Collapse of Russia country zone

Server operators
156

I don’t know if Singapore can be considered “normal”, but:

# time tcpdump -c 1000000 -w sg.pcap inbound and ip and udp and dst port 123
real 1m15.576s
user 0m0.115s
sys 0m0.203s

# tcpdump -nn -r sg.pcap | cut -d" " -f3 | cut -d. -f1-4 | sort | uniq -c | sort -rn | head
   7712 116.12.235.x
   5130 118.201.175.x
   2021 103.227.241.x
   1922 165.21.92.x
    631 203.149.235.x
    471 219.74.179.x
    337 116.12.191.x
    281 61.16.92.x
    258 222.90.229.x
    254 122.11.164.x

For comparison, similar stats for Finland but with only 100k requests, so scale by 10x in your mind. Otherwise I would have needed to wait more than two hours for 1M.

# time tcpdump -c 100000 -w fi.pcap inbound and ip and udp and dst port 123
real 13m52.573s
user 0m0.019s
sys 0m0.075s

# tcpdump -nn -r fi.pcap | cut -d" " -f3 | cut -d. -f1-4 | sort | uniq -c | sort -rn | head
   1777 83.148.198.x
    718 13.52.88.x
    659 194.240.127.x
    307 193.184.119.x
    297 31.172.158.x
    275 87.95.173.x
    258 135.181.86.x
    245 37.16.124.x
    211 46.163.255.x
    205 95.217.63.x

Moral of the story: All the zones have their own oddities.

2 Likes