[AusNOG] massive amount of icmpv6 traffic compared to normal

[Mark Andrews]

I think Akamai need to look at what they are doing.  Thousands of
icmp6 echo requests into a single /64.  With privacy addresses
enabled they will be collecting thousands of IPv6 address from each
home.  You don't need to probe every one of them to workout the
best place to serve content from.

Mark

In message <CE27C6F4.6A34F%macca at vocus.com.au>, McDonald Richards writes:
> I've seen Akamai routinely run Ipv6 ICMP testing in the past to test that
> the routes they receive are reachable.
> 
> Macca
> 
> 
> On 7/08/13 8:02 AM, "Mark Andrews" <marka at isc.org> wrote:
> 
> >
> >Did anyone else see a massive amount of directed icmpv6 echo traffic
> >around 7 am this morning?  I happened to have a tcpdump running in
> >a window overnight with a decent history buffer.  The counts cover
> >around 20 minutes of externally originated icmpv6 echo request
> >traffic.  It looks like these were all directed at addresses that
> >have generated traffic in the past.
> >
> >  15 2001:388:1:3806::cb0d:a10d		[AARNet]
> >  25 2001:388:1:5062::cb05:4c2d		[AARNet]
> >  73 2001:388:30d0:20::cb0d:a1e5	[AARNet]
> >  33 2001:4478:1820:101::cbd9:1797	[iinet]
> > 327 2001:4478:1820:101::cbd9:17a4	[iinet]
> > 368 2001:4478:2220:100::cbce:5434	[iinet]
> >  90 2001:4478:4120::3ba7:1214		[iinet]
> > 365 2001:44b8:2020:8::3ba7:911e	[iinet/internode]
> >  32 2001:44b8:3070:5::9665:c344	[iinet/internode]
> > 365 2001:44b8:3070:5::9665:c35d	[iinet/internode]
> >  32 2001:c78:203:1::d209:5804		[AAPT]
> >  18 2001:c78:203:2::d20b:8e29		[AAPT]
> > 370 2401:1c00:3000::cba1:a45		[nextgen]
> > 357 2406:3c00:6000:2::cb09:b945	[CITEC]
> >   8 2600:1402:a::174d:cf3b		[AKAMAI]
> >   9 2600:1402:a::b833:223f		[AKAMAI]
> >   9 2600:1406:19::b833:783f		[AKAMAI]
> >   6 2600:140b:12::48f6:bed2		[AKAMAI]
> >   9 2600:1415:1::3cfe:ba26		[AKAMAI]
> >   1 2600:1415:1::b854:df45		[AKAMAI]
> >   1 2600:1415:1::b854:df81		[AKAMAI]
> >  24 2600:1415:1::b854:df91		[AKAMAI]
> >  18 2600:1415:7::173e:e021		[AKAMAI]
> >   6 2600:1415:7::173e:e02e		[AKAMAI]
> >  18 2600:1415:8::173e:9d0f		[AKAMAI]
> >   6 2600:1417:9::b854:efb7		[AKAMAI]
> >
> >The requests were spread out pretty evenly over
> >the target addresses.  The last one is the HE
> >tunnel endpoint.
> >
> >  66 2001:470:1f00:820:1957:4b69:2ac6:e9f:
> >  60 2001:470:1f00:820:1c21:6ba2:fb2b:9bfd:
> >  62 2001:470:1f00:820:1cf0:cf26:5e6:d8db:
> >  62 2001:470:1f00:820:1d24:1a12:b873:4a42:
> >  66 2001:470:1f00:820:1dc7:7cf5:9186:822:
> >  63 2001:470:1f00:820:1e0:16bb:8c30:6e72:
> >  62 2001:470:1f00:820:28c9:9f76:1511:f655:
> >  61 2001:470:1f00:820:294e:fc16:cac0:875e:
> >  62 2001:470:1f00:820:395b:ff7c:3c9c:b937:
> >  62 2001:470:1f00:820:3d3a:685e:6df2:5498:
> >  63 2001:470:1f00:820:4445:250:5814:6cdb:
> >  61 2001:470:1f00:820:50f4:de9:cd26:2516:
> >  66 2001:470:1f00:820:54f8:696b:5031:ea34:
> >  60 2001:470:1f00:820:59c9:c923:816b:8b7d:
> >  61 2001:470:1f00:820:6113:2702:9988:340b:
> >  64 2001:470:1f00:820:6533:8688:73a5:fff8:
> >  62 2001:470:1f00:820:6de7:3deb:8b0f:ff40:
> >  62 2001:470:1f00:820:75af:c5c0:a467:3e92:
> >  69 2001:470:1f00:820:7968:d8e:79de:8f92:
> >  61 2001:470:1f00:820:9453:af6f:87e1:74d8:
> >  59 2001:470:1f00:820:9c03:a1e:80ea:5bb8:
> >  66 2001:470:1f00:820:9d39:9440:eca6:b46c:
> >  62 2001:470:1f00:820:9d79:8e43:6952:e195:
> > 127 2001:470:1f00:820:a0d0:3ba5:749f:5208:
> >  62 2001:470:1f00:820:a46a:cf6d:a101:9c8f:
> >  63 2001:470:1f00:820:a5b1:d071:6eb6:688e:
> >  65 2001:470:1f00:820:a5e4:f68e:4e76:bad3:
> >  62 2001:470:1f00:820:adcd:8ff6:1fc1:6f54:
> > 114 2001:470:1f00:820:b5a3:6e0c:d14f:4bca:
> >  62 2001:470:1f00:820:b943:3351:3ec7:1be7:
> >  60 2001:470:1f00:820:c52:d7b2:88e:beba:
> >  61 2001:470:1f00:820:c959:c2e2:207e:2165:
> >  63 2001:470:1f00:820:d125:e343:cbb0:29f:
> >  66 2001:470:1f00:820:e90c:7e26:cd6:b1c1:
> >  65 2001:470:1f00:820:e9a6:b550:4082:7072:
> >  61 2001:470:1f00:820:ecfe:8286:8258:dcb3:
> >  63 2001:470:1f00:820:fc06:7033:750a:a307:
> >  62 2001:470:1f00:820:fce3:ec69:66eb:18fc:
> >  87 2001:470:1f00:ffff::5a1:
> >
> >-- 
> >Mark Andrews, ISC
> >1 Seymour St., Dundas Valley, NSW 2117, Australia
> >PHONE:	+61 2 9871 4742		         INTERNET: marka at isc.org
> >_______________________________________________
> >AusNOG mailing list
> >AusNOG at lists.ausnog.net
> >http://lists.ausnog.net/mailman/listinfo/ausnog
> 
> _______________________________________________
> AusNOG mailing list
> AusNOG at lists.ausnog.net
> http://lists.ausnog.net/mailman/listinfo/ausnog
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at isc.org