receive more than 3,168kbps of incoming traffic, or more than 3 average-sized packets per second.  These /24s are located within 14 /16s within 1.0.0.0/8. This list of /24s that received in excess of 3 average-sized packets per second, and their enclosing /16s, are provided in Appendix I of the report.

So what the report is saying is that most /24s receive less than 3 packets per second, in other works an average of less than 1 packet per minute per individual /32 address. I'm not sure that I can agree with the proposition that that level of traffic represents an unreasonable impost on ISPs in the region who are allocated address blocks from within 1/8.

Yes, there are a subset of /24s that are abnormal in the volume of traffic that they appear to attract, and the report is recommending that these address blocks be reserved and investigated further.



> They should be applauded for doing the study, and then taking the
> action to reserve the address ranges experiencing > than background
> loads.
> 
> 
> Nice one
> 

thanks Narelle,

  Geoff