Re: Traffic to 5/8 and 37/8 - stats on RIPE Labs

[Ryan Rawdon <ryan () u13 net>]

Doesn't the LogMeIn Hamachi "VPN service" use 5.0.0.0/8?  Perhaps the spikes to 5.5.5.0/24 or the space in general are 
from fluctuations or waves of disconnects of Hamachi users, so when they are disconnected their Hamachi traffic heads 
out in to the DFZ?  This service is particularly popular amongst gamers who like to play LAN games over the Internet 
when Internet play is not possible, which could account for the diverse set of source addresses and UDP traffic (and 
I'm sure a long tail of other applications/uses)

I can't say I am terribly familiar with the service, but it is one of the first things that came to mind when reading 
the RIPE writeup.

It would be interesting to see what the distribution of source/destination ports are in the traffic headed into 5/8 or 
5.5.5.0/24 to see if they can be correlated to common games or applications that may be used over Hamachi.


On Feb 21, 2011, at 8:36 AM, Mirjam Kuehne wrote:

> Hello,
>
> During NANOG 51, Manish Karir gave a Lightning Talk showing how much and what kind of traffic is going to unallocated 
> address space in 5/8 and 37/8 (among other ranges he tested).
>
> This is now also available on RIPE Labs:
>
> http://labs.ripe.net/Members/mkarir/first-impressions-of-pollution-in-two-ripe-ncc-darknets
>
> Kind Regards,
> Mirjam Kuehne
> RIPE NCC