4 ms·
> any service such as Cloudflare would need to be extremely aggressive in blocking Cloudflare needs an algorithm to deduce the IPv6 prefix size controlled by a
by p1mrx 3y ago
> any service such as Cloudflare would need to be extremely aggressive in blocking
Cloudflare needs an algorithm to deduce the IPv6 prefix size controlled by a given entity, but the details of that algorithm are not obvious. You are jumping to the conclusion that they must be doing a bad job because the problem is challenging.
IPv4 abuse detection is also challenging because of (e.g.) the prevalence of CGNAT with multiple users sharing an IP address.
Which problem is harder? Which solution is better? I don't know, without a lot of proprietary data and analysis.
- tomschlick 3y agoI would imagine they have a list of the default / max DHCPv6 blocks that ISPs hand out. They are generally public knowledge so it would be easy for them to say Comcast hands out /56 so when blocking they block at that level for the ASN.
- p1mrx 3y agoIt probably makes more sense to derive that information from measurements. There are a lot of ISPs in the world, and allocation policies can change, even if you manage to find a person who knows what they are.