Yeah I saw the link-local addresses. My guess is it is broadcast traffic from the IPv6 capable routers on that segment chatting. That was a lot of traffic for just chatter. I'll keep digging. I'm not seeing it elsewhere though so I am puzzled.
Get this though - looking back I see that all of this throughput magically showed up at 3am on January 1st. Dun dun dun!!! -Ty On Tue, Jan 6, 2015 at 10:38 AM, Ken Hohhof <[email protected]> wrote: > I see link-local addresses and the second one in the list looks like > UPnP, not sure about the first one. > > *From:* Ty Featherling <[email protected]> > *Sent:* Tuesday, January 06, 2015 10:13 AM > *To:* [email protected] > *Subject:* [AFMUG] unexplained IPv6 traffic. > > We started getting calls of slow speeds on this tower and found multiple > customers that had a constant ~1.5Mbps download occuring. When I logged > into the router I saw that traffic on some ports that should be idle > (SiteMonitor for example). When I torch the traffic this is what I see. A > single IPv6 connection on the DHCP ports. while this Mikrotik router is > running 6.xx, I do NOT have the IPv6 package active since I do not have > IPv6 running on my network yet. Does anyone know what this is or why it > would be happening? I do not see it on other routers. Someone's router > plugged into this broadcast domain and trying to serve IPv6 DHCP? I am > enabling the IPv6 package so I can manage this traffic but I am very > curious what I am dealing with. > > -Ty >
