20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours

Mon Jul 20 18:57:18 UTC 2015

On Mon, 20 Jul 2015 19:42:39 +0100, Colin Johnston said:
> see below for china ranges I believe, ipv4 and ipv6

You may believe... but are you *sure*?  (Over the years, we've seen
*lots* of "block China" lists that accidentally block chunks allocated
to Taiwan or Australia or other Pacific Rim destinations).

And remember - asking the NIC doesn't help, because there are almost
certainly blocks allocated that the registration points to Korea or
someplace, but the provider routes a sub-block to China.  And let's
not even get started on blocks allocated by ARIN or RIPE....

(Yes, it *was* a trick question :)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 848 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20150720/011b175a/attachment.sig>