Google's "unusual traffic" notification

[gall at switch.ch]

On Wed, 24 Jul 2013 10:27:20 +0200, Philipp Kern <phil at philkern.de> said:

> On 2013-07-24 10:05, gall at switch.ch wrote:
>> A customer reported to us that many of his users have been getting the
>> "Our systems have detected unusual traffic from your computer network"
>> message from Google since last week.  Apparently, this is only
>> happening for IPv6, which makes me suspect that there is some kind of
>> glitch with Google's technique for detecting what they believe is
>> automated traffic.

> I presume it's per IP block, so it's not at all surprising that it 
> "happens only for IPv6". So are you sure that there's no automated 
> traffic happening? (Netflow should/might tell you that.)

This is not easy to find out without knowing what pattern to look for
(threshold, block size) and which time period to check (depends on how
long a block remains banned, which I don't know either).

>From past experience, I have developped a reflex to suspect that
something is not working as inteded when "it only happens with IPv6"
:/ That's why I try to find out if that could be the case here before
pursuing other options.  Call it a hunch.

If anybody from Google is listening (Lorenzo?), maybe they could check
for me if and why something in 2001:620:610::/48 is banned.

-- 
Alex