> > now as to who's responsible, first off you have to understand that we block > > rfc1918-sourced packets at our AS boundary. (otherwise these numbers would > > be Much Higher > > are you sure? i suspect they are windows 2000 systems behind NATs. so > the dynamic update is for the 1918 address, but the packet source address > has been natted into real space.
according to our border flow stats, not all of them get nat'd on the way here.
