On Thu, 25 Oct 2012, Emanuele Balla (aka Skull) wrote:
At the end, everything will be about how fast abusive/infected machines
will move around the address space:
1) from one IP to another inside their own /64
2) from one /64 to another
3) from one ISP to another, particularly where showshoe-like schemes are
in place
I believe it's going to be common enough that legitimate MTAs will move
around within their /64 quite frequently (privacy extensions that are
default on in Windows for instance), means outgoing IPv6 address will move
to a new outgoing address every N hours (where N is somewhere between
1-48, I don't know exactly).
--
Mikael Abrahamsson email: swmike(_at_)swm(_dot_)pp(_dot_)se
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg