EXTERNAL: Re: Google's "unusual traffic" notification

[Djachechi, Christian N]

 I got the same message from Google her in the US, but could not figure out what the issue was. Looked at my log and did not find anything unusual. I am dual stack.

CHRISTIAN DJACHECHI, PMP | SENIOR TECHNOLOGIST 
LOCKHEED MARTIN IS&GS CIVIL EITS-CMS/CITIC

-----Original Message-----
From: ipv6-ops-bounces+christian.n.djachechi=lmco.com at lists.cluenet.de [mailto:ipv6-ops-bounces+christian.n.djachechi=lmco.com at lists.cluenet.de] On Behalf Of gall at switch.ch
Sent: Wednesday, July 24, 2013 5:51 AM
To: Philipp Kern
Cc: ipv6-ops at lists.cluenet.de
Subject: EXTERNAL: Re: Google's "unusual traffic" notification

On Wed, 24 Jul 2013 10:27:20 +0200, Philipp Kern <phil at philkern.de> said:

> On 2013-07-24 10:05, gall at switch.ch wrote:
>> A customer reported to us that many of his users have been getting 
>> the "Our systems have detected unusual traffic from your computer network"
>> message from Google since last week.  Apparently, this is only 
>> happening for IPv6, which makes me suspect that there is some kind of 
>> glitch with Google's technique for detecting what they believe is 
>> automated traffic.

> I presume it's per IP block, so it's not at all surprising that it 
> "happens only for IPv6". So are you sure that there's no automated 
> traffic happening? (Netflow should/might tell you that.)

This is not easy to find out without knowing what pattern to look for (threshold, block size) and which time period to check (depends on how long a block remains banned, which I don't know either).

>From past experience, I have developped a reflex to suspect that
something is not working as inteded when "it only happens with IPv6"
:/ That's why I try to find out if that could be the case here before pursuing other options.  Call it a hunch.

If anybody from Google is listening (Lorenzo?), maybe they could check for me if and why something in 2001:620:610::/48 is banned.

--
Alex