Considering at least the top 4 IPs you've listed are CDN providers (Edgio and Fastly), this definitely sounds like game updates or something of the sort. Nothing unusual really for 3am on a weekday morning especially for an eyeball network.

Kind regards,
Peter


On Tue, Jul 23, 2024 at 9:57 AM Aaron Gould <aaron1@gvtc.com> wrote:
Thanks Jason, updates for what?  I was hoping any other eyeball network operators may have been seeing "lots of internet" usage like me and may be able to share what they know.  I'm always suspicious about the typical game update that tends to cause something like this.  someone unicasted me a response that it might be related to F1 Manager 2024 for video game consoles released today
 

i grabbed my netflow data for the last few hours for any source ip that has sent more than 5 GB of data...

    
Top 100 Src IP Addr ordered by bytes:
Date first seen          Duration Proto       Src IP Addr    Flows(%)     Packets(%)       Bytes(%)         pps      bps   bpp
2024-07-23 04:37:29.600 14860.800 any      93.184.215.240   557558( 0.6)  108.5 M( 9.2)  162.6 G(12.9)     7302   87.5 M  1497
2024-07-23 04:42:07.616 14577.664 any        72.21.81.240   361240( 0.4)   64.5 M( 5.5)   96.6 G( 7.7)     4426   53.0 M  1497
2024-07-23 06:52:08.192  6781.696 any     151.101.162.172   270298( 0.3)   36.9 M( 3.1)   55.0 G( 4.4)     5445   64.9 M  1489
2024-07-23 04:23:08.160 15722.240 any     151.101.150.172    1.0 M( 1.0)   31.2 M( 2.6)   46.4 G( 3.7)     1985   23.6 M  1486
2024-07-23 04:42:47.552 14542.592 any      146.75.106.172   238287( 0.2)   22.9 M( 1.9)   33.9 G( 2.7)     1575   18.7 M  1480
2024-07-23 03:40:11.776 18298.880 any     199.232.214.172   135793( 0.1)   19.1 M( 1.6)   28.4 G( 2.3)     1043   12.4 M  1486
2024-07-23 03:48:59.392 17769.728 any     199.232.210.172   135811( 0.1)   18.8 M( 1.6)   27.9 G( 2.2)     1057   12.6 M  1486
2024-07-23 04:22:05.184 15783.680 any      199.232.70.172   923350( 0.9)   18.5 M( 1.6)   27.5 G( 2.2)     1169   14.0 M  1491
2024-07-23 04:36:40.704 14909.696 any       146.75.42.172   138813( 0.1)    5.6 M( 0.5)    8.3 G( 0.7)      374    4.5 M  1492
2024-07-22 22:50:26.048 35683.840 any      199.232.70.252   112323( 0.1)    5.4 M( 0.5)    8.0 G( 0.6)      150    1.8 M  1485
2024-07-23 06:52:06.656  6783.488 any       146.75.10.172    74859( 0.1)    4.6 M( 0.4)    6.8 G( 0.5)      676    8.1 M  1489
2024-07-23 02:38:16.704 22011.392 any     151.101.160.204     6114( 0.0)    4.1 M( 0.3)    6.2 G( 0.5)      187    2.2 M  1489
2024-07-23 01:34:17.728 25851.136 any     151.101.161.190    44001( 0.0)    4.1 M( 0.3)    6.1 G( 0.5)      157    1.9 M  1489
2024-07-22 22:17:50.464 37638.912 any     199.232.154.252    69420( 0.1)    3.6 M( 0.3)    5.4 G( 0.4)       96    1.1 M  1483

-Aaron



On 7/23/2024 8:19 AM, Peter Potvin wrote:
Do you have any sort of additional information about this? Which source and destination ASNs, how much "a lot" is, etc? This sounds like a typical game update release cycle though without any information not a whole lot of networks would be able to confirm anything.

Kind regards,
Peter


On Tue, Jul 23, 2024 at 9:07 AM Aaron Gould <aaron1@gvtc.com> wrote:
Anyone else see a lot of Internet traffic starting at 3 a.m. and
continuing even now?  Seems to be spiky tcp.

--
-Aaron

-- 
-Aaron