On Aug 6, 2008, at 9:01 AM, Randy Bush wrote:
serious curiosity:
what is the proportion of bad stuff coming from unallocated space vs allocated space? real measurements, please. and are there longitudinal data on this?
are the uw folk, gatech, vern, ... measuring?
Some data from our anonymous stats program (currently ~90 ISPs) included below. In short, ~3% of 727k attacks we've seen over the last 631 days employed bogon source addresses. (definition of what constitutes "attack" is subjected to reporting participant operational policy, but these are primarily rate-based DDoS attacks) -danny --- General Statistics total_days 631 total_attacks 1137265 avg_attacks_day 1802 avg_collectors_day 47 avg_attacks_collector_day 38 total_good_attacks 727410 63.96% --- Bogon Summary bogon block attacks % of attacks 0.0.0.0/7 65 0.01 2.0.0.0/8 3 0.00 5.0.0.0/8 3 0.00 10.0.0.0/8 8794 1.21 23.0.0.0/8 4 0.00 27.0.0.0/8 7 0.00 92.0.0.0/6 101 0.01 100.0.0.0/6 374 0.05 104.0.0.0/5 303 0.04 112.0.0.0/5 775 0.11 120.0.0.0/8 45 0.01 127.0.0.0/8 6 0.00 172.16.0.0/12 3646 0.50 174.0.0.0/7 1 0.00 176.0.0.0/5 1 0.00 192.168.0.0/16 7451 1.02 223.0.0.0/8 10 0.00 224.0.0.0/3 8 0.00 bogonTotal 21597 2.97