Doesn't the LogMeIn Hamachi "VPN service" use 5.0.0.0/8? Perhaps the spikes to 5.5.5.0/24 or the space in general are from fluctuations or waves of disconnects of Hamachi users, so when they are disconnected their Hamachi traffic heads out in to the DFZ? This service is particularly popular amongst gamers who like to play LAN games over the Internet when Internet play is not possible, which could account for the diverse set of source addresses and UDP traffic (and I'm sure a long tail of other applications/uses)
I can't say I am terribly familiar with the service, but it is one of the first things that came to mind when reading the RIPE writeup. It would be interesting to see what the distribution of source/destination ports are in the traffic headed into 5/8 or 5.5.5.0/24 to see if they can be correlated to common games or applications that may be used over Hamachi. On Feb 21, 2011, at 8:36 AM, Mirjam Kuehne wrote: > Hello, > > During NANOG 51, Manish Karir gave a Lightning Talk showing how much and what > kind of traffic is going to unallocated address space in 5/8 and 37/8 (among > other ranges he tested). > > This is now also available on RIPE Labs: > > http://labs.ripe.net/Members/mkarir/first-impressions-of-pollution-in-two-ripe-ncc-darknets > > Kind Regards, > Mirjam Kuehne > RIPE NCC >
