Also Brett, you might want to keep in mind geo-location for your IPv4 space.
If the subnet you are using is still showing on some geo services as another state or country weird things can happen with CDN routing etc. From: Af [mailto:af-boun...@afmug.com] On Behalf Of Brett A Mansfield Sent: Tuesday, November 7, 2017 7:16 PM To: af@afmug.com Subject: Re: [AFMUG] Facebook Ireland IP flooding traffic Thanks Mike. Thank you, Brett A Mansfield On Nov 7, 2017, at 5:35 PM, Mike Hammett <af...@ics-il.net<mailto:af...@ics-il.net>> wrote: Upload or download? Download, I assume? Contact their NOC, contact info here: https://peeringdb.com/net/979 ----- Mike Hammett Intelligent Computing Solutions<http://www.ics-il.com/> [http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/ICSIL>[http://www.ics-il.com/images/googleicon.png]<https://plus.google.com/+IntelligentComputingSolutionsDeKalb>[http://www.ics-il.com/images/linkedinicon.png]<https://www.linkedin.com/company/intelligent-computing-solutions>[http://www.ics-il.com/images/twittericon.png]<https://twitter.com/ICSIL> Midwest Internet Exchange<http://www.midwest-ix.com/> [http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/mdwestix>[http://www.ics-il.com/images/linkedinicon.png]<https://www.linkedin.com/company/midwest-internet-exchange>[http://www.ics-il.com/images/twittericon.png]<https://twitter.com/mdwestix> The Brothers WISP<http://www.thebrotherswisp.com/> [http://www.ics-il.com/images/fbicon.png]<https://www.facebook.com/thebrotherswisp>[http://www.ics-il.com/images/youtubeicon.png] <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ________________________________ From: "Brett A Mansfield" <li...@silverlakeinternet.com<mailto:li...@silverlakeinternet.com>> To: af@afmug.com<mailto:af@afmug.com> Sent: Tuesday, November 7, 2017 5:14:17 PM Subject: [AFMUG] Facebook Ireland IP flooding traffic I have a customer that is using 3x the bandwidth all my remaining customers on the same leg of the network use. The traffic is almost all from the same IP address. 31.13.70.51 I was thinking a torrent VPN service, but this shows as a Facebook IP in the RIPE region and is registered as a direct assign to Facebook Ireland. Any idea what can cause this IP to have a nearly consistent 100Mb of bandwidth? I asked the customer and he said that he doesn’t do any torrenting and he thought it might be game updates (he is a PC gamer). I’ve seen what game updates do, and it’s nothing like this. Thank you, Brett A Mansfield
