5 ms·

Part of CloudFlare’s arrangement with APNIC is to study this traffic. See “Enter 1.1.1.1” section on this post: https://blog.cloudflare.com/announcing-1111/ ht

Part of CloudFlare’s arrangement with APNIC is to study this traffic. See “Enter 1.1.1.1” section on this post: https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/

cpeterso 9y ago
So is all this 1.1.1.1 garbage traffic now directed to Cloudflare's servers? Or will ISPs port filter everything sent to 1.1.1.1 except DNS (and DNS-over-HTTPS) requests headed for Cloudflare?
- Arnt 9y ago
  Can't really filter out such things efficiently, so Cloudflare gets it, yes. https://www.nanog.org/sites/default/files/wed.general.trafficdiversion.serodio.10.pdf https://www.nanog.org/sites/default/files/wed.general.traffi...
  - PhantomGremlin 9y ago
    Is there still some sort of traffic "balance" requirement for settlement-fee peering? Cloudflare sends so much data out that they probably want to get more sent to them so things balance out. The more garbage traffic, the better! :) I'm totally out of my bailiwick here, it can't be that simple, can it?
- BuildTheRobots 9y ago
  >APNIC's research group held the IP addresses 1.1.1.1 and 1.0.0.1. While the addresses were valid, so many people had entered them into various random systems that they were continuously overwhelmed by a flood of garbage traffic. APNIC wanted to study this garbage traffic but any time they'd tried to announce the IPs, the flood would overwhelm any conventional network. >We talked to the APNIC team about how we wanted to create a privacy-first, extremely fast DNS system. They thought it was a laudable goal. We offered Cloudflare's network to receive and study the garbage traffic in exchange for being able to offer a DNS resolver on the memorable IPs. And, with that, 1.1.1.1 was born. Cloudflare and APNIC seem to both assume the traffic is going to now hit cloudflare. Trying to block everything but DNS makes no sense at all; how can/should ISPs be keeping track of which services someone chooses to run on their IP address? Edit: Turns out Cloudflare aren't just running DNS; they're hosting a http/s webpage with instructions on how to use their DNS too, so you've gotta hope people aren't filtering: https://1.1.1.1/ https://1.1.1.1/

cpeterso 9y ago

So is all this 1.1.1.1 garbage traffic now directed to Cloudflare's servers? Or will ISPs port filter everything sent to 1.1.1.1 except DNS (and DNS-over-HTTPS) requests headed for Cloudflare?

Arnt 9y ago
Can't really filter out such things efficiently, so Cloudflare gets it, yes. https://www.nanog.org/sites/default/files/wed.general.trafficdiversion.serodio.10.pdf https://www.nanog.org/sites/default/files/wed.general.traffi...
- PhantomGremlin 9y ago
  Is there still some sort of traffic "balance" requirement for settlement-fee peering? Cloudflare sends so much data out that they probably want to get more sent to them so things balance out. The more garbage traffic, the better! :) I'm totally out of my bailiwick here, it can't be that simple, can it?
BuildTheRobots 9y ago
>APNIC's research group held the IP addresses 1.1.1.1 and 1.0.0.1. While the addresses were valid, so many people had entered them into various random systems that they were continuously overwhelmed by a flood of garbage traffic. APNIC wanted to study this garbage traffic but any time they'd tried to announce the IPs, the flood would overwhelm any conventional network. >We talked to the APNIC team about how we wanted to create a privacy-first, extremely fast DNS system. They thought it was a laudable goal. We offered Cloudflare's network to receive and study the garbage traffic in exchange for being able to offer a DNS resolver on the memorable IPs. And, with that, 1.1.1.1 was born. Cloudflare and APNIC seem to both assume the traffic is going to now hit cloudflare. Trying to block everything but DNS makes no sense at all; how can/should ISPs be keeping track of which services someone chooses to run on their IP address? Edit: Turns out Cloudflare aren't just running DNS; they're hosting a http/s webpage with instructions on how to use their DNS too, so you've gotta hope people aren't filtering: https://1.1.1.1/ https://1.1.1.1/