Doesn't the LogMeIn Hamachi "VPN service" use 5.0.0.0/8?  Perhaps the spikes to 
5.5.5.0/24 or the space in general are from fluctuations or waves of 
disconnects of Hamachi users, so when they are disconnected their Hamachi 
traffic heads out in to the DFZ?  This service is particularly popular amongst 
gamers who like to play LAN games over the Internet when Internet play is not 
possible, which could account for the diverse set of source addresses and UDP 
traffic (and I'm sure a long tail of other applications/uses)

I can't say I am terribly familiar with the service, but it is one of the first 
things that came to mind when reading the RIPE writeup.

It would be interesting to see what the distribution of source/destination 
ports are in the traffic headed into 5/8 or 5.5.5.0/24 to see if they can be 
correlated to common games or applications that may be used over Hamachi.


On Feb 21, 2011, at 8:36 AM, Mirjam Kuehne wrote:

> Hello,
> 
> During NANOG 51, Manish Karir gave a Lightning Talk showing how much and what 
> kind of traffic is going to unallocated address space in 5/8 and 37/8 (among 
> other ranges he tested).
> 
> This is now also available on RIPE Labs:
> 
> http://labs.ripe.net/Members/mkarir/first-impressions-of-pollution-in-two-ripe-ncc-darknets
> 
> Kind Regards,
> Mirjam Kuehne
> RIPE NCC
> 


Reply via email to