On 12/04/2007, at 2:53 PM, Alastair Johnson wrote:
Truman Boyes wrote:
On 12/04/2007, at 6:34 AM, Steve Phillips wrote:
ISP starts seeing increase in v6 tunneled traffic
Steve, you mean to assume that ISPs actually look at the traffic they are carrying? If 20,000 v6 users in NZ started tunneling between each other and created ipv6 bittorrent trackers to carry porn and 0-day exploits, I think most ISPs would have no idea that was happening over their network.
This may have been the case a couple years ago, but I suspect ISPs today would notice (assuming we're talking significant traffic volumes):
- increase in international bandwidth consumption; - decrease in effectiveness of their DPI/QoS boxes; - increase in "unknown protocol"
Very quick netflow and/or DPI analysis would show what's going on. If it starts hitting the bottom line, the ISPs will figure it out damn quick.
Certainly I used to notice things like this from Netflow data. If the traffic volume is low enough, you'd probably miss it... but we're talking BT here, right?
aj.
Greetings a.j., I would expect traffic volumes would be no more significant than today's volumes which are already full of p2p. I believe ISPs just don't care that much. As long as they are making some margin, then there is no significant interest (aside from stochastic modeling for fun) in seeing how much tunneled v6 a provider is carrying. They just wouldn't care, unless, as you point out, this is being used to avoid DPI/QoS boxes. The number of ISPs that monitor these types of things in detail would be far and in between. I believe that if we proposed a pop quiz to the top 10 ISPs in NZ and asked them how much GRE or IPIP traffic they carry a day, the answer would generally be "not sure". But I bet the top 10 ISPs would know pretty close to how many Mbps / Gbps they are sending to international. truman