Neil Craig

We monitor traffic to www.bbc.co.uk & www.bbc.com per country & got alerts that daily requests from Angola have dropped off loads recently.

Looking at the Angola traffic split by network AS. AS36907 traffic looks suspicious! Spidey sense triggered...the "before" traffic was *way* too consistent.

Digging in to the logs, looks like they removed their Fortigates on 6th Sept. which'd been sending 343k req/day for www.bbc.co.uk/ , every single day!

Gotta love being on the internet!

#WebStats #BBC

Sep 9, 2024 at 4:25pmWeb
Show threadJaxxAISep 9, 2024
@tdp_org maybe they were using www.bbc.co.uk as some kind of destination probe to confirm the Internet was up? That calculates exactly as 4 nodes doing a call every 1 second, 24/7.
Show threadKieranSep 9, 2024
@JaxxAI @tdp_org Probably SD-WAN IPSLA health checks? Would need to be a few FortiGates + high frequency for that though.
Show threadNeil CraigSep 9, 2024
@bluekieran2 @JaxxAI Yeah I think so, it's been ages since I spoke to them about it. I think they poll every 5 or 10 seconds so doesn't take all that many really.
Show threadDJGummikuhSep 9, 2024
@tdp_org how do you monitor this traffic from the outside? @GossiTheDog also brings up all these statistics of edge traffic and I ALWAYS wonder how you even get that information when you're not the ISP or otherwise MITM on all traffic to and from that location?
Show threadMichaelSep 9, 2024
@tdp_org i love these sort of posts! Absolutely unimportant (for me) trivia that tickle my interest just right.
Show threadSkylar MacDonaldSep 9, 2024
@tdp_org this feels like a modern version of that (presumably apocryphal) story that the nuclear subs check if Radio 4 is still broadcasting to determine whether the UK has been nuked or not
Show threadFrederickSep 19, 2024
@tdp_org where do you get these logs?
Show threadNeil CraigSep 19, 2024
@securetty They're our CDN access logs