Massive uptick in number of flows to/from probe
Hi, Maybe coincidence with the update of the UI rolled out today, but we've seen a massive uptick in the number of flows going out from our probe up to a range of 120k flows/sec starting around 15:00 local time (CEST) Anybody else experiencing the same thing? Any ideas as to what's going on here? Thanks in advance for any clue, -ewald eingeschränkt/restricted
Hi, Define “flow” for me? Regards, Ernst J. Oud
On 2 Sep 2025, at 18:44, Jenisch Ewald <Ewald.Jenisch@oekb.at> wrote:
Hi,
Maybe coincidence with the update of the UI rolled out today, but we've seen a massive uptick in the number of flows going out from our probe up to a range of 120k flows/sec starting around 15:00 local time (CEST)
Anybody else experiencing the same thing? Any ideas as to what's going on here?
Thanks in advance for any clue, -ewald
eingeschränkt/restricted ----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-atlas.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
Define “flow” for me?
We collect flow-records from our Internet-uplink-routers, so "flow" is a netflow record coming from these routers. Best regards, -ewald eingeschränkt/restricted -----Original Message----- From: Ernst J. Oud <ernstoud@gmail.com> Sent: Dienstag, 2. September 2025 19:06 To: Jenisch Ewald <Ewald.Jenisch@oekb.at> Cc: ripe-atlas@ripe.net Subject: [EXTERN] Re: [atlas] Massive uptick in number of flows to/from probe Hi, Regards, Ernst J. Oud
On 2 Sep 2025, at 18:44, Jenisch Ewald <Ewald.Jenisch@oekb.at> wrote:
Hi,
Maybe coincidence with the update of the UI rolled out today, but we've seen a massive uptick in the number of flows going out from our probe up to a range of 120k flows/sec starting around 15:00 local time (CEST)
Anybody else experiencing the same thing? Any ideas as to what's going on here?
Thanks in advance for any clue, -ewald
eingeschränkt/restricted ----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-atlas.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
Hi, Not the most skilled network specialist here so I needed Google… “… data to analyze traffic patterns, identify bandwidth hogs, monitor network performance, and detect security threats by tracking the source, destination, and protocol of network flows. It provides details like IP addresses, ports, protocols, and packet/byte counts, but does not include the actual data packets themselves.” So what you are saying is that your probes see a larger number of packets to/from the internet, i.e. they are processing a larger number of measurement requests? I just checked some of my Atlas probes, nothing extraordinary happening. The amount of measurement requests is low, as it has always been. Say a couple per day. Regards, Ernst J. Oud
On 2 Sep 2025, at 19:28, Jenisch Ewald <Ewald.Jenisch@oekb.at> wrote:
Define “flow” for me?
We collect flow-records from our Internet-uplink-routers, so "flow" is a netflow record coming from these routers.
Best regards, -ewald
eingeschränkt/restricted -----Original Message----- From: Ernst J. Oud <ernstoud@gmail.com> Sent: Dienstag, 2. September 2025 19:06 To: Jenisch Ewald <Ewald.Jenisch@oekb.at> Cc: ripe-atlas@ripe.net Subject: [EXTERN] Re: [atlas] Massive uptick in number of flows to/from probe
Hi,
Regards,
Ernst J. Oud
On 2 Sep 2025, at 18:44, Jenisch Ewald <Ewald.Jenisch@oekb.at> wrote:
Hi,
Maybe coincidence with the update of the UI rolled out today, but we've seen a massive uptick in the number of flows going out from our probe up to a range of 120k flows/sec starting around 15:00 local time (CEST)
Anybody else experiencing the same thing? Any ideas as to what's going on here?
Thanks in advance for any clue, -ewald
eingeschränkt/restricted ----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-atlas.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
Hi Ewald (I believe we met), I see nothing extra ordinary on my 3 probes in the last week (two SW-probes behind FW on my AS, one NATted HW-probe on 8447). Traffic/packet levels in the usual range, checked FW logs. Given your organization, maybe someone got curious. Is your probe exposed or behind a FW? Rgds, MiKa On 2025-09-02 18:44, Jenisch Ewald wrote:
Hi,
Maybe coincidence with the update of the UI rolled out today, but we've seen a massive uptick in the number of flows going out from our probe up to a range of 120k flows/sec starting around 15:00 local time (CEST)
Anybody else experiencing the same thing? Any ideas as to what's going on here?
Thanks in advance for any clue, -ewald
eingeschränkt/restricted ----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-atlas.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
-- NetCaT GmbH, Bennogasse 13/5, 1080 Wien FN 433437 h, Handelsgericht Wien, UID: ATU69635335 GF: Michael Kafka, Georg Kraus
Hi, must be a coincidence in your case. I don't see an increased traffic on my probes. Both HW and SW probe quite normal traffic. // Hans -- On 02.09.25 18:44, Jenisch Ewald wrote:
Hi,
Maybe coincidence with the update of the UI rolled out today, but we've seen a massive uptick in the number of flows going out from our probe up to a range of 120k flows/sec starting around 15:00 local time (CEST)
Anybody else experiencing the same thing? Any ideas as to what's going on here?
Thanks in advance for any clue, -ewald
eingeschränkt/restricted ----- To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-atlas.ripe.net/ As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. More details at: https://www.ripe.net/membership/mail/mailman-3-migration/
Hi, On Sep 2, 2025, at 19:44, Jenisch Ewald <Ewald.Jenisch@oekb.at> wrote:
Anybody else experiencing the same thing? Any ideas as to what's going on here?
I've seen quite a bit more ICMP traffic sometime last week than usual, FWIW. Thanks, Lars
participants (5)
-
Ernst J. Oud -
Hans Mayer -
Jenisch Ewald -
Lars Eggert -
Michael Kafka