I remember it well. A nontrivial percentage of all the traffic for 1.2.3.4 came from the same Dutch telecoms operator on the same protocol (MGCP, i.e. a broken SIP middlebox). It's somehow in my mind that it was T-Mobile.nl but I can't find an actual reference to that.
On Tue, Sep 16, 2014 at 4:15 PM, Leo Vegoda <leo.veg...@icann.org> wrote: > Hi Ollie, > > Ollie Potts wrote: > >> Given the notoriety that is associated with these addresses what surprises > >> me is that it appears 1.2.3.0/24 is announced from AS15169 - Google Inc. > > In the past, APNIC has arranged for some large networks to announce various > research prefixes to help with measuring the traffic received. I believe > that they work with very large networks because of the high volume of > traffic. Mark Dranse explained what happened when the RIPE NCC announced > that prefix for APNIC here: > > http://www.ripe.net/internet-coordination/press-centre/publications/presenta > tions/2010/pollution-in-1.0.0.0-8/at_download/download > > I would be surprised if Google was announcing APNIC's research prefixes > without a suitable LOA. > > Regards, > > Leo
