Re: Scanning activity from 2620:96:a000::/48

2021-07-15 Thread Nick Suan
midnight UTC, the control plane policers for > unresolved traffic on a couple of our CE routers started being clogged with > ping-scanning activity from 2620:96:a000::/48, which belongs to «Internet > Measurement Research (SIXMA)» according to ARIN. > > Excerpt of this traffic (anony

Re: Scanning activity from 2620:96:a000::/48

2021-07-06 Thread Mel Beckman
Protected or not, 600 pps is abusive. If they practice this behavior routinely they could find themselves filtered off the Internet. If Tore can’t reach them, I recommend an abuse report to their upstream, assuming they’re not directly peering at an IXP (I haven’t checked). -mel via cell On Ju

Re: Scanning activity from 2620:96:a000::/48

2021-07-06 Thread Tom Beecher
As mentioned, rando traffic is part and parcel of being internet connected. There isn't much 'ok' or 'not ok' to it. At this point of the internet's lifecycle, it is incumbent on all operators to protect themselves as much as possible from potential malfeasance or unintended technical oopsies. Tha

Re: Scanning activity from 2620:96:a000::/48

2021-07-06 Thread Tore Anderson
* Dobbins, Roland > Scanning is part of the ‘background radiation’ of the Internet, and it’s > performed by various parties with varying motivations. Of necessity, IPv6 > scanning is likely to be more targeted (were your able to discern any rhyme > or reason behind the observed scanning patter

Re: Scanning activity from 2620:96:a000::/48

2021-07-06 Thread Dobbins, Roland
> On 6 Jul 2021, at 16:53, Tore Anderson wrote: > > I was just curious to hear if anyone else is seeing the same thing, and also > whether or not people feel that this is an okay thing for this «Internet > Measurement Research (SIXMA)» to do (assuming they are white-hats)? Scanning is part of

Re: Scanning activity from 2620:96:a000::/48

2021-07-06 Thread Mark Tinka
On 7/6/21 11:53, Tore Anderson wrote: I was just curious to hear if anyone else is seeing the same thing, and also whether or not people feel that this is an okay thing for this «Internet Measurement Research (SIXMA)» to do (assuming they are white-hats)? One would think that they if they wa

Scanning activity from 2620:96:a000::/48

2021-07-06 Thread Tore Anderson
A couple of hours after midnight UTC, the control plane policers for unresolved traffic on a couple of our CE routers started being clogged with ping-scanning activity from 2620:96:a000::/48, which belongs to «Internet Measurement Research (SIXMA)» according to ARIN. Excerpt of this traffic