Google's "unusual traffic" notification

Erik Kline ek at google.com
Thu Jul 25 03:31:21 CEST 2013


On 24 July 2013 18:51,  <gall at switch.ch> wrote:
> On Wed, 24 Jul 2013 10:27:20 +0200, Philipp Kern <phil at philkern.de> said:
>
>> On 2013-07-24 10:05, gall at switch.ch wrote:
>>> A customer reported to us that many of his users have been getting the
>>> "Our systems have detected unusual traffic from your computer network"
>>> message from Google since last week.  Apparently, this is only
>>> happening for IPv6, which makes me suspect that there is some kind of
>>> glitch with Google's technique for detecting what they believe is
>>> automated traffic.
>
>> I presume it's per IP block, so it's not at all surprising that it
>> "happens only for IPv6". So are you sure that there's no automated
>> traffic happening? (Netflow should/might tell you that.)
>
> This is not easy to find out without knowing what pattern to look for
> (threshold, block size) and which time period to check (depends on how
> long a block remains banned, which I don't know either).
>
> >From past experience, I have developped a reflex to suspect that
> something is not working as inteded when "it only happens with IPv6"
> :/ That's why I try to find out if that could be the case here before
> pursuing other options.  Call it a hunch.
>
> If anybody from Google is listening (Lorenzo?), maybe they could check
> for me if and why something in 2001:620:610::/48 is banned.

FWIW, it seems this is basically working as intended.  (I'll follow up
with you, unicast, for more detail.)


More information about the ipv6-ops mailing list