20-30Gbps UDP 1720 traffic appearing to originate from CN in last 24 hours

Mon Jul 20 20:03:24 UTC 2015

On Mon, 20 Jul 2015 15:40:09 -0400, ML said:

> If you really wanted to go the route of blocking all/almost all China.
> Isn't there a short list of ASNs that provide transit to China
> citizens/networks?
> I'm referring to AS4134, AS4837, etc
> Wouldn't blackholing any prefix with those ASNs in the AS path
> accomplish the goal and stay up to date with a new prefixes originated
> from China?

What do you do if AS4134 has customers in Australia as well?

And how do you even *tell* if they do or not, if the space hasn't been
SWIP'ed or otherwise noted as customer space?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 848 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20150720/fb1f92c6/attachment.sig>