[Pool] 8-10k pps in Brazil

Joseph B josephb at f-m.fm
Fri May 29 15:25:00 UTC 2015


A few of my servers have been added to the BR Zone by admins.

These servers were previously only in North America / US zone.

With each server set at the same "Net speed" as previously, I'm seeing a
5x increase in data traffic.

Example traffic graph showing increase as servers were added to BR pool
a few hours ago.

https://www.dropbox.com/s/pn0yqrtkd4tdotx/Screenshot%202015-05-30%2000.47.11.png?dl=0

Some analysis on a 1 minute TCPDUMP.

212588 total inbound NTP packets
98354 unique source IPs
71178 source /24 networks

Breaking it down some more:

31529 packets were from the top 25 /24s
45132 packets were from the top 100 /24s

Top 25 requests / subnets for 1 minute were:

   4105 191.247.228.0/24
   3985 191.247.231.0/24
   2143 191.247.227.0/24
   2115 191.247.226.0/24
   2089 191.247.224.0/24
   2073 191.247.225.0/24
   1077 189.40.81.0/24
   1033 189.40.82.0/24
    965 189.40.80.0/24
    959 189.40.90.0/24
    945 189.40.66.0/24
    940 189.40.83.0/24
    939 189.40.67.0/24
    877 189.40.91.0/24
    864 189.40.65.0/24
    840 189.40.64.0/24
    794 189.40.89.0/24
    784 189.40.88.0/24
    645 177.79.4.0/24
    608 201.23.172.0/24
    594 177.79.5.0/24
    554 189.40.74.0/24
    546 189.40.72.0/24
    538 189.40.73.0/24
    517 189.40.75.0/24

Inside 191.247.228.0/24 the requests came from 128 IPs, with the
distribution being fairly broad, it looks like this:

     75 191.247.228.12
     70 191.247.228.176
     69 191.247.228.1
     67 191.247.228.13
     64 191.247.228.57
     61 191.247.228.49
     60 191.247.228.7
     60 191.247.228.59
     60 191.247.228.53
     59 191.247.228.8
     58 191.247.228.51
     58 191.247.228.163
     56 191.247.228.63
     56 191.247.228.62
     55 191.247.228.54
     55 191.247.228.175
     55 191.247.228.16
     55 191.247.228.141

The requests are from many incrementing ports, so likely to be NAT/CGN
gateways.

Cheers,

Joseph



On Thu, May 28, 2015, at 02:13 PM, Matt Wagner wrote:
> I'm still seeing 10,000 queries/second, even after reducing my bandwidth


More information about the pool mailing list