Usage of fd00::/8 on the Interwebz - something with filters and uRPF

[Emile Aben]

On 30/05/2013 08:36, Tim Chown wrote:
> 
> On 30 May 2013, at 07:23, Jeroen Massar <jeroen at massar.ch> wrote:
> 
>> On 2013-05-29 23:19, Eric Vyncke (evyncke) wrote:
>>> I do not mind too much getting packets with a ULA as source address;
>>> not perfect but I can live with those packets
>>
>> Hmm, you say till the day you receive a 100G of spoofed packets... and
>> that is what they are as nobody is able to claim they "own" those prefixes.
> 
> Would be interesting to see how much IPv6 traffic hits the DNS roots from link-local or ULA sources.  Anyone have any info?

For a days worth (2013-05-28) of IPv6 traffic to k-root I found these
non 2000::/3 IPv6 sources:

##address                               pkt_count
::                                      23
::10.28.254.28                          1
::12                                    1
fc00:bbb:30:0:XXXX:XXXX:XXXX:XXXX       2
fc10:2:e102:0:XXXX:XXXX:XXXX:XXXX       162
fc10:2:e103:0:XXXX:XXXX:XXXX:XXXX       66
fd00:0:ac:1400:XXXX:XXXX:XXXX:XXXX      1
fd01:db8:f00:a0:XXXX:XXXX:XXXX:XXXX     63
fd02:c9e3:a6c0:3d02:XXXX:XXXX:XXXX:XXXX 146
fd02:c9e3:a6c0:3d03:XXXX:XXXX:XXXX:XXXX 36
fd02:c9e3:a6c1:2502:XXXX:XXXX:XXXX:XXXX 1
fd02:c9e3:a6c1:2d02:XXXX:XXXX:XXXX:XXXX 9
fd12:e602:eec4:6487:XXXX:XXXX:XXXX:XXXX 10
fd15:10fb:654a:1:XXXX:XXXX:XXXX:XXXX    5
fd15:10fb:654a:1:XXXX:XXXX:XXXX:XXXX    19
fd19:f3c4:8c30:0:XXXX:XXXX:XXXX:XXXX    242
fd5e:21e:ad1c:0:XXXX:XXXX:XXXX:XXXX     5
fd90:5cdd:b6e3:0:XXXX:XXXX:XXXX:XXXX    92
fda0:747e:ab29:2196:XXXX:XXXX:XXXX:XXXX 48
fdb2:2c26:f4e4:0:XXXX:XXXX:XXXX:XXXX    2
fdbc:7dda:f921:0:XXXX:XXXX:XXXX:XXXX    1
fdcb:3fb1:918:1:XXXX:XXXX:XXXX:XXXX     12
fde6:8bfc:fdf1:0:XXXX:XXXX:XXXX:XXXX    12
fdfa:ec97:5437:0:XXXX:XXXX:XXXX:XXXX    16
fdfa:ec97:5437:0:XXXX:XXXX:XXXX:XXXX    1845
fec0:0:0:fea9:0:XXXX:XXXX:XXXX:XXXX     1


out of a total of 95258 uniq IPv6 sources (out of 5483 uniq /32s).

hth,
Emile